The setting
The US Federal Trade Commission brought a complaint about Rite Aid’s facial-recognition practices in December 2023. Read the regulator’s allegations alongside the modified settlement order, which contains a neither-admit-nor-deny provision.
The decision context
A historical enforcement case about image quality, testing and operational reliance. Allegations in the complaint are not presented as findings after a contested trial, and settlement terms are not evidence of later compliance.
The evidence to examine
Reported evidence
Regulator allegations: input quality and testing
The FTC alleged use of poor-quality enrolment images and a failure to assess accuracy before deployment, including during a pilot.
Source: US Federal Trade Commission, FTC v. Rite Aid: complaint (2023) · Paragraph 22 and paragraphs 50–55 ↓Reported evidence
Regulator allegation: uneven errors
The FTC alleged a failure to assess or monitor whether accuracy varied by the subject’s race or gender.
Source: US Federal Trade Commission, FTC v. Rite Aid: complaint (2023) · Paragraph 43 ↓Reported evidence
Settlement terms
The modified order specifies a five-year facial-recognition prohibition, deletion requirements and a monitoring programme for covered biometric systems. It states that the respondents neither admit nor deny the allegations, subject to its stated exceptions.
Source: US Federal Trade Commission, Rite Aid: modified decision and order (2024) · Introductory findings; sections I–III ↓What this does not establish
A complaint records allegations; a settlement imposes terms without establishing every allegation through a trial. These materials do not provide a general deployment threshold, a current compliance assessment or a calculation of the prohibition’s remaining duration.
Try the decision first
Your task.
What controls are needed before staff may act on an alert, and what should happen when a control fails?
- Map capture, watchlist enrolment, matching, staff interpretation and action as separate stages. Identify where a person could be wrongly accused and what evidence would reveal it.
- Specify input-quality checks, deployment-like testing and trained review with correction authority. Include group coverage, denominators, complaints and records of remedial action.
- Define who can stop reliance, remove an unreliable enrolment and investigate an incident. Distinguish a proposed local control from a remedy actually specified in the order.
Read one defensible approach
AIPEX analysis for discussion. Other conclusions can be defensible if their evidence, assumptions and trade-offs are explicit.
- Treat the alert as a claim requiring investigation, rather than an established identity or wrongdoing. The policy problem includes staff behaviour and the enrolment process, not only the model.
- Require evidence that controls detect errors under actual capture conditions. A supplier disclaimer or nominal human reviewer does not demonstrate effective checks.
- Give an operational owner authority to suspend reliance and remedy errors. Use the settlement as a concrete control-design reference, while checking the rules applicable to any different organisation or jurisdiction.
Read the evidence / Reviewed 18 October 2026
Sources & scope.
AIPEX’s prompts and worked approaches are our own synthesis. Use the linked material to examine the method and its limits.
- US Federal Trade Commission
FTC v. Rite Aid: complaint (2023) ↗
19 December 2023; paragraphs 22, 43 and 50–55 on image quality, demographic monitoring and pre-deployment testing
A regulator's allegations, not findings established after a contested trial. Read alongside the settlement document; it neither provides a universal error threshold nor evaluates current products.
- US Federal Trade Commission
Rite Aid: modified decision and order (2024) ↗
Introductory findings; sections I (five-year prohibition), II (deletion), III (monitoring programme)
Settlement terms, including a neither-admit-nor-deny provision. The prohibition is measured from the order's effective date; this historical case does not calculate its present status or infer later compliance.
- NIST
AI Risk Management Framework: Core ↗
GOVERN 1–3, 5–6; MAP 1–2; MEASURE 2–3; MANAGE 2–4
A voluntary US framework for organising risk management. It does not establish legal authority or certify a deployment as safe.