Rite Aid scanned every shopper's face, and mostly flagged the innocent

The matcher at the door

Between 2012 and 2020, the drugstore chain Rite Aid ran facial-recognition surveillance in hundreds of its stores. It captured the face of nearly every customer who walked in and checked it against a private watchlist of people it had flagged as suspected shoplifters or troublemakers.¹

Here is how the FTC says it worked. A camera took a live image of each entering shopper. Software compared it against an enrollment database of people Rite Aid called persons of interest, checking the new face against every face on the list. When it declared a shopper the same person as someone enrolled, above a confidence threshold Rite Aid set, it sent a match alert to a store employee's phone. The alert showed the two images and a pre-set instruction, most often “Approach and Identify.”²

Reuters, which uncovered the program in 2020 from its own store visits and internal documents, found the cameras in about 200 stores, one of the largest such rollouts by any U.S. retailer.³ Almost everything else known about the system comes from the FTC's December 2023 complaint, which Rite Aid settled without admitting or denying it.⁴ Treat the specifics that follow as the agency's charges, not a court's findings.

The FTC says those enrollments came from CCTV stills, phone photos, and driver's-license images, kept indefinitely.²

What the false alerts did to shoppers

By the FTC's account, employees acted on the alerts. They followed shoppers through stores, stopped and searched them, refused to let them fill prescriptions or buy medicine, accused them out loud in front of coworkers, employers, and children, and called the police.² The people this happened to had done nothing. The match was wrong.

The complaint describes specific stops. In one, employees stopped and searched an 11-year-old girl on the strength of a false match; the complaint says she was so shaken that her mother had to miss work.² In another, the system matched a Black woman to an enrollment that employees themselves had recorded as a white woman with blonde hair. The police were called, and she was asked to leave, before anyone realized the match was false.² These accounts come only from the FTC. Rite Aid did not admit them. One shopper wrote to the company that “every black man is not [a] thief nor should they be made to feel like one.”²

Banned for five years

Rather than fight the charges, Rite Aid settled. Under the order, it is barred for five years from using any facial recognition in its stores or pharmacies. It had to delete the shopper images it collected “and any data, models, or algorithms derived” from them, and certify the deletion under oath. If it ever deploys another automated biometric system, it must first test the system's accuracy, measure whether the errors vary by demographic group, notify the people enrolled, and post clear notice in stores.⁴ The FTC's consumer-protection director, Samuel Levine, called it “Rite Aid's reckless use of facial surveillance systems.”¹

The settlement resolves the case without any ruling that the allegations are true. Rite Aid “neither admit[ted] nor den[ied]” the FTC's claims, and the order was entered while the company was in Chapter 11 bankruptcy.⁴ Rite Aid's own account differs sharply from the FTC's.

Two of those claims sit badly with the record. Start with “pilot.” The FTC alleges the technology ran in hundreds of stores. Reuters, reporting three years earlier, documented it in roughly 200, and found stores in poorer areas nearly three times as likely to carry the cameras as wealthier ones.¹³ Then the shutdown. Rite Aid frames it as its own choice. The FTC alleges the company stopped “only after” it learned press coverage was imminent, and Reuters records that Rite Aid said it quit only once Reuters sent it the findings.²³ What would settle the disputes was never made public: the actual match logs, and any measured error rate for Rite Aid's own system.

Why most of the alerts were wrong

The core problem was not that the software was unusually bad. A watchlist looks for something rare in a huge stream of ordinary faces, and rare targets defeat even an accurate matcher. Work it through with round, illustrative numbers, since Rite Aid never measured the real one.

Say the software is right about any single face-to-face comparison 99,999 times out of 100,000, a false-match rate of one in 100,000. That is the kind of benchmark NIST uses in its testing, and it sounds almost perfect.⁸ But a watchlist does not run one comparison. It runs one for every face enrolled. Check an innocent shopper against 10,000 enrolled faces and the chance that at least one comes back a false match is about one in ten. Send a thousand shoppers through the door in a day and roughly a hundred of them draw a false alert. Someone from the watchlist is a rare visitor; maybe one walks in that day. So the store collects about a hundred wrong alerts for every right one.

That is the base-rate problem. When the target is rare, even a tiny per-scan error rate produces far more false alarms than true hits, because the errors come from a huge pool of innocent faces and the true hits do not. The system can be right about almost every comparison and wrong about almost every alert at once.

Rite Aid's own numbers point the same way. The FTC alleges that in one eight-month window a single enrolled image generated more than 900 alerts in five days, across more than 130 stores.² Over 5,000 alerts fired more than 100 miles from where the person was enrolled, matches to people who could not have been there.² And the company could not count its false positives at all: employees left about two-thirds of alerts unresolved, so the outcomes went unrecorded.²

Nothing in the deployment caught this. By the FTC's account, Rite Aid ran no accuracy testing, before rollout or after. It fed the system blurry, poorly lit images that raise false matches. Training ran an hour or two and skipped the technology's limits. The alerts told staff to act while hiding the confidence score.² The vendors, for their part, said in writing not to trust the output.

Then there is who the false alerts land on. In 2019 the government's own testing measured face-matching across 189 algorithms and found that false-match rates vary sharply by demographic group, often by factors of 10 to more than 100. But not in every algorithm: a few systems it tested showed no such gap at all.⁸ Rite Aid used low-quality store-camera images and unnamed algorithms, and, by the FTC's account, never checked whether its own error rate differed by race or gender.² The complaint's demographic evidence is circumstantial: the cameras sat disproportionately in non-white neighborhoods, and alerts in plurality-Black and Asian areas carried lower confidence scores, which were more often false.¹² So the honest reading is narrow. NIST did not prove that Rite Aid misread Black or women shoppers by any particular factor. But demographic skew in false matches is real and often large. Rite Aid never checked which kind of system it had. So the flood of false alerts from its base-rate problem would fall hardest on the groups a skewed matcher misreads most.

Where the same weakness runs now

Rite Aid's cameras are off, but the base rate that undid them is a property of the setup, not of Rite Aid. Any system that scans a whole crowd to find a few faces meets it: a store floor, a stadium or concert gate, an airport line, a police search of one photo against a database of millions. The true targets are rare and the innocent faces are many, so most alerts come back wrong. Where the matcher misreads some groups more than others, the wrong alerts fall on them.⁸

The order made Rite Aid do the thing it never did: prove a system's accuracy, and measure whether its errors skew by group, before it may scan a shopper again.⁴ That requirement is specific to Rite Aid. The arithmetic that made its cameras dangerous never was.