YOU’RE BE­ING FOL­LOWED

WEARE ALL BE­ING TRACKED AS WEGO ABOUT OUR EV­ERY­DAY ROU­TINES

National Post (Latest Edition) - Financial Post Magazine - - CONTENTS - by Ar­mina Li­gaya

We are all be­ing tracked by nu­mer­ous pri­vate cor­po­ra­tions as we go about our ev­ery­day rou­tines, rais­ing a whole host of pri­vacy con­cerns.

Rap star Jay Z last came to Toronto in Jan­uary and his con­cert at Air Canada Cen­tre was packed, draw­ing thou­sands of fans to the arena in the down­town core. To gauge the suc­cess of this con­cert by the hip-hop mogul of “Em­pire State of Mind” and Bey­once-spouse fame, pro­mot­ers in the past would have typ­i­cally re­lied on the es­ti­mated at­ten­dance, while nearby businesses could look at how flush their cash reg­is­ters were by night’s end.

Now, thanks to the ubiq­ui­tous cell­phone, Toronto-based com­pany Vi­asense Inc. can fig­ure out that roughly 13,000 people filled the stands, but they also know how much time con­cert­go­ers spent at the show, where they went be­fore and af­ter, and where they ul­ti­mately spent the night. Vi­asense doesn’t know the con­cert­go­ers’ names or what they look like, but the mar­ket­ing and an­a­lyt­ics com­pany can rec­og­nize the unique iden­ti­fier linked to the cell­phones people carry and trace their paths. “We were able to see ex­actly the makeup of the au­di­ence,” says Mossab Basir, founder and CEOofVi­asense.

Lo­ca­tion data silently emit­ted by the cell­phones, smart­phones and other elec­tronic de­vices most of us carry through­out the day has trig­gered a new gold rush for mar­keters who want to har­ness it and for com­pa­nies that covet the in­sights it can pro­vide. The pat­terns of places a per­son, even if name­less, fre­quents can re­veal plenty. Their path­ways can paint a pic­ture of a yogi with a pen­chant for gam­bling or a busy par­ent fer­ry­ing chil­dren to school, hockey and bal­let. It can also shed light on traf­fic pat­terns through a mall, or in­side a store or air­port to help im­prove ser­vices.

Pri­vacy and con­sumer ad­vo­cates say we’re mov­ing into un­charted ter­ri­tory, and it’s pos­si­ble that in the fu­ture we will know where ev­ery­one is, and was, at all times. This may have far-reach­ing im­pli­ca­tions that we and the law are not yet pre­pared to deal with. And the prac­tice is only go­ing to in­ten­sify as com­pa­nies rush to cap­i­tal­ize on con­sumers’ “data ex­haust,” says Ge­off White, coun­sel for the Pub­lic In­ter­est Ad­vo­cacy Cen­tre (PIAC). “There is no de­fence for this level of sur­veil­lance,” he says, point­ing out com­pa­nies are prof­it­ing off the in­for­ma­tion while con­sumers ei­ther don’t know it is hap­pen­ing or have lit­tle con­trol over it. “You wouldn’t sanc­tion the abil­ity to walk up and put a GPS track­ing de­vice in your purse or back pocket.”

But on the sur­face, this data collection seems rel­a­tively be­nign. For ex­am­ple, Vi­asense an­a­lyzes bulk cell­phone data, as well as data from sen­sors that de­tect Wi-Fi- or Blue­tooth-en­abled smart­phones and other de­vices, to col­lect lo­ca­tion in­for­ma­tion. The in­sights they gen­er­ate, Basir and his busi­ness part­ner Kerry Mor­ri­son say, are meant to be “mi­cro-gen­er­al­iza­tions” about groups to help clients, and are not linked to an in­di­vid­ual. Plus, they en­crypt and pro­tect the data they gather, and are work­ing with pri­vacy groups to put in the right checks and bal­ances. “It’s en­tirely anony­mous,” Basir says. “We have ab­so­lutely no idea who that per­son is, or even what their phone num­ber is.”

Of course, lots of firms al­ready know a lot about any given con­sumer. In ex­change for, say, a bank ac­count or a mort­gage, people will­ingly and know­ingly give up per­sonal in­for­ma­tion from their in­come lev­els and credit his­to­ries to home ad­dresses and other con­tact info. Com­pa­nies have also long ben­e­fited from the ad­vent of In­ter­net cook­ies, the abil­ity to log what a per­son surf­ing the web is click­ing on, and for how long, over time. That in­for­ma­tion is used to de­cide what ads pop up on screen and how to tar­get cus­tomers. But that abil­ity to track on­line be­havioural pat­terns, on a mas­sive scale, is now pos­si­ble in the real world.

