Smartphone tracking crackdown leaves consumers in the dark

Federal regulators cracked down on secret smartphone tracking of shoppers on Thursday, but the end result is that covert tracking can continue and customers may never know it.

The Federal Trade Commission said it settled charges of deceiving consumers with Nomi Technologies, a New York-based company which supplies stores, malls and stadiums with equipment to secretly track shoppers using smartphone Wi-fi signals. The system does not identify individual shoppers but does maintain a database of visits by every phone.

In 2012 and 2013, Nomi's privacy policy promised that stores using its service would disclose the practice  and allow customers to opt out. But stores using Nomi's service made no such disclosures and consumers could only opt out of tracking on Nomi's web site -- meaning the privacy policy contained "false or misleading" representations, the FTC said on Thursday.

“It’s vital that companies keep their privacy promises to consumers when working with emerging technologies, just as it is in any other context,” Jessica Rich, director of the FTC’s Bureau of Consumer Protection, said in a statement.

As a result of the FTC settlement, however, retailers using Nomi's system won't have to disclose that they're secretly tracking customers. Nomi has simply eliminated the promise that they would. And the company doesn't reveal the identity of the retailers who use its services.

Now the only way consumers can avoid being tracked is by going to Nomi's web site and adding the MAC address of their phone, a serial-number-like unique 12-digit identifying code, to the company's opt-out listing. But there's still no way for consumers to know where Nomi, or one of many competing services, is tracking them in the first place.

Surreptitious tracking of shoppers' smartphones has raised the ire of privacy and consumer advocacy groups for years. And when the practice is divulged, for example by Nordstrom's in 2013, the outrage is swift and widespread.

As a result, Apple (AAPL) started scrambling the MAC addresses broadcast by iPhones last year to thwart tracking systems. The company's iBeacons feature allows stores to track customers even more closely via Bluetooth signals, however, if the customer consents by installing an app. And both iPhones and phones running Google's (GOOGL) Android software allow myriad apps to track a consumer's location unless the consumer chooses to opt out in the phone's settings.

Nomi doesn't disclose which stores use its tracking systems, but retailers generally say they that the monitoring is aimed at improving the shopping experience and the layout of stores.

Nomi said it made "the recommended changes" to its privacy policy over a year and a half ago. "Our mission is to help clients deliver the best possible customer experience, and a key part of achieving that goal is empowering consumers with choice," the company said in a statement.

"What consumers gain is that there is no longer a potentially deceptive statement in the privacy policy," Amanda Koulousias, an attorney in the FTC's Bureau of Consumer protection, said. And while there is no law requiring retailers to disclose tracking activity, they also must post accurate privacy policies, she said.

The FTC settlement with Nomi came on a 3 to 2 vote, with two Republican commissioners dissenting. The dissenters warned that the action would only prompt companies to promise even less disclosure in the future.

"I fear that the majority’s decision in this case encourages companies to do only the bare minimum on privacy, ultimately leaving consumers worse off," commissioner Maureen K. Ohlhausen wrote in her dissent.