The Federal Trade Commission (“FTC”) today announced that it has entered into a proposed consent order with Nomi Technologies (“Nomi”), marking the agency’s first action against a retail tracking company.  The announcement comes one year after the agency held a workshop on mobile device tracking in the retail environment.  Although the action may indicate increased interest in retail tracking, the FTC did not focus on the unique aspects of that technology but instead focused on a single statement in Nomi’s privacy policy that the FTC claimed was material and deceptive.  Notably, two of the FTC’s five commissioners disagreed and dissented from the action.

Nomi provides a technology that allows brick-and-mortar retailers to track how consumers in possession of mobile phones move through their stores, which can help retailers determine how to display merchandise, deploy sales staff, and design more efficient retail layouts, among other things.  According to the FTC’s complaint, Nomi places sensors in retail stores that collect the media access control (MAC) addresses of consumer mobile phones when those devices are  detected in and around the store.  Nomi then hashes the MAC addresses, which are unique to each device, prior to storing them, and provides retailers with aggregated information on how many consumers pass by the store instead of enter it, how long consumers stay in the store, the types of devices consumers use, and how many repeat customers enter a store, among other information.

The FTC’s complaint alleges that from at least November 2012 until October 22, 2013, Nomi’s website included a privacy policy that promised that the company would “[a]lways allow consumers to opt out of Nomi’s service on its website, as well as at any retailer using Nomi’s technology” (emphasis added).  However, the FTC claims, that promise was “not true because no in-store opt-out  mechanism was available, and consumers were not informed when the tracking was taking place.”  The complaint observes that Nomi does not require retailers to post disclosures or otherwise notify consumers that they use Nomi’s service, and that through October 2013 “most, if not all, of Nomi’s clients did not post any disclosure, or otherwise notify consumers, regarding their use” of the service.

The Commission split 3-2 on whether to issue the complaint against Nomi and accept the proposed consent order.  Commissioners Maureen Ohlhausen and Joshua Wright issued separate statements dissenting from the action.  Commissioner Ohlhausen noted that “as a third party contractor collecting no personally identifiable information, Nomi had no obligation to offer consumers an opt out.”  The FTC’s action therefore ultimately could harm consumer privacy because it could encourage other retail tracking companies to not offer an opt out at all for fear of not presenting it correctly and risking a deception claim.  Commissioner Wright separately argued the agency should have declined to issue a complaint in the first place, noting that while Nomi’s reference to an in-store opt out option may have been incorrect, the absence of this option was not material, as consumers who saw this disclosure could have — and likely did, if it mattered to them — opt out on Nomi’s website.

Notably, the consent order does not require Nomi to provide in-store notice when a retailer uses its services, nor to provide an in-store (or online) opt-out.  The FTC did not address the extent to which the store itself would have such obligations when it uses tracking technology.  A statement by Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny said such notice was “not the Commission’s goal in bringing this case.”  Instead, the case is “simply about ensuring that when companies promise consumers the ability to make choices, they follow through on those promises.”

Under the proposed 20-year consent order, Nomi will be prohibited from misrepresenting to consumers their options for controlling whether information is collected, used, disclosed or shared about them or their computers or other devices, as well as the extent to which consumers will be notified about information practices.

The consent order will be published in the Federal Register shortly and will be subject to public comment through May 25, 2015.  After that time, the agency will determine whether to make the proposed order final.