It be­gan with apps such as Foursquare, where users “check in” to let their so­cial net­work know where they are, and some­times get a dis­count or spe­cial deal from a mer­chant in re­turn. People also will­ingly share their daily ac­tiv­i­ties and where­abouts via so­cial me­dia such as Twit­ter, Face­book and In­sta­gram. But in the next phase, con­sumers will no longer have to do any­thing at all for businesses and mar­keters to learn in­for­ma­tion about them, ex­cept have a cell­phone or turn on the Wi-Fi or Blue­tooth ca­pa­bil­i­ties on their smart­phone, tablet or lap­top.

In Canada, about 80% of res­i­dents own a cell­phone. Smart­phones are also be­com­ing more com­mon, with 62% of Cana­dian res­i­dents us­ing the de­vices in 2012, up from 45% a year ear­lier, ac­cord­ing to comS­core. The pas­sive pings con­stantly emit­ted by these de­vices are be­ing com­piled and col­lected by Vi­asense, Toronto-based Turn­style So­lu­tions Inc., Win­nipeg-based Mexia In­ter­ac­tive Inc. and dozens of oth­ers around the world.

The Lo­ca­tion-Based Mar­ket­ing As­so­ci­a­tion, based in Toronto, es­ti­mates the global mar­ket is worth roughly US$9 bil­lion cur­rently, and will grow to as much as US$16 bil­lion by 2016. “We’re fa­mil­iar with cook­ies in the on­line world, track­ing when people are go­ing to the web­site, where they’ve been, and when they come back,” says Asif Khan, the as­so­ci­a­tion’s ex­ec­u­tive di­rec­tor. “But I think that lo­ca­tion is the new cookie go­ing for­ward.” Khan es­ti­mates there are roughly 80 to 100 com­pa­nies fo­cused on lo­ca­tion-based mar­ket­ing around the world.

“It’s one of the tech­nolo­gies that al­most ev­ery re­tailer is us­ing, test­ing or look­ing to use in 2014,” Jules Polonet­sky, ex­ec­u­tive di­rec­tor of the Fu­ture of Pri­vacy Fo­rum, based in Wash­ing­ton, D.C., told the Fi­nan­cial Post in Jan­uary. The goal of us­ing these tech­nolo­gies is to as­sess where a per­son is, and use that in­for­ma­tion to bet­ter en­tice that con­sumer, but there are a va­ri­ety of ways to track where­abouts.

Lo­ca­tion data gar­nered from cell­phone sig­nals is one method. Vi­asense buys bulk, raw anony­mous data from a Cana­dian car­rier, and crunches the ag­gre­gate data to fig­ure out where those cell­phone sig­nals are be­ing emit­ted from. Once a de­vice hits the net­work, Vi­asense at­taches its own unique ID to it and cap­tures where it is trav­el­ling through­out the city, Basir says.

Since the com­pany of­fi­cially launched last year, it has been build­ing a data­base of this in­for­ma­tion stretch­ing as far back as July 2013. Vi­asense pro­cesses 600 lo­ca­tion pings per sec­ond, or 50 mil­lion pings per day, and has com­piled anony­mous profiles of roughly four mil­lion de­vices. The com­pany can even de­ter­mine if a de­vice-holder is an avid run­ner by the speed at which the sig­nal is trav­el­ling across, say, Toronto’s Trin­ity-Bell­woods park. Vi­asense can also match a pro­file’s home lo­ca­tion — de­fined as where the de­vice spends the hours be­tween mid­night and 7 a.m. — with cen­sus data for that postal code to get de­mo­graphic in­for­ma­tion, Basir says.

“We call it per­sis­tently pro­fil­ing... which just means that as you

VI­ASENSE PRO­CESSES 600 LO­CA­TION PINGS PER SEC­OND AND COM­PILED ANONY­MOUS PROFILES OF FOUR MIL­LION DE­VICES

move through­out the city through­out the day, you go from home to your of­fice to maybe a yoga stu­dio later, or what­ever, we can see that these move­ments are hap­pen­ing in the city,” says Basir. “And we start to pro­file the to­tally anony­mous user based on that.”

