Big Brother for Hire: FTC Cracks Down on Consumer Tracking Company

Nomi’s Tracking Technology

Nomi’s “Listen” service offers brick and mortar retailers the ability to track the movements of individuals in and around stores, providing these retailers with insights into consumer trends and patterns. Through a beacon placed inside retail stores, Nomi collects information emitted from consumers’ wireless devices, such as Smartphones or tablets, as they search for nearby WiFi networks. When searching for a wireless signal, devices broadcast a 12-digit identifier, known as a MAC address. Although Nomi scrambles the MAC address prior to storing it on its server, the result is still a unique identifier for each wireless device, permitting individualized customer tracking. Nomi uses this process to provide retailers with various consumer analytics, including the average duration of customer visits, the number of customers who pass by the store without entering, the percentage of repeat customers within a given time period, and the number of customers who also visit nearby stores.

The FTC Complaint and Settlement

In its complaint, the FTC alleged that Nomi failed to abide by representations made in the company’s privacy policy. Notably, Nomi’s privacy policy states that consumers have the ability to opt out of the company’s tracking system either on the Nomi website or in retail locations that use its technology. According to the FTC, however, Nomi did not require its clients to post in-store disclaimers about Listen tracking or otherwise provide information on how to opt out. Consequently, many consumers may have failed to opt out simply because they were unaware that they were being tracked in the first place.

In addition to imposing certain disclosure and reporting requirements, the FTC order approving the settlement also enjoins Nomi from engaging in any misrepresentations about either the extent to which consumers exercise control over their tracking services or the extent to which they will be given notice about such tracking.

Importantly, the FTC did not take issue with the actual tracking and data collection conducted by Nomi. Rather, it found that the company was engaging in deceptive practices by failing to live up to promises made in its privacy policy. It is important, then, for companies to pay attention not only to their substantive conduct, but also to the claims made in their privacy policies, as misrepresentations therein may lead to an FTC complaint.