I hate shopping. I know what I want and I do a surgical strike. In and out; no soldier left behind.

But most normal people browse a bit. That’s where Nomi Technologies came into the picture. Nomi’s technology allows retailers to track consumers’ movements through their stores. How does it work? According to a complaint issued by the Federal Trade Commission and announced on April 23 in conjunction with a settlement, Nomi placed sensors in its clients’ stores. Those sensors collected the media access control address (MAC address) assigned to consumers’ mobile devices. Although Nomi took steps to de-identify the MAC addresses prior to storing them, the method used – hashing – still resulted in an identifier that is unique to a consumer’s mobile device and can be tracked over time, according to the FTC. And, that was the FTC’s hook.

The complaint alleged that Nomi tracked consumers both inside and outside their clients’ stores, tracking the MAC address, device type, date and time the device was observed, and signal strength of consumers’ devices. Nomi provided aggregated information on how many consumers passed by the store instead of entering, how long consumers stayed in the store, the types of devices used by consumers, how many repeat customers entered a store in a given period, and how many customers had visited another location in a particular chain of stores.

Yes, there was a way to opt out. But, according to the FTC, that method was not made readily available to consumers. The FTC complaint alleged that no opt-out option was available at retailers using the service, and consumers were not informed of the tracking taking place in the stores at all. The opt-out method resided solely on Nomi’s website. Under the consent agreement, Nomi agreed to provide an in-store mechanism for consumers wishing to opt out of tracking, and agreed that consumers would be informed when locations were using Nomi’s tracking services. The FTC also alleged that Nomi’s privacy policy misrepresented the opt-out mechanism by stating that there would be an opt-out method at stores using its services.

This settlement represents the FTC’s first case against a retail tracking company. It is important because it deals with a growing area of retail marketing. With consumers more and more predictably connected to the Internet by means of their handheld devices, the technological options available to retailers to learn about potential and actual customer behavior in and around their stores is exploding. Also, this case is important because of the way “anonymous” data – further anonymized through “hashing” – was not anonymous enough. Despite the FTC’s facile explanation in its press release that the case turned on a misrepresentation in the respondent’s privacy policy, the hard work to come will be in figuring out what sort of “anonymization” will actually suffice according to the FTC.

Ooh, I like that hat. But, you already knew that, didn’t you?