What Rite Aid does with your data

What it collects and does with your data

• FTC complaint: from 2012 to 2020 Rite Aid used AI facial recognition in hundreds of stores to flag suspected shoplifters, built a database of tens of thousands of often low-quality images (security cameras, employee phones, news stories), generated thousands of false-positive matches, was more likely to generate false positives in plurality-Black and Asian communities, did not tell consumers, and discouraged employees from revealing the technology.
• The Markup and KFF Health News documented Rite Aid sending Facebook answers to vaccine-eligibility health questions (December 2022) and the names of patients' specific prescriptions, still observed on 2023-06-23.
• Rite Aid closed its remaining stores after its second Chapter 11 filing (May 2025); pharmacy services were sold to CVS, Walgreens, Albertsons, and Kroger.
• Rite Aid sought bankruptcy court approval to sell intangible assets, including customer loyalty data, trademarks, domain names, and mobile apps, for $7.8M to Rite Aid LLC (also known as PMDLabs Inc.).
• Hilco (sale agent) reports the brand, RiteAid.com, private-label brands, and front-end consumer loyalty data sold in a single transaction for $7.8M; prescription files were excluded.
• The Rite Aid brand now operates online, offering blood testing and saying pharmacy services are coming back.

Sensitive data

• biometrics/face (facial recognition 2012 to 2020)
• health/pharmacy (prescription names sent to Facebook per The Markup)
• loyalty data sold as a bankruptcy asset

Enforcement and litigation

2 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• FTC action (federal court complaint plus a modified 2010 FTC data-security order): five-year ban on facial recognition for surveillance, deletion of images and derived algorithms, consumer notice requirements, and an information security program. Settled.
• Proposed class action (California, filed February 2023) alleging Rite Aid's website sent Facebook vaccine-appointment health answers; Rite Aid moved to dismiss; outcome not found.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 8. Floor from named parties: Rite Aid estate, Rite Aid LLC/PMDLabs, CVS, Walgreens, Albertsons, Kroger, Meta, and at least one facial recognition vendor. Which pharmacy buyer holds a given customer depends on the store, so one person is likely in fewer than all.

Third parties: Named: Rite Aid LLC / PMDLabs Inc. (loyalty data buyer); CVS, Walgreens, Albertsons, Kroger (pharmacy buyers); Meta (pixel recipient per The Markup); two facial recognition vendors (unnamed in FTC release). Company defunct; no consumer privacy policy of the original entity reviewed.

Data brokers linked to Rite Aid

None. The research documents no flow between Rite Aid and a data broker.

Data practices score

12 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

3

Retail media scale

0

Sensitive data

3

Opt-out friction

3

Estimated emissions for one person

Research gaps

• Loyalty member count unknown.
• Court approval of the PMDLabs sale inferred from Hilco's completed-sale page, not a court order.
• Number of loyalty profiles in the sale not verified (a figure of 10.9M email opt-ins appears only in search summaries).
• Outcome of the 2023 Meta Pixel class action not found.