In law school, everybody learns the adage that hard cases make bad law. When it comes to the Federal Trade Commission (“FTC”), a better aphorism might be, “easy cases make new law.” The FTC’s recent settlement with Nomi Technologies, Inc. (“Nomi”) is, as the FTC’s press release notes, the “FTC’s first against a retail tracking company.” On its face, the case is like many FTC privacy cases: it challenges a statement in the company’s privacy policy for allegedly being inconsistent with the company’s actual practices and thus deceptive. Under the surface, however, the case may open the door for the FTC to create a notice-and-choice regime for the physical tracking of consumers, analogous to its well-established notice-and-choice regime for online tracking.

“RETAIL TRACKING” AND NOMI’S ALLEGEDLY DECEPTIVE PRACTICES

Retail tracking occurs when retailers, or their third-party service providers, capture and track the movements of consumers in and around stores through their mobile devices, such as through the use of WiFi or beacons, in order, for example, to better understand store traffic or serve targeted offers.1  Given the potential lack of transparency around the practice and the corresponding privacy implications, it is not surprising that the FTC decided to address the practice.

It is also not surprising that the FTC has moved cautiously into this space. The facts of In re Nomi, as alleged in the complaint, are simple. Nomi provided  mobile device tracking technology that enabled its clients, brick-and-mortar retailers, to receive analytics reports about aggregate customer traffic patterns — that is, how long consumers stay in the store and in which sections, how long they wait in line, what percentage of consumers pass by the store altogether, and so on. Nomi represented in the privacy policies posted on its website that it  would “[a]lways allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.” While Nomi offered an opt-out on its website, it allegedly did not provide an opt-out mechanism at its clients’ retail locations, thus rendering its privacy policy promise deceptive, in violation of Section 5 of the FTC Act. The FTC further alleged that Nomi represented, expressly or by implication, that consumers would be given notice when they were being tracked at a retail location. The Statement of Chairwoman Ramirez and Commissioners Brill and McSweeny in support of the complaint and proposed order explains that “the express promise of an in-store opt out necessarily makes a second, implied promise: that retailers using Nomi’s service would notify consumers that the service was in use. This promise was also false. Nomi did not require its clients to provide such a notice. To our knowledge, no retailer provided such a notice on its own.” By allegedly failing to provide notice when a retail location was utilizing Nomi’s service to track customers, Nomi’s implied promise to provide notice was also deceptive.

THE FTC KEEPS NOMI NARROW, FOR NOW. WHAT LESSONS CAN OTHERS LEARN?

The proposed order provides for very narrow injunctive relief: it simply enjoins Nomi from misrepresenting how consumers can control the collection, use, disclosure, or sharing of information collected from them or their devices, and from misrepresenting the extent to which consumers will receive notice about such tracking.

Nomi is the FTC’s first case involving brick-and-mortar tracking, and the FTC is not yet creating new law: specifically, the proposed order does not require the company to provide notice and choice in connection with retail tracking. This raises the question of whether the FTC would ever impose such an obligation. We have no certainty around the FTC’s view, but it is reasonable to anticipate that the FTC will move in a direction that mirrors its position with respect to online tracking — that is, that at least when information is collected for targeted advertising purposes, a company should provide meaningful disclosures to consumers about the tracking and choice with respect to whether to allow it.2  The FTC could ultimately deem a failure to provide such notice and/or choice an unfair and/or deceptive practice under Section 5 of the FTC Act.

What does this mean for retailers and other places of business? In light of Nomi and our expectations with respect to the direction the FTC is likely to take, companies that engage in in-store tracking should consider how best to provide their customers with notice and choice. One option is to track only those customers who have downloaded the retailer’s app and agreed to be tracked for identified purposes, such as the delivery of targeted offers. Another option is to use a vendor that subscribes to the Future of Privacy Forum Mobile Location Analytics Code of Conduct,3 which requires participating mobile location analytics companies to, among other things, provide consumers with appropriate notice and choice.