Vi­asense will not name the Cana­dian car­rier that it pur­chases the ag­gre­gate phone data from due to con­fi­den­tial­ity agree­ments, but it has a 40% share of the mar­ket, says Kerry Mor­ri­son, founder of Norm, an um­brella com­pany of mar­ket­ing and an­a­lyt­ics ser­vices that Vi­asense is a part of. Telus Corp. and BCE Inc. say they don’t sell this type of cus­tomer data. Rogers Com­mu­ni­ca­tions Inc. says it pro­vides anony­mous data to third­party providers that it has ser­vice agree­ments with, such as ve­hi­cle traf­fic in­for­ma­tion to de­ter­mine the flow on road­ways. But this data is anony­mous and can­not iden­tify an in­di­vid­ual’s lo­ca­tion. “We have been ap­proached by Vi­asense, but do not have a di­rect busi­ness re­la­tion­ship with the com­pany,” says a Rogers spokesper­son.

Wire­less car­ri­ers in the U.S., such as Ver­i­zon Wire­less, have re­port­edly al­ready be­gun sell­ing ag­gre­gate data. Ver­i­zon in 2012 an­nounced the launch of its Pre­ci­sion Mar­ket In­sights di­vi­sion, which draws data from its 86- mil­lion-plus sub­scriber base, anonymizes it, and “ad­vanced an­a­lyt­ics en­gines then pro­vide a deeper per­spec­tive to help you reach and en­gage with your tar­get au­di­ences,” says Ver­i­zon’s web­site. Its cus­tomers who choose not to par­tic­i­pate are ex­empted, it adds. Tele­com com­pa­nies al­ready have this data at their fin­ger­tips, and many are try­ing to fig­ure out what to do with it, Mor­ri­son says. No Cana­dian car­ri­ers have an­nounced such pro­grams. But Vi­asense is in dis­cus­sions with the other two of the Big 3, he says. “We have one car­rier now, we will shortly have the other[s],” Mor­ri­son says. All three car­ri­ers say they were not in dis­cus­sions with Mor­ri­son and Basir’s com­pany.

Norm also has two other an­a­lyt­ics meth­ods: us­ing al­go­rithms to comb through so­cial me­dia for men­tions and ref­er­ences of brands, and in-store sen­sors that de­tect Wi-Fi- or Blue­tooth-en­abled de­vices. The long-term aim is to com­bine all three, though that’s not pos­si­ble yet, Mor­ri­son says.

Per­haps the most pop­u­lar, or eas­i­est to im­ple­ment, method of gath­er­ing lo­ca­tion data is to use small sen­sors that de­tect Wi-Fi- or Blue­tooth-en­abled de­vices. When a lap­top, smart­phone or tablet has

those ca­pa­bil­i­ties turned on, it is au­to­mat­i­cally try­ing to con­nect with the near­est Wi-Fi router or Blue­tooth de­vice. These sen­sors, which have a ra­dius of as much as 45 me­tres, can de­tect a de­vice’s sig­nals and log its unique

12- char­ac­ter al­phanu­meric iden­ti­fier called a MAC ad­dress, with­out ever ac­tu­ally con­nect­ing to it. These sen­sors or bea­cons will rec­og­nize the MAC ad­dress when­ever that de­vice comes near it, how long it stays, and what ar­eas of the store it lingers in based on the strength of the sig­nal. Turn­style So­lu­tions can de­velop an anony­mous por­trait of these users based on the pat­tern of lo­ca­tions it sees from its net­work of sen­sors.

Turn­style’s net­work has grown to more than 200 sen­sors across Toronto since it launched as a pi­lot pro­gram in Jan­uary 2013, and 400 glob­ally. These can also func­tion as Wi-Fi routers, al­low­ing re­tail­ers to pro­vide In­ter­net to their cus­tomers. If a con­sumer agrees to opt in us­ing a so­cial-me­dia ac­count, that mer­chant will know his or her name and other per­sonal data as well. But Turn­style doesn’t ask con­sumers for con­sent be­fore track­ing a de­vice’s Wi-Fi sig­nal, be­cause it’s not linked to a per­son’s iden­tity, CEO Devon Wright says. Turn­style now has about 3.5 mil­lion unique cus­tomer profiles in Canada and close to seven mil­lion world­wide. Mexia In­ter­ac­tive, whose clients in­clude air­ports, shop­ping malls and large re­tail­ers, has sen­sors in about 3,000 lo­ca­tions world­wide, says founder Glenn Tin­ley. And one of the big­gest play­ers do­ing in-store an­a­lyt­ics is U.S. com­pany Eu­clid An­a­lyt­ics, whose clients in­clude high-end re­tail chain Nord­strom and HomeDepot, ac­cord­ing to The NewYork Times.

