How Rite Aid’s Facial Recognition System Led to Harassment and What It Means for Consumers

Introduction

Facial recognition technology (FRT) is a powerful tool that can identify and verify people based on their faces. It has many potential applications, such as enhancing security, improving customer service, and personalizing experiences. However, FRT also poses significant risks for consumers, such as invading their privacy, violating their consent, and discriminating against them based on their characteristics.

One of the most controversial cases of FRT misuse in the US involved Rite Aid, one of the largest drugstore chains in the country. Rite Aid secretly installed FRT systems in hundreds of its stores across the US, without informing or obtaining consent from its customers. The FRT systems were used to scan the faces of every customer entering the store, and compare them with a database of people who had previously been involved in shoplifting or other crimes. If a match was found, the system would alert the store staff, who would then monitor and harass the customer, regardless of whether they had done anything wrong.

This article will explore how Rite Aid’s FRT program violated consumer privacy and civil rights, and what legal actions were taken to stop it. It will also analyze the implications of Rite Aid’s FRT program for consumers’ rights and expectations in relation to FRT use, and provide some recommendations or best practices for consumers who want to avoid or minimize FRT misuse.

The Problem

Rite Aid’s FRT program started in 2012, and expanded to more than 200 stores in 12 states by 2020 . The FRT systems were supplied by a company called DeepCam, which claimed to have ties with the Chinese government and military . The FRT systems were mostly installed in low-income and non-white neighborhoods, where Rite Aid believed crime rates were higher . This resulted in a disproportionate targeting of people of color, who were more likely to be flagged by the FRT systems and subjected to scrutiny and intimidation by the store staff .

Rite Aid’s FRT program raised serious privacy concerns among consumers, who were unaware that their faces were being scanned and stored by the company. Rite Aid did not disclose its FRT program to the public, nor did it provide any notice or opt-out option to its customers. Rite Aid also did not have a clear policy or procedure for how it collected, used, shared, or protected the facial data of its customers. Rite Aid did not obtain consent from its customers before scanning their faces, nor did it inform them of their rights or choices regarding FRT use. Rite Aid also did not ensure the accuracy or reliability of its FRT systems, which could result in false positives or false negatives, leading to wrongful accusations or missed detections of criminal activity.

Rite Aid’s FRT program also violated consumer civil rights, as it discriminated against customers based on their race, gender, age, or other characteristics. Rite Aid’s FRT systems were biased and inaccurate, as they were trained on a limited and skewed dataset of faces, which did not reflect the diversity of the population. Rite Aid’s FRT systems were also prone to errors and glitches, as they were affected by factors such as lighting, angle, expression, or accessories. Rite Aid’s FRT systems were also influenced by human judgment and prejudice, as they relied on the store staff to confirm or reject the matches generated by the FRT systems. Rite Aid’s FRT program created a hostile and unsafe environment for customers, who were treated as suspects and criminals, rather than as valued and respected patrons.

The Solution

Rite Aid’s FRT program was exposed and challenged by several media outlets, civil rights groups, and consumer advocates, who investigated and reported on the FRT systems installed in Rite Aid stores, and demanded that Rite Aid stop using FRT and delete the facial data of its customers . Rite Aid’s FRT program also attracted the attention and scrutiny of the Federal Trade Commission (FTC), the US agency responsible for protecting consumer rights and enforcing consumer protection laws.

The FTC launched an investigation into Rite Aid’s FRT program, and found that Rite Aid had violated several consumer protection laws by failing to protect the medical and financial privacy of its customers. The FTC alleged that Rite Aid had collected and stored sensitive personal information of its customers, such as their names, addresses, phone numbers, prescription records, credit card numbers, and facial images, without adequate security measures or safeguards. The FTC also alleged that Rite Aid had shared this information with third parties, such as DeepCam, without proper authorization or oversight. The FTC also alleged that Rite Aid had deceived its customers by not disclosing its FRT program or obtaining their consent before scanning their faces.

The FTC filed a complaint against Rite Aid, and reached a settlement with the company in 2023. The settlement required Rite Aid to:

• Establish a comprehensive information security program designed to protect the personal information it collects from consumers, and obtain independent audits of its program every two years for the next 20 years.
• Cease using FRT in its stores, and delete all the facial data of its customers that it had collected or stored.
• Notify its customers of its FRT program and the FTC settlement, and provide them with an opportunity to request a copy of their facial data or file a complaint with the FTC.
• Pay a civil penalty of $10 million to the FTC, which will be used to provide redress to the consumers harmed by Rite Aid’s FRT program.

In addition to the FTC action, Rite Aid also faced several state-level laws that regulate FRT use in different jurisdictions. For example, in California, the California Consumer Privacy Act (CCPA) gives consumers the right to know what personal information a business collects, uses, shares, or sells, and the right to opt out of the sale of their personal information. In Illinois, the Biometric Information Privacy Act (BIPA) requires businesses to obtain written consent from consumers before collecting or using their biometric information, such as their facial images. In New York, the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) requires businesses to implement reasonable security measures to protect the personal information of consumers, and to notify consumers and authorities in case of a data breach.

The Future

Rite Aid’s FRT program has significant implications for consumers’ rights and expectations in relation to FRT use. Rite Aid’s FRT program demonstrates the potential harms and abuses of FRT for consumers, such as privacy invasion, consent violation, and discrimination. Rite Aid’s FRT program also highlights the need for consumer awareness and empowerment in facing FRT challenges, such as consent, transparency, accountability, and choice.

Consumers have the right to know how FRT is used by businesses, and to have a say in how their facial data is collected, used, shared, or protected. Consumers also have the right to be treated fairly and equally by FRT, and to be free from harassment or discrimination based on their facial features. Consumers also have the right to seek redress or remedy in case of FRT misuse or harm.

Consumers have the expectation that FRT will be used in a responsible and ethical manner by businesses, and that FRT will provide benefits and value for consumers, rather than harms and risks. Consumers also have the expectation that FRT will be accurate and reliable, and that FRT will respect and protect their dignity and identity. Consumers also have the expectation that FRT will be regulated and supervised by authorities, and that FRT will comply with the laws and standards that apply to FRT use.

Consumers have the choice to opt in or opt out of FRT use by businesses, and to control how their facial data is used or shared. Consumers also have the choice to use alternative methods of identification or verification, such as passwords or PINs, rather than FRT. Consumers also have the choice to use tools or techniques to avoid or minimize FRT detection, such as masks, sunglasses, or makeup.

Conclusion

Rite Aid’s FRT program was a case of FRT misuse that violated consumer privacy and civil rights, and resulted in consumer harassment and discrimination. Rite Aid’s FRT program was stopped by the FTC, which ordered Rite Aid to pay a penalty, delete the facial data of its customers, and establish a security program to protect the personal information of its customers. Rite Aid’s FRT program also faced state-level laws that regulate FRT use in different jurisdictions.

Rite Aid’s FRT program shows the importance of consumer awareness and empowerment in relation to FRT use. Consumers have the right, the expectation, and the choice to decide how FRT is used by businesses, and to protect themselves from FRT misuse or harm. Consumers should be informed and involved in FRT decisions, and should demand and exercise their rights and choices regarding FRT use.

What do you think of Rite Aid’s FRT program and its impact on consumers? Do you agree or disagree with the FTC’s action and the state-level laws? How do you feel about FRT use by businesses in general? Share your thoughts and opinions in the comments