The Federal Trade Commission’s (“FTC”) chief technologist has detailed ways for retailers to address consumer privacy concerns posed by the use of tracking technologies to follow consumer’s movements.

What is Retail Tracking?

Retail tracking uses a variety of technologies to track consumer movements and behaviours in stores and other retail settings such as malls. The technology, which utilizes WiFi or Bluetooth signals from a consumer’s phone to track them, provides a bricks and mortar version of the analytics tools that have been available to track user movements across web sites. For instance, a store using retail tracking can measure the number of people who walk past the store, the number who come through the front door – and this information includes whether or not they went in immediately or lingered outside and had to be convinced by the advertising in the store front. Once consumers are inside the store, retailers can find out how many  of them walked up to the second floor and compare with the number of people who did so last week, or compare consumer traffic in the discount area of the store versus the luxury brand area. In a shopping mall, it is possible to track consumers across individual stores, and reveal mass behaviour patterns, such as discovering that a certain percentage of consumers who buy burgers at the food court also buy running shoes within the next hour. If you’re a marketer, this information is gold – it can allow you to push coupons or ads to individual phones, assist in product placement or allow mall owners to charge premiums for leases in high traffic areas. However, the technology has raised privacy concerns, both in Canada and the US.

Privacy Concerns in Both US and Canada

In the US, the FTC recently settled deception charges against start-up Nomi Technologies, Inc. related to Nomi’s in-store, sensor-based, tracking technology. This is the first FTC enforcement action against emerging retail store-based tracking technologies. Nomi managed to collect over  nine million mobile devices’ media access control (MAC) addresses over 9 months in 2013. While Nomi’s privacy policy told consumers they could always “opt out of Nomi’s services on its website as well as at any retailer using Nomi technology”,  according to the FTC’s complaint, Nomi had no mechanism for in-store customer opt-outs; customers could only opt-out by visiting Nomi’s website. The key points from the FTC investigation were that privacy policies need to be accurate, retailers should have consumer-facing notices that advise that the technology is in use, and consumer opt-outs should be easy for consumers to find.

In Canada, a recent decision from the Privacy Commissioner of Canada made similar findings in respect of a telecommunications provider who had used the online version of tracking to display ads targeted on the basis of online behaviour. In this case, the central issue was the Privacy Commissioner’s finding that opt-out consents were, in its view, insufficient given the sensitivity of the personal information collected during browsing. It is worth noting that that the opt-out/opt-in debate is likely to evolve as a distinguishing feature between American and Canadian approaches to these sorts of technologies. Companies using US-made technologies (or technologies rolled out by US-based companies to their Canadian affiliates).

 How Can Retailers Address Privacy Concerns?

Currently, tracking technologies vary with how much notice they provide consumers and whether consumers can opt in or opt out, according to the FTC’s chief technologist. For instance, he notes that some carriers provide dashboards by which consumers can manage their privacy preferences and opt out of having their location information used for marketing purposes. Other technologies use persistent identifiers, such as an International Mobile Station Equipment Identity, and are linked to a smartphone and an SIM card. Hardware identifiers, such as WiFi addresses or Bluetooth media access control addresses, are tied to devices and are automatically broadcast when smartphones search for networks. These persistent identifiers often can be linked to individuals by name, which creates privacy concerns.

Among the recommendations from the FTC’s chief technologist for retailers considering the use of tracking technologies:

  • open WiFi or Bluetooth networks that alert consumers to the existence of mobile retail tracking and allow them to temporarily join in order to opt-out (in Canada, this may well be an invitation to opt in instead)
  • provide customer facing notices advising that the technologies are in use
  • provide an easy process by which to opt out (or in) both online and in store
  • have privacy policies that explicitly address the technologies and the uses to which the information is put
  • ensure that the technologies in use are really anonymous (if that is what they claim) or if they are not, that this is acknowledged, consumers are made of aware of this ,and appropriate consents are in place,