News

Senator Chuck Schumer introduces voluntary 'code of conduct' for retail surveillance

October 23, 2013

U.S. Senator Charles E. Schumer, The Future of Privacy Forum and a group of location analytics companies — including Euclid, iInside, Mexia Interactive, SOLOMO, Radius Networks, Brickstream and Turnstyle Solutions — announced that they have agreed to a Code of Conduct to promote consumer privacy and responsible data use for retail location analytics. The companies responded to privacy concerns raised by Senator Schumer and the FPF about the use of this new technology. The code of conduct includes in-store posted signs that alert shoppers that tracking technology is being used, and instructions for how to opt out.

"This is a significant step forward in the quest for consumer privacy," Schumer said. "This agreement shows that technology companies, retailers, and consumer advocates can work together in the best interest of the consumer. There is still much more work to be done, and I will continue to push for privacy rights to be respected and strengthened, but this represents real progress, and I thank the Future Privacy Forum and these tech companies for their hard work hammering out this agreement."

In July, Schumer warned that major national retail chains were testing technology that would allow them to automatically track shoppers' location through stores. Following this warning, FPF worked with the technology companies to develop a code to ensure that appropriate privacy controls are in place as retailers seek to improve the consumer shopping experience. These technology companies use mobile device Wi-Fi or Bluetooth MAC addresses to develop aggregate reports for retailers.

The Code puts guidelines in place to create best data practices that will provide transparency and choice for consumers. The Code calls for the display of conspicuous signage by retailers and for a central opt-out site for consumers.

Under the Code, companies that collect data through this technology must limit how the information is used and shared and how long it may be retained. The Code mandates that companies de-identify the data and explain in their privacy policy how they do so. Companies are required to get opt-in consent when personal information is collected, or when a consumer will be contacted. The Code calls for opt-out consent where the information collected is not personal. In addition, this data cannot be collected or used in an adverse manner for employment, health care or insurance purposes.

"We are just beginning to see the possibilities that in-store analytics can bring to shoppers and to retailers, and yet, as with any new technology, there is the chance for confusion about the intent and possible implications of such technology," said Steve Jeffery, CEO, Brickstream. "We applaud the Future of Privacy Forum for taking the lead in bringing retailers and technology providers together to address these important issues."