In law school, everybody learns the adage that hard cases make bad law. When it comes to the Federal Trade Commission, a better aphorism might be, “easy cases make new law.” The FTC’s recent settlement with Nomi Technologies Inc. is, as the FTC’s press release notes, the “FTC’s first against a retail tracking company.” On its face, the case is like many FTC privacy cases: It challenges a statement in the company’s privacy policy for allegedly being inconsistent with the company’s actual practices and thus deceptive. Under the surface, however, the case may open the door for the FTC to create a notice-and-choice regime for the physical tracking of consumers, analogous to its well-established notice-and-choice regime for online tracking.
“Retail Tracking” and Nomi’s Allegedly Deceptive Practices
Retail tracking occurs when retailers, or their third-party service providers, capture and track the movements of consumers in and around stores through their mobile devices, such as through the use of Wi-Fi or beacons, in order, for example, to better understand store traffic or serve targeted offers. The FTC’s chief technologist recently published detailed comments on the “privacy trade-offs” of retail tracking and the various technologies that companies are using to engage in it. Given the potential lack of transparency around the practice and the corresponding privacy implications, it is not surprising that the FTC decided to address the practice through its Section 5 authority, even if the FTC did so in an indirect fashion.
It is also not surprising that the FTC has moved cautiously into this space. The facts of In re Nomi, as alleged in the complaint, are simple. Nomi provided mobile device tracking technology that enabled its clients, brick-and-mortar retailers, to receive analytics reports about aggregate customer traffic patterns — that is, how long consumers stay in the store and in which sections, how long they wait in line, what percentage of consumers pass by the store altogether, and so on. Nomi represented in the privacy policies posted on its website that it would “[a]lways allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.” While Nomi offered an opt-out on its website, it allegedly did not provide an opt-out mechanism at its clients’ retail locations, thus rendering its privacy policy promise deceptive, in violation of Section 5 of the FTC Act.
The FTC further alleged that Nomi represented, expressly or by implication, that consumers would be given notice when they were being tracked at a retail location. The statement of Chairwoman Edith Ramirez and Commissioners Julie Brill and Terrell McSweeny in support of the complaint and proposed order explains that “the express promise of an in-store opt out necessarily makes a second, implied promise: that retailers using Nomi’s service would notify consumers that the service was in use. This promise was also false. Nomi did not require its clients to provide such a notice. To our knowledge, no retailer provided such a notice on its own.” By allegedly failing to provide notice when a retail location was utilizing Nomi’s service to track customers, Nomi’s implied promise to provide notice was also deceptive.
The FTC Keeps Nomi Narrow, for Now. What Lessons Can Others Learn?
The proposed order provides for very narrow injunctive relief: It simply enjoins Nomi from misrepresenting how consumers can control the collection, use, disclosure or sharing of information collected from them or their devices, and from misrepresenting the extent to which consumers will receive notice about such tracking. The majority commissioners, in their statement, were at pains to disclaim any significance of the case with regard to the practice of retail tracking specifically:
While the consent order does not require that Nomi provide in-store notice when a store uses its services or offer an in-store opt out, that was not the Commission’s goal in bringing this case. This case is simply about ensuring that when companies promise consumers the ability to make choices, they follow through on those promises.
In other words, Nomi is the FTC’s first case involving brick-and-mortar tracking, but the FTC is not yet creating new law: The proposed order does not impose any affirmative notice and choice obligations on industry participants in the retail tracking space. It is not surprising that the commission declined to take such a drastic step with a practice that is still, relatively speaking, in its infancy, and that does not, on its face, involve sensitive personal information (though, while the information collected may be anonymous and analyzed only in aggregate, some retailers may, or at least could, pair tracking information through their apps with other information about identifying a specific consumer).When the FTC does impose specific obligations relating to a particular practice, it typically moves in an incremental fashion. For example, the FTC noted in its 2009 Report on Self-Regulatory Principles for Online Behavioral Advertising and again in its 2012 Privacy Report that the collection of precise geolocation requires affirmative express consent because such information is sensitive. The FTC continued to indicate, in guidance and follow-on staff reports, that a failure to provide notice and obtain affirmative opt-in consent for the collection of precise geolocation information could give rise to a cause of action for deception under Section 5 of the FTC Act.Then, when the FTC settled a case (
When the FTC does impose specific obligations relating to a particular practice, it typically moves in an incremental fashion. For example, the FTC noted in its 2009 Report on Self-Regulatory Principles for Online Behavioral Advertising and again in its 2012 Privacy Report that the collection of precise geolocation requires affirmative express consent because such information is sensitive. The FTC continued to indicate, in guidance and follow-on staff reports, that a failure to provide notice and obtain affirmative opt-in consent for the collection of precise geolocation information could give rise to a cause of action for deception under Section 5 of the FTC Act.Then, when the FTC settled a case (Goldenshores), alleging violations of Section 5 relating to an Android app’s collection, use and disclosure of precise geolocation from users’ devices, the order imposed specific parameters on the out-of-policy notice and choice that the app had to provide — effectively creating a new notice and choice regime for the collection, use and disclosure of such information that companies ignore at their peril.By contrast, the
Then, when the FTC settled a case (Goldenshores), alleging violations of Section 5 relating to an Android app’s collection, use and disclosure of precise geolocation from users’ devices, the order imposed specific parameters on the out-of-policy notice and choice that the app had to provide — effectively creating a new notice and choice regime for the collection, use and disclosure of such information that companies ignore at their peril.By contrast, the
By contrast, the narrow approach the FTC has taken with Nomi raises the question of whether the FTC would ever impose a notice and choice obligation for offline, retail tracking. We have no certainty around the FTC’s view, but it is reasonable to anticipate that the FTC will move in a direction that mirrors its position with respect to online tracking — that is, that at least when information is collected for targeted advertising purposes, a company should provide meaningful disclosures to consumers about the tracking and choice with respect to whether to allow it.[2] The FTC could ultimately deem a failure to provide such notice and/or choice an unfair and/or deceptive practice under Section 5 of the FTC Act.
What does this mean for retailers and other places of business? In light of Nomi and our expectations with respect to the direction the FTC is likely to take, companies that engage in in-store tracking should consider how best to provide their customers with notice and choice. Whatever the FTC does, it will probably move conservatively. That means that the FTC is likely to continue to identify practices as violations of Section 5 if they can be remedied without stifling retail tracking technology as it matures.
The Nomi complaint presents two interrelated themes that provide a guide to future enforcement. First, choice must be linked to notice, meaning that, as far as the FTC is concerned, consumers do not have meaningful choice unless they also have notice at the point of collection, even if notice is provided only in a privacy policy only. Nomi can thus be read to suggest that, at least in some circumstances, choice with regard to virtual tracking needs to be accompanied by notice in the brick-and-mortar world. Second, the complaint suggests, obliquely, that tracking consumers’ physical activities is “material” — i.e., that it is likely to affect the consumer’s conduct. If that is right, then this type of tracking must be disclosed to consumers because the failure to make such a disclosure would be, axiomatically, a material omission.
How should retailers proceed? One option is to track only those customers who have downloaded the retailer’s app and affirmatively agreed to be tracked for identified purposes, such as the delivery of targeted offers. Another option is to use a vendor that subscribes to the Future of Privacy Forum Mobile Location Analytics Code of Conduct, which requires participating mobile location analytics companies to, among other things, provide consumers with appropriate notice and choice. These types of compliance strategies could help protect companies from the next possible phase of FTC enforcement in this space, since they address what appear to be, for now, the most direct ways to avoid conducting retail tracking without providing notice and choice.