New Code of Conduct for Retailers Tracking Customers via WiFi

Practical Law Legal Update 4-547-1106 (Approx. 3 pages)

New Code of Conduct for Retailers Tracking Customers via WiFi

by Practical Law Intellectual Property & Technology

Published on 29 Oct 2013 • USA (National/Federal)

The Future of Privacy Forum (FPF), US Senator Charles E. Schumer and mobile analytics companies released a Mobile Location Analytics Code of Conduct for retailers that track customers using mobile phone WiFi signals. The code is aimed largely at mobile analytics companies that provide the tracking software.

The Future of Privacy Forum (FPF), US Senator Charles E. Schumer and a group of mobile analytics companies released the Mobile Location Analytics Code of Conduct on October 22, 2013. Mobile Location Analytics (MLA) uses customers' in-store movements, tracked by cellphones' interaction with store WiFi networks, to develop reports that retailers can use to reduce check-out waiting times, adjust the timing of sales and discounts, optimize store layouts and better understand consumer shopping patterns. The code is intended to provide a self-regulatory framework for MLA companies who provide this tracking software to retailers. The self-regulatory code aims to promote consumer privacy and responsible data use for retail location analysis.

The code focuses on the following seven principles:

Notice.
Limited collection.
Choice.
Limitation on collection and use.
Onward transfer.
Limited retention.
Consumer education.

The FPF's news release highlights notable provisions of the code that ask the MLA companies to, among other things:

Take reasonable steps to require that companies using their technology conspicuously display in-store signage informing customers about the collection and use of MLA data.
Provide consumers with the ability to opt out of the tracking.
Create a standard symbol to convey the concept of MLA services to consumers for use on the central industry website, MLA company websites and education materials and communications.
Not collect or use data in an adverse manner for employment, health care or insurance purposes.
Set internal policies for data retention and deletion of unique device data.
De-identify the data and explain in their privacy policy how they do so.

The code requires a consumer's affirmative consent to tracking if either:

Personal information will be linked to a mobile device identifier.
A consumer will be contacted based on MLA information.

The code includes certain exceptions for:

Data collected for the purpose of managing or operating a WiFi network, or for analysis used to test the network's operation.
Data collected or used for security, fraud or legal compliance, or to protect the safety, property or other rights of a company, or its employees or customers.
Data used within an employer-employee relationship.
A MLA company, retailer or other entity that has obtained an affirmative consent that describes collection, use or sharing of MLA information.

New Code of Conduct for Retailers Tracking Customers via WiFi | Practical Law