Nomi Technologies, a company that helps retail stores track consumers using their mobile devices, has agreed to settle Federal Trade Commission charges that it misled consumers with promises to provide an in-store mechanism for consumers to opt out of tracking and that they would be notified when the tracking was taking place.
This complaint is the FTC’s first against a retail tracking company.
The company’s privacy policy stated it “pledged to… always allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.” Although there was an opt-out option on its website, the complaint alleges that no option was available at retail stores and that consumers were not informed when being tracked.
According to the FTC, Nomi collected information from approximately 9 million mobile devices within the first nine months of 2013.
“It’s vital that companies keep their privacy promises to consumers when working with emerging technologies, just as it is in any other context,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “If you tell a consumer that they will have choices about their privacy, you should make sure all of those choices are actually available to them.”
The complaint said that Nomi places sensors in its clients’ stores that collect the MAC address, a 12-digit code unique to each device, of consumers’ mobile devices while it searches for WiFi networks. Despite the fact that the company uses a technique called hashing to obscure the MAC addresses before storing them, this technique still results in a code for an individual device to be tracked over time.
Related Stories
Nomi tracked customers both inside and outside their clients’ stores to collect information including, device type, date and time the device was observed and signal strength of the device. The company provided information on how many consumers passed by the stores instead of entering, how long consumers stayed in the store, how many repeat customers enter the store in a given period and how many customers had visited another location in a particular chain of stores.
Under the terms of the settlement with the FTC, Nomi agreed to abide by its privacy promises and not misrepresent consumers’ options when it comes to controlling their information and blocking being tracked.
The Commission vote to issue the complaint and accept the proposed consent order was 3-2. It will soon publish a description of the consent agreement package in the Federal Register. The agreement will be open for public comments for 30 days until May 25, before it is finalized.
The FTC held a privacy seminar on the issue of mobile device tracking in the retail environment as part of its spring privacy series last year.
“We continually review our privacy policies to ensure that they follow best practices and had already made the recommended changes in pursuit of that goal by updating our privacy policy over a year and a half ago, while we were still an early-stage startup that was less than a year old,” Nomi told Forbes.