A tracking firm that quietly captured information about 9 million consumers wandering in, out, and nearby retail stores, largely without consumers’ knowledge, was slapped on the wrist by the Federal Trade Commission on Thursday. The commission vote on the order was 3-2, meaning the slap was given reluctantly, with two of five commissioners writing that the FTC should have used “prosecurial discretion” and dropped the matter.
Nomi Technologies is one of those firms you’ve heard about but probably don’t really believe exists. Retailers buy the firm’s gadgets, which listen for cell phones in consumers’ pockets and purses. Once a device “hears” the WiFi requests from a phone, it logs data about the gadget, and then uses that data to follow consumers around the store. The information can tell shop owners that consumers tend to linger around a certain display, or that foot traffic in another corner of the store is dismal.
Nomi can even tell retailers when former customers are near the store, but don’t come in.
“In reports to clients, Nomi provided aggregated information on how many consumers passed by the store instead of entering, how long consumers stayed in the store, the types of devices used by consumers, how many repeat customers enter a store in a given period and how many customers had visited another location in a particular chain of stores,” the FTC said.
All this is legal, and becoming increasingly common. The FTC action doesn’t challenge any of this. The FTC merely objected to a lame opt-out procedure that Nomi used. According to the complaint, Nomi said it gave consmers the ability to opt out of their tracking, but the offer was relatively useless because most consumers (like you, I’m sure) had no idea Nomi was tracking them in the first place, and the only way to opt out was by going to Nomi’s website. The FTC said Nomi should have notified consumers in stores, when they were being tracked, and should have offered a way to opt out while inside the stores.
Two FTC Commissioners found fault with this logic, with comissioners Maureen K. Ohlhausen and Joshua D. Wright dissenting. Because Nomi “hashed,” or scrambled, the data collected, consumers were not personally identifiable, they argued, so there was no consumer harm. Ohlhausen argued that because Nomi had no direct relationship with consumers — it is a third-party supplier — it had no obligation to provide a consumer opt out. Wright noted that, after a front-page New York Times story about Nomi, 3,840 people visited the firm’s site and 146 people opted out of their technology. Therefore, the website opt-out was sufficient.
“This high rate, relative to website visitors, likely reflects the ease of a mechanism that was immediately and quickly available to consumers at the time they may have been reading the privacy policy,” he writes.
This is why the fight for privacy is so hard. Using Larry Ponemon’s scale for privacy concerns, I’m going to guess that roughly two-thirds of the 9 million people that Nomi tracked are opposed to that tracking, and all things being equal and easy, would decline. So…6 million vs. 136. Yes, I disgree that Nomi’s opt-out was sufficient. Like nearly almost all opt-outs, which tend to insult anyone’s intelligence when posed as an actual fair option to consumers. And as I’m sure you’ve guessed, hashing isn’t exactly a fool-proof way to ensure that people aren’t identifiable.
Let’s think about it this way: How many people would opt-in to Nomi’s technology if given the chance? Stores ask for such opt-ins all the time. They offer you coupons in exchange for your telephone number or email address. Plenty of consumers go along with it. If retailers (and Nomi…and your dissenting FTC commissioners) actually believed this technology was OK with consumers, they wouldn’t have to hide it. They’d advertise it and make some kind of bargain with consumers to sign up. Instead, the technology is deployed in sneaky ways because it’s creepy. We hear about it after the fact, which isn’t at all conducive to the kind of intelligent, public discussion we need on privacy issues.
Sure, I can imagine a way that in-store tracking technology could work for consumers and stores. How about asking people if they will carry an RFID device around the store? And yes, physical storeowners are at a disadvantage today because website retailers know more about their shoppers in some cases. But, no, we shuoldn’t disregard people’s privacy concerns because of that.
Meanwhile, here’s a tip: Turn off your WiFi when you don’t need it. Your phone will be tracked less, and you’ll save some battery power. Of course, don’t forget to turn it back on when you are home, lest you eat up too much of your data plan. (Man, it’s hard being a consumer today.)
ADDED: I received a statement from Wesley Barrow, founder of Nomi. Here it is:
“We are pleased to reach this agreement. We continually review our privacy policies to ensure that they follow best practices and had already made the recommended changes in pursuit of that goal by updating our privacy policy over a year and a half ago, while we were still an early-stage startup that was less than a year old. Our mission has always been to help clients deliver the best possible customer experience, and a key part of achieving that goal is empowering consumers with choice.”
Sign up for Bob Sullivan’s free email newsletter.
Be the first to comment