But data gath­er­ing for lo­ca­tion-based mar­ket­ing is not just limited to de­tect­ing cell­phones. As surf­ing on screens moves to the In­ter­net of things, lo­ca­tion data can be col­lected from In­ter­net-en­abled cars, shirts and other wear­able tech­nolo­gies, Khan said at a Jan­uary meet­ing of the LBMA in Toronto. Lo­ca­tion data is al­ready be­ing used for dig­i­tal ad­ver­tise­ments that can de­tect the profiles of people around it, and dis­play rel­e­vant ad con­tent, just like in the sci-fi Tom Cruise movie Mi­nor­ity Re­port.

Con­sumers, of course, are more will­ing to share their in­for­ma­tion when they are get­ting an ap­pro­pri­ate ben­e­fit from the use of their data, Khan says. “Ev­ery­body has a price for their data, and the onus is on the mar­ket or the brand to deliver that value propo­si­tion in an ef­fec­tive way that con­vinces the con­sumer to say, ‘I

THERE’S A GROW­ING SENSE AMONG CANA­DI­ANS THAT THEIR ABIL­ITY TO PRO­TECT THEIR PER­SONAL IN­FOR­MA­TION IS DI­MIN­ISH­ING

want that and, there­fore, I’m go­ing to give up my data in ex­change for that.’”

People use Face­book and Gmail when its clear those ser­vices are free in ex­change for user data. How­ever, there’s a grow­ing sense among Cana­di­ans that their abil­ity to pro­tect their per­sonal in­for­ma­tion is di­min­ish­ing, ac­cord­ing to a sur­vey con­ducted in 2012 by Canada’s Pri­vacy Com­mis­sioner. More than half (56%) say they are not con­fi­dent that they have enough in­for­ma­tion to know how new tech­nolo­gies af­fect their per­sonal pri­vacy — the high­est level since the sur­vey be­gan in 2000. Plus, 53% say they would ad­just the set­tings of their mo­bile phones or apps to limit the amount of per­sonal in­for­ma­tion they share with oth­ers. About 38% of those sur­veyed say they would turn off the lo­ca­tion-track­ing fea­ture on their mo­bile de­vices be­cause they are con­cerned about oth­ers ac­cess­ing that in­for­ma­tion.

Canada’s Per­sonal In­for­ma­tion Pro­tec­tion and Elec­tronic Documents Act (PIPEDA) does not ad­dress lo­ca­tion-data gath­er­ing specif­i­cally, but it does re­quire that or­ga­ni­za­tions ex­plain the pur­pose for col­lect­ing per­sonal in­for­ma­tion and ob­tain con­sent for its use. A spokesper­son for the pri­vacy com­mis­sioner says it wouldn’t be in a po­si­tion to de­ter­mine the le­gal­ity of lo­ca­tion-data gath­er­ing prac­tices with­out in­ves­ti­gat­ing in re­sponse to a com­plaint. The com­mis­sioner’s of­fice hasn’t re­ceived any com­plaints and doesn’t have any on­go­ing in­ves­ti­ga­tions specif­i­cally re­lated to such gath­er­ing.

Tech­nolo­gies in­volv­ing lo­ca­tion data are evolv­ing rapidly, and while they can be “ex­tremely use­ful,” some can raise pri­vacy con­cerns, the com­mis­sioner’s spokesper­son says. “In­for­ma­tion about where a per­son has been could be very sen­si­tive,” she says in an email. “Some of the pri­vacy is­sues raised with re­spect to track­ing a per­son’s lo­ca­tion can in­clude: Who has ac­cess to that in­for­ma­tion? How is it pro­tected? How long is it kept? How eas­ily could a spe­cific per­son be iden­ti­fied based on the data?”

