You're walking through a chain drugstore and stop at the counter where some fairly personal items are for sale. Or you're at a bookstore and browse in the section about certain medical problems. Not long ago, those stops wouldn't have been anybody's business. But if you're carrying a cellphone -- who doesn't these days? -- your every move in those stores could be a matter of record.
Technology that allows retailers to track the movement of shoppers by harvesting Wi-Fi signals within their stores is spreading rapidly. Giant U.S. retailers including Nordstrom and Home Depot are already using it, as does one of the most popular malls in Singapore. Indeed, Euclid Analytics, one of the better-known companies selling the technology, boasts that it has tracked some 50 million devices in 4,000 locations.
[ Find out how our Internet privacy is at risk -- but not dead yet. | Secure your privacy through obscurity by following these tips for covering your tracks online. | Learn how to protect your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]
Like the tracking of Web surfers via cookies, tracking shoppers by sniffing Wi-Fi signals is supposed to return only anonymous data. But in fact, hashing (the technology used to mask a phone's MAC) is hardly infallible. In many cases, shoppers have no idea that they are being tracked, much less have a chance to opt out.
"It's one thing to track someone's shopping habits through a loyalty card or credit card purchase; folks understand that their information may be collected," said Sen. Al Franken (D-Minn.), who has introduced legislation to regulate shopper tracking. "It's another thing entirely to track consumers' movements without their permission as they shop, especially when someone doesn't buy anything or even enter a store. People have a fundamental right to privacy, and I think neglecting to ask consumers for their permission to track them violates that right."
Indoor location plus big data equals big trouble
If GPS worked indoors, companies like Euclid wouldn't have much of a business. But it doesn't, and retailers, who hunger after every last scrap of customer data, are spending serious money to install alternative technologies. A report by ABI Reseach puts the market for "alternative" location technologies -- that is, non-GPS -- at $8 billion by 2017. Even if that market is smaller, there's still plenty of incentive for vendors to chase it, and ABI analyst Dominique Bonte said a year ago that more than 30 companies are in the running.
One of those vendors is YFind Technologies. The Singapore- and San Jose-based company sells a system called TheRetailHQ, which includes a shopper analytics dashboard powered by YFind's indoor positioning system. What information does it collect?
According to YFind's website, foot traffic is monitored minute by minute, and the amount of time customers spend in stores or malls or parts of stores is tracked. The system can distinguish new shoppers from repeat visitors and how often they visit. In short, anything a shopper does in the store is fair game as long as his or her phone is turned on.
"People understand there are cameras in stores to prevent shoplifting, and they know that if they use credit or reward cards their information is collected. But that's voluntary. This technology is not," says Dave Maass, a spokesman for the Electronic Frontier Foundation.
YFind's website has pages of material illustrating the uses of TheRetailHQ and a video showing its founder being tracked as he navigated a multistory mall in Singapore. But the word "privacy" is apparently absent from the site -- at least I couldn't find it. I wanted to know if the company requires its customers to notify shoppers that they are being tracked and how it protects their data. I also asked if YFind sells data to data brokers, but a spokesman said the company's executives were traveling and not available to answer questions.