FTC Tracking Settlement Relies on an Implied Website Claim
The Commission's enforcement initiatives have long maintained that commercial privacy policies must not be false or deceptive. Here, however, the FTC partly relied on an "implied representation," a move that may merit note by firms that maintain website privacy policies.
As understood by the FTC, Nomi provides technological services that allow retailers to track consumers' movements around their stores. This is accomplished by monitoring media access numbers of consumers' mobile devices. Those numbers were processed (hashed), and the detected location and movement information was assembled in analytic reports on "aggregate consumer traffic patterns" that were provided to client retailers. No data was provided on individual mobile devices or individual consumers.
The flaw precipitating the FTC enforcement initiative was that, although Nomi enabled consumers to opt out on its website, Nomi "did not provide an opt-out mechanism at its clients' retail locations." Thus, the proposed administrative complaint alleges, the retail-locations representation as "false or misleading."
The good news for tracking firms is that the FTC did not challenge the tracking practice itself or claim that notice must always be given of its use.
However, firms of all types that have privacy policies may find problematic that the Commission majority (Chairwoman Ramirez, Commissioner Brill and Commissioner McSweeny) found the quoted website language to represent that "consumers would be given notice when a retail location was utilizing Nomi's" service. The Nomi website language does not make that representation in those words. Rather, the FTC found it to be implicit in the representation that Nomi always "will allow consumers to opt out…at any retailer using Nomi's technology."
The Commission's construction would seem to rule out a business model where retailers would say nothing about Nomi's service but would allow opt outs by consumers who asked if the service was in use and then sought to opt out. Those presumably would be some of the consumers who had learned about the service from Nomi's website or some other source. The Commission's analysis does not discuss that business model, much less explain why a policy allowing such "under the counter" opt outs would be false, deceptive or unfair.
If a firm offering such a service did not want to give consumer notice at retail establishments that the service was in use, then the Commission's interpretation would suggest that such a service provider should refrain from allowing opt outs at the retail establishments. The Commission materials do not discuss that implication.