Tracking Beacons: Unregulated And Coming To A Store, Stadium Or Airport Near You

They're ubiquitous, unregulated and coming to a location near you. Tracking beacons, little wireless sensors that tell apps in your smartphone that you're nearby, are making their way into retailers, supermarkets, museums, drug stores, sports stadiums and all manner of public places, part of a complex infrastructure of tracking hardware and software designed to influence shopping behavior in real time.

Beacon technology got some publicity early this week when BuzzFeed revealed the placement of the trackers had been placed in phone booths around Manhattan by billboard company Titan. But that’s just the tip of the iceberg. Macy’s, Duane Reade, Nordstrom, American Eagle Outfitters, Virgin Atlantic, the U.S. Open and 25 Major League Baseball stadiums are just some of the retailers and venues that have implemented beacon technology.

BI Intelligence estimates there are about 30,000 beacons pinging mobile phones around the country. Right now just 2 percent of U.S. retailers are estimated to be using them, showing that while advertisers see tons of promise, it's still early days. “The reality is in 2014 no one is really doing anything at scale yet,” said Jeremy Sigel, VP of mobile at Essence Digital, an ad agency.

But a confluence of events, including the proliferation of mobile payments and an update to Google's Android mobile operating system is expected to greatly expand the reach of the devices. Until now, beacon tracking has been limited to iPhones running iOS 7, which allows beacons to interact with apps when they’re not running. That’s about 30 percent of smartphones in America. But that’s about to expand: Google is expected to enable the technology in the next version of its mobile operating system, Android L, bringing Android phones into the beacon world.

Yet the technology is moving faster than the agencies that regulate them, leaving them in a legal grey area and no standards on how location data can be used, collected and stored and how consumers are notified that data collection is taking place.

“This is another example of how marketers are digging deeper into people’s lives without meaningful notice or consent,” said Jeff Chester, executive director of the Center for Digital Democracy. “It’s the Wild West and agencies are just catching up.”

Tracking beacons don’t collect data; rather, they alert the apps in a phone where you are. Those apps can then send messages, usually in the form of push notifications. Those notifications occupy a legal grey area somewhere between email, which is regulated by the Federal Trade Commission, and a text, which is regulated by the Federal Communications Commission.

Advertisers are allowed to send unsolicited email messages, but they must also contain a mailing address and a way to opt out of future emails. Text messages require explicit advance permission. The question the courts haven’t yet sorted out is: What is a “push” notification triggered by WiFi or Bluetooth networks?

“If a client were to come to me and say, ‘I want to send marketing using beacon,’ what I have to think about is would this be viewed as a text message -- I don’t think it is a text message,” said Liisa M. Thomas, chair of the privacy and data practice at law firm Winston & Strawn.

Last year, the watchdog group Future of Privacy Forum and Sen. Charles Schumer (NY-D) announced a code of conduct for location data collection, which includes prominent signage in locations where data is collected, as well as a website where people can go to opt out, smartstoreprivacy.com.

Beacons can collect the phone’s unique identifier, a 12-digit code that can allow a retail store to know that this is a single device and to track things like wait times and where the shopper moves in a store. The FPF’s code calls for marketers to de-identify information collected and to notify users how that information is used.

Facebook's entry into location advertising this week with its "Local Awareness Ads" will probably do more to make people aware of tracking than anything else in the market today. Facebook is only locating people within a mile, which can be done from cell towers and WiFi networks and does not require beacons.

Consumers can opt out by turning off the function in apps, not downloading them at all, or by turning off bluetooth tracking on their mobile phones. But most people will probably become aware they're being tracked not from a notice but from the ads and messages themselves. As FPF Executive Director Jules Polonetsky noted in an op-ed, “It’s not a surprise that the deployment of these technologies has led to critical media stories about surprised shoppers who express annoyance when told that they are secretly having their phones tracked.”