US cracks down on retail tracking

The US Federal Trade Commission announced a consent order with Nomi Technologies, which it said did not abide by its own promises to allow consumers to opt out of being tracked while they shop. This is the first enforcement action by the FTC against a retail-tracking company.

Nomi is one of several companies that have developed ways to use consumers’ cellphones to track their real-world movements for commercial purposes.

According to the FTC complaint, the company used sensors in stores to collect the MAC address — a unique code — of a shopper’s smartphone when the device searched for Wi-Fi networks, a thing many phones do almost constantly by default.

The movements of users — both in and outside these stores — were tracked using this unique ID, as well as the device type, the time the shopper was observed and the signal strength — which could be used to determine how nearby the shopper was.

Unique smartphone code

Nomi collected information on about nine million mobile devices during the first nine months of 2013, the FTC alleged. It used a technique called “hashing” to obscure MAC addresses that could be used to identify a particular smartphone.

But it still generated a unique code that was associated with those devices, allowing them to be tracked over time and potentially revealing sensitive information about a shopper’s movements, according to the FTC.

The company used the tracking information to give retailers insight into their customer base — for instance, how many repeat customers they had during a given period and how long consumers stayed in the store, the FTC said.