Mining WiFi Data: Retail Privacy Pitfalls

Retailers are changing their tune when it comes to installing and exploiting WiFi infrastructure for customer insight. But are some retailers going too far?

This is the question Ryan Adzima, senior wireless engineer at systems reseller General Datatech, will pose at Interop New York next month in an October 2nd presentation entitled, "The Social Wi-Fi Goldmine: Should You Be Digging?" Not so long ago, retailers were reticent to invest in WiFi infrastructure, but Adzima says they now see the advantages of promoting online access and making shopping apps available to customers.

"Two years ago, nobody wanted to put Wi-Fi in their stores to give consumers a way to window shop," Adzima says. "Now they have a massive incentive because they'll see you going to Amazon or other competitors, they'll see your buying history, and they can target you more specifically and draw you away from competitors."

[Are there any standards in this domain? Read NIST Drafts Mobile App Security Guidelines.]

The baseline opportunity in exploiting WiFi is anonymous information gathering. With presence-analytics applications, for example, retailers have no idea who you are, but they can track the unique mobile access control (MAC) addresses of smartphones as they pass through a store. From this they can gather statistics on footpaths and dwell times at various locations throughout the store and gain insight into which departments, displays and specific products are drawing traffic.

Purple WiFi touts heat mapping, geofencing, and automated promotions among the capabilities of its Wi-Fi analytics suite.

This intelligence, provided by vendors like Euclid Analytics and Purple WiFi, helps you understand the traits of customers coming directly into your store from parking-lot entrances versus mall entrances, which might hint at primary versus secondary stops. It also help with department and product evaluation and planning, so you can come up with strategies to place traffic-driving products near profit-driving products or departments that aren't getting enough attention.

Privacy hawks would point out that these surveillance systems can track smartphones whether users log onto the store's public WiFi service or not (so long as the phones have WiFi on). What's more, MAC addresses are unique to each device and therefore are traceable to unique owners.

But tracking to individuals just doesn't happen, according to Adzima, and even if retailers practice this kind of surveillance without logins, "There's nothing wrong with this approach," he says. "It has nothing to do with individuals; it's about understanding shoppers as a group."

The next step up in mobile-data mining is welcoming customers to login into your WiFi network and, simultaneously, your customer loyalty account. That could happen using Facebook or another network account ID and password, but we'll get to this social-profile angle in a moment. For now, let's just assume

1 of 2