YOU’RE BEING FOLLOWED
WEARE ALL BEING TRACKED AS WEGO ABOUT OUR EVERYDAY ROUTINES
We are all being tracked by numerous private corporations as we go about our everyday routines, raising a whole host of privacy concerns.
Rap star Jay Z last came to Toronto in January and his concert at Air Canada Centre was packed, drawing thousands of fans to the arena in the downtown core. To gauge the success of this concert by the hip-hop mogul of “Empire State of Mind” and Beyonce-spouse fame, promoters in the past would have typically relied on the estimated attendance, while nearby businesses could look at how flush their cash registers were by night’s end.
Now, thanks to the ubiquitous cellphone, Toronto-based company Viasense Inc. can figure out that roughly 13,000 people filled the stands, but they also know how much time concertgoers spent at the show, where they went before and after, and where they ultimately spent the night. Viasense doesn’t know the concertgoers’ names or what they look like, but the marketing and analytics company can recognize the unique identifier linked to the cellphones people carry and trace their paths. “We were able to see exactly the makeup of the audience,” says Mossab Basir, founder and CEOofViasense.
Location data silently emitted by the cellphones, smartphones and other electronic devices most of us carry throughout the day has triggered a new gold rush for marketers who want to harness it and for companies that covet the insights it can provide. The patterns of places a person, even if nameless, frequents can reveal plenty. Their pathways can paint a picture of a yogi with a penchant for gambling or a busy parent ferrying children to school, hockey and ballet. It can also shed light on traffic patterns through a mall, or inside a store or airport to help improve services.
Privacy and consumer advocates say we’re moving into uncharted territory, and it’s possible that in the future we will know where everyone is, and was, at all times. This may have far-reaching implications that we and the law are not yet prepared to deal with. And the practice is only going to intensify as companies rush to capitalize on consumers’ “data exhaust,” says Geoff White, counsel for the Public Interest Advocacy Centre (PIAC). “There is no defence for this level of surveillance,” he says, pointing out companies are profiting off the information while consumers either don’t know it is happening or have little control over it. “You wouldn’t sanction the ability to walk up and put a GPS tracking device in your purse or back pocket.”
But on the surface, this data collection seems relatively benign. For example, Viasense analyzes bulk cellphone data, as well as data from sensors that detect Wi-Fi- or Bluetooth-enabled smartphones and other devices, to collect location information. The insights they generate, Basir and his business partner Kerry Morrison say, are meant to be “micro-generalizations” about groups to help clients, and are not linked to an individual. Plus, they encrypt and protect the data they gather, and are working with privacy groups to put in the right checks and balances. “It’s entirely anonymous,” Basir says. “We have absolutely no idea who that person is, or even what their phone number is.”
Of course, lots of firms already know a lot about any given consumer. In exchange for, say, a bank account or a mortgage, people willingly and knowingly give up personal information from their income levels and credit histories to home addresses and other contact info. Companies have also long benefited from the advent of Internet cookies, the ability to log what a person surfing the web is clicking on, and for how long, over time. That information is used to decide what ads pop up on screen and how to target customers. But that ability to track online behavioural patterns, on a massive scale, is now possible in the real world.
It began with apps such as Foursquare, where users “check in” to let their social network know where they are, and sometimes get a discount or special deal from a merchant in return. People also willingly share their daily activities and whereabouts via social media such as Twitter, Facebook and Instagram. But in the next phase, consumers will no longer have to do anything at all for businesses and marketers to learn information about them, except have a cellphone or turn on the Wi-Fi or Bluetooth capabilities on their smartphone, tablet or laptop.
In Canada, about 80% of residents own a cellphone. Smartphones are also becoming more common, with 62% of Canadian residents using the devices in 2012, up from 45% a year earlier, according to comScore. The passive pings constantly emitted by these devices are being compiled and collected by Viasense, Toronto-based Turnstyle Solutions Inc., Winnipeg-based Mexia Interactive Inc. and dozens of others around the world.
The Location-Based Marketing Association, based in Toronto, estimates the global market is worth roughly US$9 billion currently, and will grow to as much as US$16 billion by 2016. “We’re familiar with cookies in the online world, tracking when people are going to the website, where they’ve been, and when they come back,” says Asif Khan, the association’s executive director. “But I think that location is the new cookie going forward.” Khan estimates there are roughly 80 to 100 companies focused on location-based marketing around the world.
“It’s one of the technologies that almost every retailer is using, testing or looking to use in 2014,” Jules Polonetsky, executive director of the Future of Privacy Forum, based in Washington, D.C., told the Financial Post in January. The goal of using these technologies is to assess where a person is, and use that information to better entice that consumer, but there are a variety of ways to track whereabouts.
