In-Store Tracking Gets a Little Harder
- by David Dorf
Remember how Nordstrom was tracking shopper movements within their stores using the unique number, called a MAC, emitted by the WiFi radio in smartphones? The phones didn't need to connect to the network, only have their WiFi enabled, as most people do by default. They did this, presumably, to track shoppers' path to purchase and better understand traffic patterns. Although there were signs explaining this at the entrances, people didn't like the notion of being tracked. (Nevermind that there are cameras in the ceiling watching them.) Nordstrom stopped the program.
To address this concern the Future of Privacy, a Washington think tank, created Smart Store Privacy, a do-not-track service that allows consumers to register their MAC address in much the same way people register their phone numbers in the national do-not-call list. A group of companies agreed to respect consumers' wishes and ignore smartphones listed in the database. The database includes Bluetooth identifiers as well. Of course you could simply turn your bluetooth and WiFi off when shopping as well.
Most know that Apple prefers to use BLE beacons to contact and track smartphones within their stores. This feature extends the typical online experience to also work in physical stores. By identifying themselves, shoppers can expect a more tailored shopping experience much like what we've come to expect from Amazon's website, with product recommendations and offers that are (usually) relevant.
But the upcoming release of iOS8 is purported to have a new feature that randomizes the WiFi MAC address of smartphones during the "probing" phase. That is, before connecting to the WiFi network, a random MAC number is used so as to keep the smartphone's real MAC address secret. Unless you actually connect to the store's WiFi, they won't recognize the MAC address.
The details on this are still sketchy, but if the random MAC is consistent for a short period, retailers will still be able to track movements anonymously, but they won't recognize repeat visitors. That may be sufficient for traffic analytics, but it will stymie target marketing. In the case of marketing, using iBeacons with opt-in permission from consumers will be the way forward.
There is always a battle between utility and privacy, so I expect many more changes in this area. Incidentally, if you'd like to see where beacons are being used this site tracks them around the world.
