Original URL: https://www.theregister.com/2011/11/29/cellphone_tracking_nixed/

Malls suspend plan to track shoppers' cellphones

Privacy concerns rain on retailer's snoop fest

By Dan Goodin

Posted in Security, 29th November 2011 01:07 GMT

Two shopping malls have dropped plans to track shopper's movements after a US senator voiced privacy concerns about the practice, which involves monitoring individuals' cellphone signals.

The Footpath tracking system will no longer be used at the Promenade Temecula mall in southern California or the Short Pump Town Center mall in Virginia. An article published last week on CNN.com said both malls planned to deploy the system beginning the day after Thanksgiving, which is typically the busiest shopping day of the year.

The product of UK-based Path Intelligence, Footpath uses antennas to detect the TMSI, or Temporary Mobile Subscriber Identifier, of each cellphone in the vicinity to anonymously track shoppers as they move from store to store. The TMSIs, which are short-term numbers issued to a mobile device when it enters a cell tower's coverage area, are put through a one-way hash function to prevent them from being intercepted, and all data collected is encrypted and anonymized. The only way for users to stop the tracking is to turn their devices off.

The owner of both malls suspended the plans after receiving a letter over the weekend from US Senator Charles Schumer of New York. In a statement published on his website, he warned that the tracking service might be abused. He also called on the Federal Trade Commission to investigate if Footpath violates privacy laws.

“Personal cell phones are just that – personal,” Schumer wrote. “If retailers want to tap into your phone to see what your shopping patterns are, they can ask you for your permission to do so. It shouldn’t be up to the consumer to turn their cell phone off when they walk into the mall to ensure they aren’t being virtually tailed.”

A spokesman for Forest City, which owns and operates the malls, said the company is suspending the project until it offers shoppers a way to opt out of the tracking that doesn't require cellphones to be turned off.

For her part, the CEO of Path Intelligence defended Footpath as a system that allowed brick-and-mortar retailers to track customers in much the way e-commerce websites have been doing for years.

“Online retailers do not require you to 'opt-in' to being tracked,” Sharon Biggar told a reporter for The Hill. “Rather they observe/track behavior from the moment a shopper enters an online website. We are simply seeking to create a level playing field for offline retailers, and believe you can do so whilst simultaneously protecting the privacy of shoppers.”

We're guessing Biggar's PR handlers didn't tell her about the do-not-track and Right to be Forgotten directives under consideration in the US and EU respectively. The use of browser cookies to track web visitors, often without their consent, has turned out to be highly controversial, as a huge raft of lawsuits suggests. ®