Location data garnered from cellphone signals is one method. Viasense buys bulk, raw anonymous data from a Canadian carrier, and crunches the aggregate data to figure out where those cellphone signals are being emitted from. Once a device hits the network, Viasense attaches its own unique ID to it and captures where it is travelling throughout the city, Basir says.
Since the company officially launched last year, it has been building a database of this information stretching as far back as July 2013. Viasense processes 600 location pings per second, or 50 million pings per day, and has compiled anonymous profiles of roughly four million devices. The company can even determine if a device-holder is an avid runner by the speed at which the signal is travelling across, say, Toronto’s Trinity-Bellwoods park. Viasense can also match a profile’s home location — defined as where the device spends the hours between midnight and 7 a.m. — with census data for that postal code to get demographic information, Basir says.
“We call it persistently profiling... which just means that as you
VIASENSE PROCESSES 600 LOCATION PINGS PER SECOND AND COMPILED ANONYMOUS PROFILES OF FOUR MILLION DEVICES
move throughout the city throughout the day, you go from home to your office to maybe a yoga studio later, or whatever, we can see that these movements are happening in the city,” says Basir. “And we start to profile the totally anonymous user based on that.”
Viasense will not name the Canadian carrier that it purchases the aggregate phone data from due to confidentiality agreements, but it has a 40% share of the market, says Kerry Morrison, founder of Norm, an umbrella company of marketing and analytics services that Viasense is a part of. Telus Corp. and BCE Inc. say they don’t sell this type of customer data. Rogers Communications Inc. says it provides anonymous data to thirdparty providers that it has service agreements with, such as vehicle traffic information to determine the flow on roadways. But this data is anonymous and cannot identify an individual’s location. “We have been approached by Viasense, but do not have a direct business relationship with the company,” says a Rogers spokesperson.
Wireless carriers in the U.S., such as Verizon Wireless, have reportedly already begun selling aggregate data. Verizon in 2012 announced the launch of its Precision Market Insights division, which draws data from its 86- million-plus subscriber base, anonymizes it, and “advanced analytics engines then provide a deeper perspective to help you reach and engage with your target audiences,” says Verizon’s website. Its customers who choose not to participate are exempted, it adds. Telecom companies already have this data at their fingertips, and many are trying to figure out what to do with it, Morrison says. No Canadian carriers have announced such programs. But Viasense is in discussions with the other two of the Big 3, he says. “We have one carrier now, we will shortly have the other[s],” Morrison says. All three carriers say they were not in discussions with Morrison and Basir’s company.
Norm also has two other analytics methods: using algorithms to comb through social media for mentions and references of brands, and in-store sensors that detect Wi-Fi- or Bluetooth-enabled devices. The long-term aim is to combine all three, though that’s not possible yet, Morrison says.
Perhaps the most popular, or easiest to implement, method of gathering location data is to use small sensors that detect Wi-Fi- or Bluetooth-enabled devices. When a laptop, smartphone or tablet has
those capabilities turned on, it is automatically trying to connect with the nearest Wi-Fi router or Bluetooth device. These sensors, which have a radius of as much as 45 metres, can detect a device’s signals and log its unique
12- character alphanumeric identifier called a MAC address, without ever actually connecting to it. These sensors or beacons will recognize the MAC address whenever that device comes near it, how long it stays, and what areas of the store it lingers in based on the strength of the signal. Turnstyle Solutions can develop an anonymous portrait of these users based on the pattern of locations it sees from its network of sensors.
Turnstyle’s network has grown to more than 200 sensors across Toronto since it launched as a pilot program in January 2013, and 400 globally. These can also function as Wi-Fi routers, allowing retailers to provide Internet to their customers. If a consumer agrees to opt in using a social-media account, that merchant will know his or her name and other personal data as well. But Turnstyle doesn’t ask consumers for consent before tracking a device’s Wi-Fi signal, because it’s not linked to a person’s identity, CEO Devon Wright says. Turnstyle now has about 3.5 million unique customer profiles in Canada and close to seven million worldwide. Mexia Interactive, whose clients include airports, shopping malls and large retailers, has sensors in about 3,000 locations worldwide, says founder Glenn Tinley. And one of the biggest players doing in-store analytics is U.S. company Euclid Analytics, whose clients include high-end retail chain Nordstrom and HomeDepot, according to The NewYork Times.
But data gathering for location-based marketing is not just limited to detecting cellphones. As surfing on screens moves to the Internet of things, location data can be collected from Internet-enabled cars, shirts and other wearable technologies, Khan said at a January meeting of the LBMA in Toronto. Location data is already being used for digital advertisements that can detect the profiles of people around it, and display relevant ad content, just like in the sci-fi Tom Cruise movie Minority Report.
