“Retail Tracking” and Nomi’s Allegedly Deceptive Practices
Retail tracking occurs when retailers, or their third-party service providers, capture and track the movements of consumers in and around stores through their mobile devices, such as through the use of Wi-Fi or beacons, in order, for example, to better understand store traffic or serve targeted offers. The FTC’s chief technologist recently published detailed comments on the “privacy trade-offs” of retail tracking and the various technologies that companies are using to engage in it. Given the potential lack of transparency around the practice and the corresponding privacy implications, it is not surprising that the FTC decided to address the practice through its Section 5 authority, even if the FTC did so in an indirect fashion.
The FTC further alleged that Nomi represented, expressly or by implication, that consumers would be given notice when they were being tracked at a retail location. The statement of Chairwoman Edith Ramirez and Commissioners Julie Brill and Terrell McSweeny in support of the complaint and proposed order explains that “the express promise of an in-store opt out necessarily makes a second, implied promise: that retailers using Nomi’s service would notify consumers that the service was in use. This promise was also false. Nomi did not require its clients to provide such a notice. To our knowledge, no retailer provided such a notice on its own.” By allegedly failing to provide notice when a retail location was utilizing Nomi’s service to track customers, Nomi’s implied promise to provide notice was also deceptive.
The FTC Keeps Nomi Narrow, for Now. What Lessons Can Others Learn?
The proposed order provides for very narrow injunctive relief: It simply enjoins Nomi from misrepresenting how consumers can control the collection, use, disclosure or sharing of information collected from them or their devices, and from misrepresenting the extent to which consumers will receive notice about such tracking. The majority commissioners, in their statement, were at pains to disclaim any significance of the case with regard to the practice of retail tracking specifically:
While the consent order does not require that Nomi provide in-store notice when a store uses its services or offer an in-store opt out, that was not the Commission’s goal in bringing this case. This case is simply about ensuring that when companies promise consumers the ability to make choices, they follow through on those promises.
In other words, Nomi is the FTC’s first case involving brick-and-mortar tracking, but the FTC is not yet creating new law: The proposed order does not impose any affirmative notice and choice obligations on industry participants in the retail tracking space. It is not surprising that the commission declined to take such a drastic step with a practice that is still, relatively speaking, in its infancy, and that does not, on its face, involve sensitive personal information (though, while the information collected may be anonymous and analyzed only in aggregate, some retailers may, or at least could, pair tracking information through their apps with other information about identifying a specific consumer).When the FTC does impose specific obligations relating to a particular practice, it typically moves in an incremental fashion. For example, the FTC noted in its 2009 Report on Self-Regulatory Principles for Online Behavioral Advertising and again in its 2012 Privacy Report that the collection of precise geolocation requires affirmative express consent because such information is sensitive. The FTC continued to indicate, in guidance and follow-on staff reports, that a failure to provide notice and obtain affirmative opt-in consent for the collection of precise geolocation information could give rise to a cause of action for deception under Section 5 of the FTC Act.Then, when the FTC settled a case (
When the FTC does impose specific obligations relating to a particular practice, it typically moves in an incremental fashion. For example, the FTC noted in its 2009 Report on Self-Regulatory Principles for Online Behavioral Advertising and again in its 2012 Privacy Report that the collection of precise geolocation requires affirmative express consent because such information is sensitive. The FTC continued to indicate, in guidance and follow-on staff reports, that a failure to provide notice and obtain affirmative opt-in consent for the collection of precise geolocation information could give rise to a cause of action for deception under Section 5 of the FTC Act.Then, when the FTC settled a case (Goldenshores), alleging violations of Section 5 relating to an Android app’s collection, use and disclosure of precise geolocation from users’ devices, the order imposed specific parameters on the out-of-policy notice and choice that the app had to provide — effectively creating a new notice and choice regime for the collection, use and disclosure of such information that companies ignore at their peril.By contrast, the
Then, when the FTC settled a case (Goldenshores), alleging violations of Section 5 relating to an Android app’s collection, use and disclosure of precise geolocation from users’ devices, the order imposed specific parameters on the out-of-policy notice and choice that the app had to provide — effectively creating a new notice and choice regime for the collection, use and disclosure of such information that companies ignore at their peril.By contrast, the
By contrast, the narrow approach the FTC has taken with Nomi raises the question of whether the FTC would ever impose a notice and choice obligation for offline, retail tracking. We have no certainty around the FTC’s view, but it is reasonable to anticipate that the FTC will move in a direction that mirrors its position with respect to online tracking — that is, that at least when information is collected for targeted advertising purposes, a company should provide meaningful disclosures to consumers about the tracking and choice with respect to whether to allow it. The FTC could ultimately deem a failure to provide such notice and/or choice an unfair and/or deceptive practice under Section 5 of the FTC Act.
What does this mean for retailers and other places of business? In light of Nomi and our expectations with respect to the direction the FTC is likely to take, companies that engage in in-store tracking should consider how best to provide their customers with notice and choice. Whatever the FTC does, it will probably move conservatively. That means that the FTC is likely to continue to identify practices as violations of Section 5 if they can be remedied without stifling retail tracking technology as it matures.
How should retailers proceed? One option is to track only those customers who have downloaded the retailer’s app and affirmatively agreed to be tracked for identified purposes, such as the delivery of targeted offers. Another option is to use a vendor that subscribes to the Future of Privacy Forum Mobile Location Analytics Code of Conduct, which requires participating mobile location analytics companies to, among other things, provide consumers with appropriate notice and choice. These types of compliance strategies could help protect companies from the next possible phase of FTC enforcement in this space, since they address what appear to be, for now, the most direct ways to avoid conducting retail tracking without providing notice and choice.