The Federal Trade Commission has gone after a mobile tracking firm that it says gathered information on 9 million consumers' mobile devices in the first nine months of 2013. The agency alleges that Nomi, a small New York firm that was acquired by retail analytics company Brickstream in 2014, misled people when it said they could opt out from its tracking technology in stores, since no opt-out tool was available.
Mobile trackers have become a popular presence in retail outlets, entertainment arenas and even parks and museums. The settlement could signal future investigations by the commission related to the burgeoning and controversial world of mobile tracking via beacons and other technologies.
According to the FTC settlement, "Consumers who did not opt out on Nomi's website and instead wanted to make the opt-out decision at retail locations were unable to do so, despite the explicit promise in Nomi's privacy policies. Consumers were not provided any means to opt out at retail locations and were unaware that the service was even being used."
Most mobile-tracking technology firms claim they do not gather personally-identifiable information because the device identifiers they track are hashed, or altered, to obfuscate personal data. Many, such as Swirl, pick up on signals associated only with devices that have a specific opt-in app installed. And like Nomi, most offer their clients data in aggregate form showing information on groups of customers indicating footpaths throughout a store or the number of devices present near a shop display at a given time.
However, the FTC appears to be less concerned with the nuances of how these technologies work and which types of device identifiers should be considered personally identifiable and more focused on the ability to tie a device to a person.
The agency approaches its evaluation of mobile-tracking technologies based on whether they are "reasonably linkable to a specific consumer or device," Amanda Koulousias, staff attorney in the FTC's privacy and identity protection division and the lead attorney on the Nomi case, told Ad Age.
Industry has attempted to self-regulate privacy capabilities associated with in-store device tracking. In February 2014, the Future of Privacy Forum unveiled SmartStorePrivacy.org, a site where consumers can opt-out from having their mobile devices tracked while visiting commercial locations. The opt-out system, which received the blessing of Sen. Charles Schumer, D-N.Y., launched with 11 mobile tech firms signed on. Nomi was absent from the list, though Brickstream, which would later that year acquire Nomi, was involved.
In a statement, the Future of Privacy Forum said the settlement "demonstrates the need for companies with emerging technologies to be clear about the choices they provide consumers," adding that "the need for transparent privacy policies in the field of mobile location analytics was the genesis behind the development of FPF's Mobile Location Analytics 'Code of Conduct.' Signatories of this binding set of privacy principles must provide consumer with clear opt-out options for tracking by MAC address or similar identifiers."
The Nomi settlement was a split decision along party lines among the agency's commissioners. Republican Commissioners Joshua Wright and Maureen Ohlhausen dissented. Ms. Ohlhausen expressed concern that the decision does not help preserve consumer privacy. "I fear that the majority's decision in this case encourages companies to do only the bare minimum on privacy, ultimately leaving consumers worse off," she stated.
Nomi was not fined as a result of the settlement and standard monitoring by the FTC of Nomi's practices by the agency will apply going forward.