Retail Tracking Firm Slammed with FTC Consent Order

The Federal Trade Commission last month announced a proposed consent order settling claims against Nomi Technologies, a third-party mobile tracking service that collects data about consumers' in-store shopping behavior. The FTC's case against Nomi is significant, but not for involving a high-profile defendant or for carrying steep penalties-Nomi is a relatively unknown start-up and the proposed settlement entails purely injunctive relief. The settlement marks the Commission's first enforcement against a retail tracking company, and it demonstrates the FTC's willingness to hold companies accountable for adhering strictly to the stated terms of their privacy policies. Although the Nomi settlement likely will focus increased attention on in-store consumer tracking practices, the implication of the decision is broader: if a company makes representations or promises in its privacy policy, the FTC expects the company to keep them.

While the FTC has focused a great deal of attention on consumer privacy in the digital space, and targeted online marketing is nothing new, the FTC's case against Nomi involves a less familiar form of consumer tracking. Nomi's service allows retailers to follow consumers' movements around their stores by tracking signals on consumers' smartphones. The technology picks up media access control (MAC) addresses that are broadcast by the WiFi interface on shoppers' phones, so as shoppers move throughout a store, the Nomi sensors detect signals from shoppers' phones. While Nomi's technology does not capture personal identification information, by detecting and aggregating consumers' MAC addresses as they move around a store, Nomi is able to provide information to the retailer about a consumer's shopping patterns-including how long a visitor stayed in the store and whether that person has ever visited another location, if the retailer has more locations. In addition, the complaint noted that Nomi also tracked people who passed by stores that were using the technology, even if they never entered it, giving stores information about how many people passed by the store rather than entering.

While the FTC noted that all of the information Nomi provided could be beneficial to retailers and consumers-for example "to improve store layouts and reduce customer wait times"-the focus of the FTC's enforcement action was the technology company's privacy policy, which stated that consumers could opt out of the company's tracking services by registering on its website. The privacy policy also promised customers that they could opt out online "as well as at any retailer using Nomi's technology." In practice, however, retailers did not notify customers when Nomi technology was active, so consumers could not avail themselves of this promised in-store opt-out opportunity. In short, the FTC maintained, Nomi's privacy policy misled customers with its express promise that customers would be given an opportunity to opt out of Nomi's tracking services when they entered stores using the tracking technology. The FTC regarded this misrepresentation as a violation of Section 5 of the FTC Act.

Under the terms of the proposed consent order, Nomi will be prohibited from misrepresenting consumers' options for controlling whether information is collected, used, disclosed, or shared about them or their computers or other devices, as well as the extent to which consumers will be notified about information practices.

The FTC Commissioners voted 3-2 in favor of issuing the complaint and accepting the proposed order, and the dissents by Commissioners Wright and Ohlhausen were sharp. Commissioner Wright's statement emphasized that while Nomi may have technically violated its privacy policy, its underlying activity was legal (no personal information was collected) and the technical violation of the company's privacy policy did not rise to the level of materiality required under Section 5 to support agency action. In Wright's view, no evidence existed that consumers would have behaved appreciably differently had an in-store opt-out opportunity existed-and thus no real injury occurred. Likewise, Commissioner Ohlhausen's statement took issue with the majority's "strict liability" approach, expressing concern that the decision would discourage companies from adopting privacy policies beyond the bare minimum. Both dissenters viewed the enforcement action-even with civil penalties-as a poor exercise of prosecutorial discretion.

Commissioners Ramirez, Brill and McSweeny, in their statement approving the enforcement action, focused on the "express" promise to provide an in-store opt-out mechanism, as well as the implied promise that customers would be notified whether a particular store was using tracking technology. The majority rejected the argument put forth by the dissenters that the deception was immaterial. In the majority's view, a presumption of materiality could not be overcome given the absence of sound evidence about how many customers would have opted out had they actually been able to avail themselves of an in-store opt-out mechanism.

Although this was the first FTC action to address in-store tracking, the technology itself was not the focus of inquiry. The FTC did not allege that Nomi was required to provide in-store notice or that Nomi's tracking technology itself infringed consumers' privacy. Rather, the violation related entirely to Nomi's failure to live up to the stated terms of its voluntarily adopted privacy policy.

This client alert is a publication of Loeb & Loeb LLP and is intended to provide information on recent legal developments. This client alert does not create or continue an attorney client relationship nor should it be construed as legal advice or an opinion on specific situations.