Learn from the FTC’s Rite Aid facial recognition case before deploying face-matching watchlists

In December 2023 the FTC announced a proposed order banning Rite Aid from facial recognition surveillance for five years. The FTC alleged false matches from low-quality images, no accuracy testing or false-positive tracking, and poor training, and the order would require notice, complaint handling and deletion.

Source facts

The FTC announced that Rite Aid would be prohibited from using facial recognition for surveillance purposes for five years to settle charges that it failed to implement reasonable procedures. The complaint says the system, used from 2012 to 2020, generated thousands of false-positive matches, and that employees acting on them followed, searched or publicly accused consumers.

According to the complaint, Rite Aid failed to test or document the technology’s accuracy before deploying it, failed to prevent the use of low-quality images, failed to monitor accuracy or track the rate of false positive matches after deployment, and failed to adequately train employees that the technology could generate false positives. Its image database drew on security cameras, employee phone cameras and news stories.

The proposed order would also require Rite Aid to notify consumers when their biometric information is enrolled and when it takes action against them based on the system, give clear and conspicuous notice of biometric surveillance in stores, investigate complaints in writing, and delete biometric information within five years. The FTC said the order would take effect after approval by the bankruptcy and federal district courts.

Applicability

Use this for any deployment that matches faces against a watchlist. The facts are the FTC’s allegations and the terms of a proposed order announced in December 2023; state biometric laws, such as Illinois BIPA, may impose further requirements.

DSE recommendation

DSE recommends that no face-matching watchlist go live without documented accuracy testing, image-quality rules, false-positive tracking, trained operators and customer notice. Require vendors to provide accuracy test results for conditions like yours, reject enrollment images below a set quality, record every alert and its outcome, and require a human check before any action toward a customer. Post clear notice, set a deletion period for enrolled images, and give people a way to complain.

Verification

Review the alert log monthly for false-positive rates by store and by demographic indicators where lawful, audit a sample of enrollments for image quality and documented reason, and confirm notice signage and deletion jobs are in place.

Official reference

Federal Trade Commission — Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards. Reviewed October 18, 2026.