Consumers, of course, are more willing to share their information when they are getting an appropriate benefit from the use of their data, Khan says. “Everybody has a price for their data, and the onus is on the market or the brand to deliver that value proposition in an effective way that convinces the consumer to say, ‘I
THERE’S A GROWING SENSE AMONG CANADIANS THAT THEIR ABILITY TO PROTECT THEIR PERSONAL INFORMATION IS DIMINISHING
want that and, therefore, I’m going to give up my data in exchange for that.’”
People use Facebook and Gmail when its clear those services are free in exchange for user data. However, there’s a growing sense among Canadians that their ability to protect their personal information is diminishing, according to a survey conducted in 2012 by Canada’s Privacy Commissioner. More than half (56%) say they are not confident that they have enough information to know how new technologies affect their personal privacy — the highest level since the survey began in 2000. Plus, 53% say they would adjust the settings of their mobile phones or apps to limit the amount of personal information they share with others. About 38% of those surveyed say they would turn off the location-tracking feature on their mobile devices because they are concerned about others accessing that information.
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) does not address location-data gathering specifically, but it does require that organizations explain the purpose for collecting personal information and obtain consent for its use. A spokesperson for the privacy commissioner says it wouldn’t be in a position to determine the legality of location-data gathering practices without investigating in response to a complaint. The commissioner’s office hasn’t received any complaints and doesn’t have any ongoing investigations specifically related to such gathering.
Technologies involving location data are evolving rapidly, and while they can be “extremely useful,” some can raise privacy concerns, the commissioner’s spokesperson says. “Information about where a person has been could be very sensitive,” she says in an email. “Some of the privacy issues raised with respect to tracking a person’s location can include: Who has access to that information? How is it protected? How long is it kept? How easily could a specific person be identified based on the data?”
BCE has already come under fire for its collection and use of wireless customer data, including location information. The Public Interest Advocacy Centre and the Consumers’ Association of Canada in January filed an application with the Canadian Radiotelevision and Telecommunications Commission complaining that BCE’s program for marketing purposes is “counter to Canadians’ reasonable expectations of privacy.”
The argument that the data collected is anonymous, and therefore doesn’t infringe on a person’s privacy rights, doesn’t hold weight, says PIAC’s White, as it is not impossible to connect the dots from a person’s device to a name. PIAC is also looking into whether the reception of these signals is in contravention of the Radiocommunications Act. “There are challenges with the current privacy legislation, and this type of marketing activity is highlighting some weaknesses in the privacy legislation, and the enforcement of it as well,” he says.
In early April, Industry Minister James Moore unveiled the Digital Privacy Act to amend PIPEDA, perhaps a sign of Canadians’ growing concern about how their personal data are used. The amendments include requiring organizations to clearly communicate with their target audience when obtaining consent and to consider whether their target audience is able to understand the consequences of sharing their personal information. However, the act did not touch on the issue of location data. “[It] doesn’t bring needed express recognition of location-based information as potentially very sensitive and something for which full disclosure and express consent should, naturally, be sought,” White says.
Turnstyle, Viasense and Mexia say they are very cognizant about privacy concerns. Turnstyle and Mexia are working with the Future of Privacy Forum, a think tank that seeks to advance responsible data practices, and are two of the 11 firms that have signed on to its Mobile Location Analytics code of conduct. Viasense says it’s in the process of signing the code as well. With this code, companies pledge to take “reasonable steps” to ensure their clients put up signage in a conspicuous location telling people mobile location analytics data are being gathered there. The Forum also has a central portal, where people can submit their MAC addresses and opt out from tracking by the 11 signatories. Still, that requires people to know it’s even happening to opt out, White says.
Without clear government regulation in the mobile location analytics sphere, industry and privacy groups are still trying to figure out the best way to handle the gathering of location data. “We, and anyone in this space, need to stay on top of things, keep communicating with the commissioner and concerned groups,” Norm’s Morrison says.
But even the players in this space don’t always see eye to eye. Mexia founder Tinley says his company does not combine the analytics of multiple clients to draw bigger demographic conclusions about their consumers, nor does it package the info and sell it in any other way. “We may not sell our company for $3 billion or some crazy valuation,” he says. “But I have children. I’m going to wake up every morning not feeling that we’re doing anything wrong… and my shareholders and board of directors and my clients appreciate that.” Nor does he want to profile Mexia’s consumers, so it limits the way the data it compiles are given to clients, and shared between them. “Call me the black sheep of the industry, [but] I don’t think consumers should be profiled, Tinley says. “I don’t want to be profiled.”