POPAI Privacy Suggestions Hit All the Right Issues

• by Erik Sass , Staff Writer @eriksass1, February 5, 2010

Last week saw the release of a recommended code of conduct for the burgeoning digital out-of-home advertising business. The suggested regulations were crafted by an out-of-home advertising industry organization, the Point of Purchase Advertising Institute (POPAI), to avoid transgressions that could inspire consumer backlash -- especially in the new, controversial area of facial recognition technology, colloquially "billboards that look back." The POPAI recommendations serve as a reminder that the DO industry must take the initiative in formulating an official set of standards for voluntary self-policing. Because if they don't do it, the government certainly will (just strike out the words "voluntary" and "self" in the preceding sentence).

The new report, titled "The One-Way-Mirror-Society: Privacy Implications of Digital Signage," mentions a number of "mid-range" tracking technologies. It includes technology that allows digital signage to track heat paths (showing a consumer's movement, for example, around a retail environment) and separate technology that tracks the consumer's gaze, to determine what part of the sign is most interesting. But the real hot-button issue is digital signage that can scan the facial features and other physical characteristics of passers-by to determine their age, gender and ethnicity.

The organization's recommendations include prominent disclosure by signage that tracking technology is being used; no storage of biometric or other personally identifying data without a consumer "opt-in"; and no re-purposing of footage from security cameras or tracking technologies originally employed for another purpose (like fire safety compliance).

This last recommendation is perhaps the single most important point made by POPAI, and it merits further exploration. Contrary to what many believe, facial recognition applications don't require the installation of expensive new equipment or vast computing power; the technology can use data from any video source, meaning every one of the nation's approximately 30 million security cameras can be equipped with this functionality. What's more, facial recognition can really mean "recognition": one brand of technology used by some DO companies, originally developed by the Israeli security forces, is capable of matching the faces of passersby to a database of known faces at the rate of about 100,000 per second.

Whether or not banks, stores, schools, and various public agencies choose to make use of facial recognition technology, it seems clear that advertisers shouldn't even consider the idea of partnering with them for consumer data. At some point this could be quite tempting: security cameras are now ubiquitous in high-traffic commercial areas like New York's Union Square or Los Angeles' Rodeo Drive, and local business owners might well be amenable to offsetting the cost of security surveillance by providing basic information about foot traffic and the demographic characteristics of passers-by to DO companies, for a fee. Just a few such partnerships would allow advertisers to piece together a virtually complete picture of the crowds entering and exiting a commercial district, so they could adjust their advertising accordingly.

But this seems guaranteed to provoke a public backlash: Americans are already uneasy about the level of public surveillance undertaken by private entities, and there is something especially nefarious about the notion of them sharing the information for profit. On the other hand, this raises an interesting ethical issue: if a DO company were to install its own unobtrusive video cameras equipped with facial recognition software to track movements in public places (independent of displays) is this also an unwarranted invasion of privacy? Per the POPAI recommendations, would the disclosure that facial recognition software is in use have to be posted by the camera itself, or does it merely have to appear by the display showing advertising?

One thing's for sure: whatever standards the industry settles on, they must fall well within the comfort range of the American public, or run the risk of a backlash followed by a regulatory crackdown.