FTC’s Latest Location-Tracking Settlement Reminds Companies to Mind any Gap Between What They Say and What They Do
According to the complaint issued along with the order, Nomi places sensors in its retail store clients’ stores that collect the MAC addresses of consumers’ mobile devices as the devices search for Wi-Fi networks. It hashes the MAC address, but according to the complaint, the result is still a persistent unique identifier for the mobile device that can be tracked over time. Nomi uses the information to provide analytics reports to its clients about aggregate customer traffic patterns such as the percentage of consumers passing the store without entering, the duration of consumer visits, the types of mobile devices used by consumers, as well as the percentage of repeat customers and the number of customers that also visited another location within a chain according to the complaint.
Nomi pledges to . . . [a]lways allow consumers to opt out of Nomi’s service on its website as well as any retailer using Nomi’s technology.
The proposed order, agreed to by three of the five FTC commissioners, prohibits Nomi from misrepresenting the options through which or the extent to which consumers can exercise control over the collection, use, disclosure, or sharing of information collected from or about them or their computers or devices, or the extent to which consumers will be provided notice about how data from or about a particular consumer, computer, or device is collected, used, disclosed, or shared.
The order will be made final by the Commission after the comment period. Based on the comments, the Commission may choose to modify the order, but that rarely happens absent a misunderstanding of the facts or the application of the order.
In a separate dissent, Commissioner Ohlhausen expressed her view that the Commission “should not apply a de facto strict liability approach to a young company that attempted to go above and beyond its legal obligation to protect consumers but, in so doing, erred without benefiting itself.” She also recommended that the Commission should use its limited resources to pursue cases that involve consumer harm, and agreed with Commissioner Wright that the evidence of consumer harm was sparse in this case.
The Nomi settlement affirms again the importance of ensuring that a company’s public statements are accurate. The dissents provide useful insights into how Commissioners Wright and Ohlhausen will view future deception actions in terms of establishing materiality and articulating consumer harm.
Katherine Armstrong, Counsel in our Washington, D.C. office, contributed to this post.
This entry original was posted on Hogan Lovells’ Chronicle of Data Protection