News & Insights  |  Newsletters


Practice Areas

FTC Tracking Settlement Relies on an Implied Website Claim

May 2015
Privacy In Focus

The Federal Trade Commission (FTC or Commission), on April 23, announced a consent order settlement with Nomi Technologies, Inc. (Nomi) resolving, subject to public comment, the Commission's assertion that representations made in Nomi's website privacy policy were false and therefore Nomi had violated Section 5 of the Federal Trade Commission Act. Two of the five commissioners dissented, writing that the circumstances did not warrant an FTC enforcement proceeding.

The Commission's enforcement initiatives have long maintained that commercial privacy policies must not be false or deceptive. Here, however, the FTC partly relied on an "implied representation," a move that may merit note by firms that maintain website privacy policies.

The Nomi Privacy Policy

As understood by the FTC, Nomi provides technological services that allow retailers to track consumers' movements around their stores. This is accomplished by monitoring media access numbers of consumers' mobile devices. Those numbers were processed (hashed), and the detected location and movement information was assembled in analytic reports on "aggregate consumer traffic patterns" that were provided to client retailers. No data was provided on individual mobile devices or individual consumers.

Nomi perceived that nevertheless some mobile device users might be troubled by the tracking of their movements in this way. During the relevant period, Nomi's website privacy policy contained a "pledge" to "always allow consumers to opt out of Nomi's service on its website as well as at any retailer using Nomi's technology."

The flaw precipitating the FTC enforcement initiative was that, although Nomi enabled consumers to opt out on its website, Nomi "did not provide an opt-out mechanism at its clients' retail locations." Thus, the proposed administrative complaint alleges, the retail-locations representation as "false or misleading."

Future Implications

The good news for tracking firms is that the FTC did not challenge the tracking practice itself or claim that notice must always be given of its use.

However, firms of all types that have privacy policies may find problematic that the Commission majority (Chairwoman Ramirez, Commissioner Brill and Commissioner McSweeny) found the quoted website language to represent that "consumers would be given notice when a retail location was utilizing Nomi's" service. The Nomi website language does not make that representation in those words. Rather, the FTC found it to be implicit in the representation that Nomi always "will allow consumers to opt out…at any retailer using Nomi's technology."

The Commission's construction would seem to rule out a business model where retailers would say nothing about Nomi's service but would allow opt outs by consumers who asked if the service was in use and then sought to opt out. Those presumably would be some of the consumers who had learned about the service from Nomi's website or some other source. The Commission's analysis does not discuss that business model, much less explain why a policy allowing such "under the counter" opt outs would be false, deceptive or unfair.

If a firm offering such a service did not want to give consumer notice at retail establishments that the service was in use, then the Commission's interpretation would suggest that such a service provider should refrain from allowing opt outs at the retail establishments. The Commission materials do not discuss that implication.