A photo match does not prove theft. The Rite Aid pharmacy case shows how recognition errors harm shoppers when staff act without sufficient checks.

What happened

The FTC (US Federal Trade Commission) alleged that Rite Aid failed to protect shoppers adequately. In 2012–2020, the chain used facial recognition to identify people it associated with wrongdoing. Its complaint, filed on 19 December 2023, described false matches leading to surveillance, demands to leave, public accusations and police calls. It also cited inadequate accuracy testing and staff training. FTC release.

One database entry triggered over 900 alerts in five days across over 130 stores. These are alerts, not proven thefts or victims. Such results require checking each match's circumstances. Complaint, paragraph 31(b).

On 23 February 2024, the court approved a stipulated order. With specified exceptions, defendants neither admitted nor denied the allegations: settlement does not automatically establish every complaint detail. Order, pages 2–4.

Where to draw the line

The system's task is to help prevent wrongdoing. Yet many alerts may mean many errors. To assess usefulness, we propose checking how many alerts were confirmed, what actions followed and whether mistaken decisions were corrected. These are proposed criteria, not Rite Aid's metrics.

Even correct identification does not prove a new offence. Both the match and what the person actually did need checking.

Assessment under the Code

This is an editorial analysis using the project's Code, not a Sharia audit of the company.

PrincipleObservation from FTC materialsAssessmentProposed action
2.1.8: reliabilityFalse matchesAn alert cannot justify an accusation aloneVerify data and circumstances
2.2.26: protecting honourPublic accusationsReputational harm riskRequire evidence before calling shoppers offenders
2.3.9: fairnessUnequal impact of errorsOverall accuracy conceals differencesCheck consequences across groups
2.2.33: appealMistaken access restrictionsReview neededAssign responsibility for complaints

What to change

These recommendations do not describe measures implemented by Rite Aid:

  • Test under real conditions, including poor lighting and low-quality images.
  • Define permitted staff actions beforehand and empower staff to stop mistaken decisions.
  • Link alerts, verification results and subsequent actions in a protected log.
  • Explain how shoppers can reach someone able to correct records and reverse restrictions.
  • Provide for stopping the system when harm recurs, consistent with Code provision 2.2.4.

Outcome and limitations

The FTC case page states that settlement provides for a five-year ban on Rite Aid using facial recognition for security or surveillance. Case page.

The documents require safeguards for automated biometric systems, notices and complaint handling. Requirements alone do not prove improvement: reviewed materials do not establish a percentage reduction in errors. This analysis covers the 2012–2024 episode. Order and Appendix A.

For educational purposes; not a fatwa, audit or legal advice.