Commentary

FTC Finalizes Deal With Nomi Over Location Tracking

Marketing and analytics companies generally don't have to let consumers control whether data about them is collected.

But if companies tell consumers they can opt out of tracking, the companies must keep that promise. That's the message the Federal Trade Commission is sending with its decision to prosecute the retail tracking firm Nomi Technologies, which allegedly misrepresented its privacy practices.

Late last week, the FTC finalized a deal requiring Nomi to promise that it won't in the future misrepresent its privacy policy. The agency's move came over the objections of trade groups like the Application Developers Alliance, which argued there was no need for a "disproportionate and heavy-handed" action by the FTC.

Nomi said in its former privacy policy that people could opt out of being tracked in retail environments by providing the company with their devices' 12-digit MAC addresses, according to the FTC. The company, which provides analytics services to retailers, also allegedly promised to allow consumers to opt out at any retailer using Nomi’s technology,

But Nomi didn't require its 45 retail clients to disclose whether they used the technology, and most of its clients failed to do so, the FTC alleged in a complaint unveiled earlier this year. The result was that consumers who might have chosen to opt out at retail locations weren't able to, according to the agency.

Like other retail tracking companies, Nomi provides data about shoppers' traffic patterns, such as the percentage of people who enter a store after walking by it. Between January and October of 2013 (the time period covered by the FTC's complaint) Nomi gathered tracking data via 12-digit “media access control” (MAC) addresses -- identifiers that mobile devices broadcast when users turn on WiFi or Bluetooth.

Nomi attempted to anonymize the MAC addresses by replacing the actual series of characters with alternate, but persistent, identifiers, according to the FTC. Last year, Apple moved to prevent tracking via MAC addresses by reconfiguring its software. Now, iOS 8's WiFi scanning uses random, locally administered MAC addresses, instead of the permanent MAC addresses.

Nomi's privacy policy no longer says that consumers can opt out at retail locations.

The U.S. Chamber of Commerce, App Developers Alliance, NetChoice (which counts Google, AOL, eBay, Facebook and Yahoo as members) and other organizations opposed the consent decree.

Among other arguments, the App Developers Alliance told the FTC that its move could backfire by encouraging companies to "simplify" their policies by making less information available to consumers.

A majority of the FTC rejected that concern. "The Commission encourages companies to provide truthful privacy choices to consumers and believes such choices are consistent with growth and innovation. However, the Commission also must take action in appropriate cases to stop companies from providing false choices," the agency said in a letter to the App Developers Alliance. "Further, prior Commission cases like this one have not deterred companies from continuing to provide truthful choices, or from adopting voluntary privacy codes in innovative areas."

Commissioner Maureen Ohlhausen dissented from the agency's action. "The FTC should not have adopted this complaint and order because it undermines the Commission’s own goals of increased consumer choice and transparency of privacy practices and because the order imposes a penalty far out of proportion to the non-existent consumer harm," she wrote.

Next story loading loading..