What's documented: the ban that outlived its target

Reuters first reported it in 2020: Rite Aid had deployed facial recognition technology in roughly 200 stores from 2012 to 2020, concentrated in lower-income neighborhoods and neighborhoods that were majority Black, Latino, or Asian — in Los Angeles and New York, stores in those areas were about three times more likely to have the system than stores in wealthier ones. In a third of the stores Reuters visited, there was no posted notice of any kind. Rite Aid quietly stopped after that reporting.

The FTC filed its own complaint three years later, calling the program "reckless" — a direct quote from the FTC's own Bureau of Consumer Protection director — run without meaningful testing or accuracy checks, and generating thousands of false-positive matches. (Some press coverage at the time additionally called it "covert"; that specific word isn't in the FTC's own complaint, though the underlying facts — no meaningful public notice, employees told not to disclose it — support the characterization.) Employees acted on those false alarms — following, confronting, and searching customers who had done nothing. The complaint itself documents one specific case, verbatim: an 11-year-old girl was stopped and searched based on a false match; her mother told Rite Aid she'd missed work because her daughter was too distraught by the incident. Rite Aid had also told its own employees not to disclose the program to customers or the press.

In December 2023, the FTC banned Rite Aid from using any facial recognition system for security purposes for five years, and ordered it to delete every image and every algorithm built from them — a settlement in which Rite Aid didn't admit to the FTC's allegations, standard for this kind of consumer-protection order. There was no fine, likely because Rite Aid was already in bankruptcy proceedings at the time, though neither the FTC's order nor its press release states that connection explicitly.

Rite Aid didn't recover. It emerged from that Chapter 11 in September 2024, filed a second one in May 2025, and by October 2025 had liquidated entirely — closing its last roughly 89 stores after 63 years in business. The five-year ban had just over three years left to run against a company that no longer existed.

Who's actually doing this right now — and the honest answer is: unclear

As of January 2026, Wegmans confirmed it runs facial recognition in a small number of Manhattan and Brooklyn stores, specifically to identify people previously flagged for misconduct — and posts the legally required signage under New York City's biometric-notice law. Lowe's has also confirmed current use, to identify suspected shoplifters.

Nearly everyone else — Walmart, Kroger, Costco, Home Depot, CVS, Walgreens, Target, Best Buy, Macy's — will not confirm or deny whether they use it. That's a materially different posture than five years ago, when some of the same companies were more openly named as users in advocacy scorecards. Whether that reflects programs that quietly ended or programs that quietly went undisclosed isn't something this piece can settle — it's genuinely unresolved, and worth being honest about rather than guessing.

What is documented is a serious case out of Texas: Harvey Eugene Murphy Jr. was arrested in October 2023 after facial recognition at a Sunglass Hut kiosk wrongly matched him to a 2022 armed robbery suspect. He sued in January 2024, alleging he was assaulted while jailed before an alibi placing him in California cleared him. That's an allegation in a filed complaint, not a court finding; there's no resolution yet. It's the most serious documented wrongful-detention claim outside the Rite Aid case.

The other lane: what your loyalty card actually does

This is a separate system from facial recognition, and Consumer Reports did the work of showing exactly how it operates. In a 2025 investigation, a Kroger customer used an Oregon data-access law to request their own shopper profile — and found it had been shared with more than 50 companies, including one of the country's largest data brokers, tobacco companies, a financial institution, a healthcare-tech firm that works with insurers, and a fintech that processes SNAP and EBT payments for the federal government. The profile itself included an "income predictor," an inferred education level, and a brand-loyalty classification — used in part to determine which discounts that specific shopper gets shown.

Kroger's broader "alternative profit" business — anchored by its data and advertising arm, sold through a subsidiary called 84.51° and an ad network called Kroger Precision Marketing, but also including other non-grocery revenue like financial services — now tops 35 percent of Kroger's total net income, according to Consumer Reports' own reporting. Groceries are not where the money's shifting.

Maryland became the first state to specifically restrict this kind of "surveillance pricing" in 2026 — but the law explicitly exempts loyalty and rewards programs, as long as enrollment is technically voluntary. Consumer advocates called that carve-out a hole big enough to walk the whole practice through, since the loyalty card is the primary way this data gets collected in the first place.

The "smart shelf" gap between the pitch and reality

Cooler Screens sold retailers on digital ad screens that replaced cooler doors and claimed to detect a shopper's age, gender, and emotional reaction using onboard cameras — the company claimed tens of millions of monthly viewers across its screen network as it scaled between 2021 and 2024. Walgreens installed more than 10,000 of them across 700 stores starting in 2019. By August 2024, all of them were gone: the screens reportedly malfunctioned, showed the wrong inventory, and in some cases caught fire. Cooler Screens sued Walgreens for $200 million over the contract; the company separately faces its own Illinois biometric-privacy lawsuit (Roberts v. Cooler Screens) over the same cameras.

Amazon's "Just Walk Out" checkout-free technology had a similar gap between the pitch and the mechanics. Reporting in 2024 — originally from The Information, corroborated by NBC News and other outlets — found the "AI-powered" system relied on roughly 1,000 human reviewers, based in India, manually checking about 700 of every 1,000 transactions — far more than the 50-per-1,000 target Amazon had set internally. Amazon publicly disputed that framing as "erroneous" and denied relying on live human video review, while not disputing the underlying figures. Amazon pulled the technology out of its Amazon Fresh and Whole Foods stores that year, keeping it mainly for smaller kiosk-style locations.

What this piece is not saying

This isn't saying every retailer refusing to confirm or deny facial recognition use is currently running it — the honest answer for most named companies is simply unknown, not concealed. It isn't saying the Murphy/Sunglass Hut allegations are proven — they're a filed complaint that hasn't been resolved. It isn't claiming Kroger did anything illegal by selling shopper data through 84.51° — the practice is disclosed, if not clearly, in a privacy policy most customers never read; the objection here is about how little most people understand about it, not that Kroger broke a law doing it. And it isn't saying Cooler Screens' or Amazon's technology never works — both are real, deployed systems; the point is that the "AI" pitch and the actual mechanics weren't the same thing.

What can I do

There is no individual switch to turn off a store's facial recognition system — it applies to anyone who walks in, and most retailers won't even confirm whether it's running. New York City is the one place with a law forcing a posted sign; everywhere else, you're relying on a company's own disclosure, which is often nothing.

For loyalty programs, the honest trade is this: declining to use a card commonly means paying a higher shelf price at checkout, so opting out entirely has a real cost. Two things do work, imperfectly: in roughly 20 states with their own consumer privacy laws, you have a legal right to request a copy of what a company has collected on you and to opt out of your data being used for targeted advertising — a real lever, though it requires actively filing the request, and it doesn't undo collection that's already happened. And using a separate email address for store apps and loyalty sign-ups keeps that data from linking back to everything else tied to your main address.

Why this is a BL:UF story

Two different systems, two different failures. One watched people's faces without telling them, got it wrong on a false-positive basis often enough to matter, and the company running it collapsed before its own punishment finished playing out. The other doesn't watch your face at all — it just turns your grocery list into an income estimate and sells it to a tobacco company, with a law on the books now that specifically protects the exact program that makes it possible.

The Receipts

Full sourcing detail, including single-sourced flags, is in the dedicated retail-surveillance research pass referenced in this file's status header.