Court Rules
All enforcement actions
Consent DecreeHigh Risk

FTC Bans Rite Aid from AI Facial Recognition for 5 Years Over Biometric Harms

Rite AidDecember 19, 2023Federal Trade Commission

Summary

The FTC settled charges that Rite Aid deployed AI facial recognition technology in hundreds of stores from 2012 to 2020 without reasonable safeguards, resulting in false-positive matches that disproportionately harmed women and people of color. The proposed order bans Rite Aid from using facial recognition for surveillance for five years and requires comprehensive biometric data safeguards, data deletion, consumer notifications, and a certified security program.

Remedy

Rite Aid is banned from using facial recognition for surveillance for five years, must delete all collected biometric images and derived algorithms, provide clear notice to consumers about its use, notify consumers when actions are taken based on the system, implement a comprehensive data security program overseen by executives, obtain independent third-party security assessments, and provide annual CEO certifications.

BanInjunctionConsent DecreeData DeletionCorrective NoticeCompliance ProgramAudit RequirementReporting Requirements

Laws Cited

FTC Act Section 52010 Commission data security order

Violation Types

Entity Details

Entity

Rite Aid

Industry

Retail

Official Sources

Related Enforcement Actions

FTC

Air AI

$18.0M

Consumer fraud enforcement action where the FTC settled with Air AI for misleading entrepreneurs with false earnings and refund guarantees. The company will be banned from marketing business opportunities and pay a suspended $18 million judgment with $50,000 for consumer relief. Violations included failure to provide required disclosures and false claims under the Telemarketing Sales Rule and Business Opportunity Rule.

FTC

Xponential Fitness

$17.0M

Consumer fraud enforcement action where the FTC settled with Xponential Fitness for violating the Franchise Rule by misrepresenting key information to franchisees, including time to open and costs. The settlement includes a $17 million monetary judgment for redress and prohibits future misrepresentations.

FTC

97 Auto Dealership Groups

Consumer fraud and advertising enforcement action where the FTC sent warning letters to 97 auto dealership groups for deceptive pricing practices, such as advertising prices that exclude mandatory fees, misleading consumers about total costs. The letters stress the need for truthful and transparent pricing in the automotive industry.

FTC

Walmart, Inc.

$100.0M

The FTC and 11 states settled with Walmart for $100 million over deceptive earnings claims in its Spark Driver gig worker app, where drivers were misled about base pay, tips, and incentives. The settlement also addressed GLBA violations for failing to provide proper notice regarding the handling of drivers' financial information. Walmart must implement an earnings verification program and is banned from misrepresenting driver earnings.

FTC

Website and Online Service Operators

The FTC issued a policy statement announcing it will not enforce COPPA against operators that collect age verification data under specific conditions. The policy aims to encourage the use of age verification technologies to protect children online. Operators must limit data use, ensure security, provide notice, and use accurate verification methods.

FTC

Operators of General Audience and Mixed Audience Sites and Services

The FTC issued a policy statement announcing that it will not enforce the COPPA Rule against website and online service operators that use age verification technologies solely to determine user age, provided they comply with conditions such as limiting data use, ensuring security, and providing clear notice. This policy aims to incentivize age verification tools to protect children online.