A company that tracked retail store customers through their smartphones without notifying them and without giving them a chance to turn off the tracking has settled a U.S. Federal Trade Commission complaint that it didn’t live up to its privacy promises.
Nomi collected information on about 9 million mobile devices during the first nine months of 2013, according to a complaint filed by the agency.
“It’s vital that companies keep their privacy promises to consumers when working with emerging technologies, just as it is in any other context,” Jessica Rich, director of the FTC’s Bureau of Consumer Protection, said in a statement. “If you tell a consumer that they will have choices about their privacy, you should make sure all of those choices are actually available to them.”
The company also noted that the FTC’s two Republican commissioners opposed the agency taking action against the company. There was no consumer harm in the case, Republican Commissioner Maureen Ohlhausen said.
Nomi is a “young company that attempted to go above and beyond its legal obligation to protect consumers but, in doing so, erred without benefitting itself,” Ohlhausen wrote in her dissent.
Nomi installs sensors in its clients’ stores that collect the MAC addresses of store customers’ mobile devices as the devices search for Wi-Fi networks. Nomi partially obscures, or hashes, the MAC addresses before storing them, but the process produces an identifier that is unique to a consumer’s mobile device and can be tracked over time, the FTC said.
Nomi tracked consumers both inside and outside their clients’ stores, including the device type, date and time and other information, according to the FTC’s complaint.
In reports to retail clients, Nomi provided aggregated information on how many consumers passed by the store instead of entering, how long consumers stayed in the store, the types of devices used by consumers, how many repeat customers enter a store in a given period and how many customers had visited another location in a particular chain of stores.
In the settlement with the FTC, Nomi is prohibited from misrepresenting consumers’ options for controlling whether information is collected, use or shared about them and their devices. Nomi is also prohibited from misrepresenting how it notifies consumers about its information-gathering practices.