Nomi provides a technology that allows brick-and-mortar retailers to track how consumers in possession of mobile phones move through their stores, which can help retailers determine how to display merchandise, deploy sales staff, and design more efficient retail layouts, among other things. According to the FTC’s complaint, Nomi places sensors in retail stores that collect the media access control (MAC) addresses of consumer mobile phones when those devices are detected in and around the store. Nomi then hashes the MAC addresses, which are unique to each device, prior to storing them, and provides retailers with aggregated information on how many consumers pass by the store instead of enter it, how long consumers stay in the store, the types of devices consumers use, and how many repeat customers enter a store, among other information.
The Commission split 3-2 on whether to issue the complaint against Nomi and accept the proposed consent order. Commissioners Maureen Ohlhausen and Joshua Wright issued separate statements dissenting from the action. Commissioner Ohlhausen noted that “as a third party contractor collecting no personally identifiable information, Nomi had no obligation to offer consumers an opt out.” The FTC’s action therefore ultimately could harm consumer privacy because it could encourage other retail tracking companies to not offer an opt out at all for fear of not presenting it correctly and risking a deception claim. Commissioner Wright separately argued the agency should have declined to issue a complaint in the first place, noting that while Nomi’s reference to an in-store opt out option may have been incorrect, the absence of this option was not material, as consumers who saw this disclosure could have — and likely did, if it mattered to them — opt out on Nomi’s website.
Notably, the consent order does not require Nomi to provide in-store notice when a retailer uses its services, nor to provide an in-store (or online) opt-out. The FTC did not address the extent to which the store itself would have such obligations when it uses tracking technology. A statement by Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny said such notice was “not the Commission’s goal in bringing this case.” Instead, the case is “simply about ensuring that when companies promise consumers the ability to make choices, they follow through on those promises.”
Under the proposed 20-year consent order, Nomi will be prohibited from misrepresenting to consumers their options for controlling whether information is collected, used, disclosed or shared about them or their computers or other devices, as well as the extent to which consumers will be notified about information practices.
The consent order will be published in the Federal Register shortly and will be subject to public comment through May 25, 2015. After that time, the agency will determine whether to make the proposed order final.