Mobile Location Analytics & Customer Privacy: A New Debate

Feb 20, 2014 9:10am

Retail businesses have to make a lot of big (read: expensive) decisions about how to get the most out of their real estate: What merchandise draws the most traffic, and how much time do shoppers spend there? Where would checkout lines be most efficient and not interfere with other shoppers?  Learning the right answers should help a business improve its service and customer experience. In a competitive marketplace, the stakes are high for retailers to make the right choices, quickly.

To help understand how shoppers are behaving in their stores, retailers are contracting statistical modeling firms that collect and analyze data many shoppers may not even realize they’re providing through their smartphones. The growth of the mobile location analytics (MLA) industry has raised a different set of questions about the specific information being collected, how it’s being used (and could be used in the future), and to what extent, if at all, consumers are aware this is happening.

Those were the questions discussed at the Federal Trade Commission’s Mobile Device Tracking seminar on Feb. 19, the first in its three-part Spring Privacy Series.

What's being tracked?
Can I be identified?
Is the public aware?
Can I opt-out?    

What’s being tracked?

Smartphones transmit a number of different signals, among them for Bluetooth, Wi-Fi, global positioning system (GPS) and global system for mobile communications (GSM), which is how voice conversations are transmitted, explained Ashkan Soltani, a former staff technologist at the FTC’s Division of Privacy and Identity Protection.

While GPS is well known for location purposes, each of these signals can be processed, by the right equipment, to track a device’s movements. Soltani said more companies use Wi-Fi to track visitors because “the laws are a little bit clearer” regarding interception of that signal and it’s relatively cost efficient to do so.

Enter Jim Riesenbach, CEO of iInside, and Glenn Tinley, founder of Mexia, who represented the MLA industry. Both said their firms collect Wi-Fi and Bluetooth, which pinpoints the location even further. “Monitoring devices can be as broad as tracking (across) an entire mall or within a single cashier line,” Riesenbach said.

However, some smartphone users don’t enable Wi-Fi or Bluetooth. Riesenbach asserts this distinguishes iInside as more of a statistical modeling and marketing company, and less of a Big Brother. “It’s not about trying to track and identify,” he said, noting that with such a low number of Bluetooth-enabled users, around 5 percent, it requires thousands of visitors to create a meaningful sample size from which to build their consumer behavior models.

Riesenbach said his firm analyzes the aggregate data largely for three purposes: pathing, dwell time, and wait time. These are pretty much what they sound like. Pathing is how shoppers move through the store and where they go, helping retailers determine if the store “flows.” Dwell time is the average time shoppers spend in specific area, which could suggest a need for more staffing in that department, and wait time refers to how long customers are in line at checkout. 

There are broad additional uses, such as tracking customer loyalty over time and strategic placement of new retail locations within malls. “In a shopping environment the collection of retailers is important,” Tinley said. “Where should a new store go based on traffic? That’s a decision this data is helping companies make.”

MLA firms present this data to retailers in the fashion of, X percent of customers visited this part of the store in the last month and the average wait time on weeknights was Z minutes. Data about a specific device is not revealed. “In the end, our clients don’t have access to that individual data, they have access to aggregate data,” Riesenbach said.

Can I be identified?

No matter how aggregate the results may be, concerns over identification remain. Smartphones have unique serial numbers known as MAC addresses, and “there is very little users can do to change them,” Soltani said.

A common cryptology technique known as hashing is used to convert the device’s MAC address into a separate unique identifier. Those unique signatures can’t be identified to the person – it won’t reveal the device user’s name, age, address or other personal information – but it can be used to develop a record for that user’s activity within a retailer’s stores over time. “What we have is a hashed MAC address,” Riesenbach emphasized. “We won’t store anything (identifying) to the specific device.”

That devices can be uniquely identified at all is what Seth Schoen, a senior staff technologist at the Electronic Frontier Foundation, takes issue with. Schoen said he prefers that device makers offer a functionality allowing users to change their MAC address. Much of the data collection regarding single visits – such as pathing, dwell time and wait time – could still be achieved, he argued, though it would impact analytics over time. 

“I’d like device makers to player a larger a role in making people aware of how their device [transmits],” Schoen said. “Device makers actually warning people, ‘People will know where your device is when used as intended’ – that’s something I would like to see.”

Is the public aware? 

Public awareness of this nascent industry and its practices is indeed a challenge for MLA companies and their clients, whose customers are relatively naïve that it’s even occurring. Mallory Duncan, senior vice president for the National Retail Federation, called it “a balancing act between understanding these dynamics and hurting consumer trust that encourages people to visit a store in the first place.”

To build trust, retailers must do a better job of conveying awareness of both the tracking activity and its benefits to customers, said Ilana Westerman, CEO of Create with Context, a digital services research and design firm.

While mobile tracking has become more commonplace, only 50 percent of consumers are aware their location may be collected, she said. Yet the willingness to share exists. Westerman cited research that found people were more than two times more willing to provide data to businesses if “it makes sense.” In one survey, 97 percent of respondents would give up a piece of data to save money.

Westerman added that people are willing to share information about themselves, but reluctant to share data that concerns others, either through contacts, pictures or social media networks. This is the type of information, Tinley says, Mexia doesn’t collect (and woudn’t be able to), which varies from the types of data transmitted about devices from some mobile apps. “There’s a difference between monitoring, observing, and tracking an app, versus a device being seen and observed as a dot,” he said.

Can I opt-out? 

Finding a practical, meaningful way to convey mobile tracking and its benefits to shoppers has been tricky. Westerman's research found that both in-store signage and mobile alerts won’t be seen in a timely fashion, if at all. “We recognize this is not the ideal, perfect solution,” Duncan said.

Cognizant that better methods of notification and consent may arise as the practice evolves, Riesenbach and Tenley said notification efforts have centered around signage in stores. Tenley added that some signage includes the new web address – – that will allow customers to opt-out of mobile tracking by all MLA companies.

The opt-out is one part of the MLA’s collaboration with the Future of Privacy Forum, a think tank for data privacy and stewardship practices. MLA companies and FPF also collaborated to create the MLA's first industry-wide code of conduct. “The best thing is to come together as an industry and create some types of visual cues,” Riesenbach said.

Though the code of conduct and opt-out website are a promising start, Schoen worries about the future of tracking, which could become more invasive and thus more identifiable, particularly when it comes to profiling customers. “I think what we’re going to see is, where there’s a will, there’s a way,” he said.

While Riesenbach acknowledged there was the potential for some MLA techniques to become more invasive, he felt this relatively new industry would grow responsibly – that is, responsive to its clients and their customers’ wishes.

“We have to continue to evolve our technology, evolve our conduct, and at the end of the day, the marketplace will prevail,” he said. “I don’t think some of the worst-case scenarios will come to be because I don’t think the market will allow it.”