BCE has al­ready come un­der fire for its collection and use of wire­less cus­tomer data, in­clud­ing lo­ca­tion in­for­ma­tion. The Pub­lic In­ter­est Ad­vo­cacy Cen­tre and the Con­sumers’ As­so­ci­a­tion of Canada in Jan­uary filed an ap­pli­ca­tion with the Cana­dian Ra­diotele­vi­sion and Telecom­mu­ni­ca­tions Com­mis­sion com­plain­ing that BCE’s pro­gram for mar­ket­ing pur­poses is “counter to Cana­di­ans’ rea­son­able ex­pec­ta­tions of pri­vacy.”

The ar­gu­ment that the data col­lected is anony­mous, and there­fore doesn’t in­fringe on a per­son’s pri­vacy rights, doesn’t hold weight, says PIAC’s White, as it is not im­pos­si­ble to con­nect the dots from a per­son’s de­vice to a name. PIAC is also look­ing into whether the re­cep­tion of these sig­nals is in con­tra­ven­tion of the Ra­dio­com­mu­ni­ca­tions Act. “There are chal­lenges with the cur­rent pri­vacy leg­is­la­tion, and this type of mar­ket­ing ac­tiv­ity is high­light­ing some weak­nesses in the pri­vacy leg­is­la­tion, and the en­force­ment of it as well,” he says.

In early April, In­dus­try Min­is­ter James Moore un­veiled the Dig­i­tal Pri­vacy Act to amend PIPEDA, per­haps a sign of Cana­di­ans’ grow­ing con­cern about how their per­sonal data are used. The amend­ments in­clude re­quir­ing or­ga­ni­za­tions to clearly com­mu­ni­cate with their tar­get au­di­ence when ob­tain­ing con­sent and to con­sider whether their tar­get au­di­ence is able to un­der­stand the con­se­quences of shar­ing their per­sonal in­for­ma­tion. How­ever, the act did not touch on the is­sue of lo­ca­tion data. “[It] doesn’t bring needed ex­press recog­ni­tion of lo­ca­tion-based in­for­ma­tion as po­ten­tially very sen­si­tive and some­thing for which full dis­clo­sure and ex­press con­sent should, nat­u­rally, be sought,” White says.

Turn­style, Vi­asense and Mexia say they are very cog­nizant about pri­vacy con­cerns. Turn­style and Mexia are work­ing with the Fu­ture of Pri­vacy Fo­rum, a think tank that seeks to ad­vance re­spon­si­ble data prac­tices, and are two of the 11 firms that have signed on to its Mo­bile Lo­ca­tion An­a­lyt­ics code of con­duct. Vi­asense says it’s in the process of sign­ing the code as well. With this code, com­pa­nies pledge to take “rea­son­able steps” to en­sure their clients put up sig­nage in a con­spic­u­ous lo­ca­tion telling people mo­bile lo­ca­tion an­a­lyt­ics data are be­ing gath­ered there. The Fo­rum also has a cen­tral por­tal, where people can sub­mit their MAC ad­dresses and opt out from track­ing by the 11 sig­na­to­ries. Still, that re­quires people to know it’s even hap­pen­ing to opt out, White says.

With­out clear govern­ment reg­u­la­tion in the mo­bile lo­ca­tion an­a­lyt­ics sphere, in­dus­try and pri­vacy groups are still try­ing to fig­ure out the best way to han­dle the gath­er­ing of lo­ca­tion data. “We, and any­one in this space, need to stay on top of things, keep com­mu­ni­cat­ing with the com­mis­sioner and con­cerned groups,” Norm’s Mor­ri­son says.

But even the play­ers in this space don’t al­ways see eye to eye. Mexia founder Tin­ley says his com­pany does not com­bine the an­a­lyt­ics of mul­ti­ple clients to draw big­ger de­mo­graphic con­clu­sions about their con­sumers, nor does it pack­age the info and sell it in any other way. “We may not sell our com­pany for $3 bil­lion or some crazy val­u­a­tion,” he says. “But I have chil­dren. I’m go­ing to wake up ev­ery morn­ing not feel­ing that we’re do­ing any­thing wrong… and my share­hold­ers and board of di­rec­tors and my clients ap­pre­ci­ate that.” Nor does he want to pro­file Mexia’s con­sumers, so it lim­its the way the data it com­piles are given to clients, and shared be­tween them. “Call me the black sheep of the in­dus­try, [but] I don’t think con­sumers should be pro­filed, Tin­ley says. “I don’t want to be pro­filed.”

Newspapers in English

Newspapers from Canada

© PressReader. All rights reserved.