Analytics company Nomi Technologies, which tracks consumers in retail environments, failed to live up to its privacy promises, the Federal Trade Commission alleged in a complaint unveiled on Thursday.
But Nomi didn't require its 45 retail clients to disclose whether they used the technology, and most of its clients didn't voluntarily do so, the FTC alleged. The result was that consumers who might have chosen to opt out at retail locations weren't able to, according to the agency.
“Consumers were not provided any means to opt out at retail locations and were unaware that the service was even being used,” the FTC said in its complaint.
Nomi agreed to settle the charges by promising that it won't in the future misrepresent its policies.
Like other retail tracking companies, Nomi provides data about shoppers' traffic patterns, such as the percentage of people who enter a store after walking by it.
Between January and October of 2013 (the time period referenced in the FTC's complaint) Nomi gathered tracking data via 12-digit “media access control” (MAC) addresses -- identifiers that mobile devices broadcast when users turn on WiFi or Bluetooth. Nomi attempted to anonymize the MAC addresses by replacing the actual series of characters with alternate, but persistent, identifiers, the FTC alleged.
Last year, Apple moved to prevent tracking via MAC addresses by reconfiguring its software. Now, iOS 8's WiFi scanning uses random, locally administered MAC addresses, instead of the permanent MAC addresses.
Commissioners Maureen Ohlhausen and Joshua Wright dissented from the decision to bring an enforcement action against Nomi.
Ohlhausen -- who described Nomi as “a young company that attempted to go above and beyond its legal obligation to protect consumers” -- wrote that the majority's decision could encourage other companies to “do only the bare minimum on privacy.”
But Commissioners Edith Ramirez, Julie Brill and Terrell McSweeny, who voted in favor of the decision, said that even though the FTC encourages companies to offer privacy choices, the agency “must take action in appropriate cases to stop companies from providing false choices.”
Wright said in his dissent that the evidence indicates that Nomi's representation regarding opting out at retail locations was “not material and therefore not deceptive.”
He also said that the FTC's order doesn't address one of the key privacy issues posed by retail tracking, which is that store owners don't have to disclose their tracking practices.