Consumer Federation of California

We’re used to being watched when we shop. Cookies track our every move online, and salespeople follow us around high-end stores. But many walk-in retailers are taking spying to a new level.

Video cameras record your every move. Your face and car’s license plate are captured and filed in searchable databases. Hidden cameras classify you by age, sex, and ethnicity, and even detect your body language and mood. Even your bank account records are being pried into. The main goal of these surveillance methods, of course, is to get you to shop more and spend more.

If all of this is news to you, it’s probably because disclosure is poor to nonexistent, say experts familiar with these practices. Also, odds are you’ve never read or decoded what you’ve agreed to in bank, retailer, and app privacy policies. And you probably never imagined that retailers would be so interested in spying on honest shoppers. ‘While most consumers understand a need for security cameras, few expect that the in-store video advertising monitor they’re watching ‘ is watching them’ with a pinhole camera, says Pam Dixon, executive director of World Privacy Forum, a nonprofit research group in San Diego.

All of this tracking is a mixed bag for shoppers. When a store closely monitors operations to improve its service, that’s a win-win. But when retailers intrude on your privacy with little or no explanation of what they’re doing or how they use your info, that’s just plain sneaky. Here’s what’s going on in many stores around the U.S. and what you need to know.

Super spy cams

High-resolution video cameras monitor all areas in and outside the store. The footage is then stored and catalogued for easy searching. With facial-recognition software, your mug shot can be captured and digitally filed without your knowledge or permission. Ditto for your car’s license plate.

What’s creepy about them: Gaze trackers are hidden in tiny holes in the shelving and detect which brands you’re looking at and how long for each. There are even mannequins whose eyes are cameras that detect the age, sex, ethnicity, and facial expressions of passers-by.

The video can be merged with a store’s other data, such as footage of you at the cash register plus the transaction details of what you bought, for how much, using what credit card. Your face and vehicle license plate can be linked. If that info is not securely stored, it could be hacked. Stores don’t provide sufficient disclosure, so you can’t opt out to protect your privacy. Last October, the Federal Trade Commission recommended clear disclosure to consumers, security standards for stored video, and customer opt-out or consent in certain circumstances.

What’s in it for you: Stores use video customer counts to set staffing and reduce cashier-line backups. The system can also nab shoplifters and identity thieves and examine the veracity of slip-and-fall injury claims, keeping fraud costs (and prices) down.

Who’s using them: ‘Most of the big chains are trying video analytics,’ says Robert Hetu, research director for retailing at Gartner, an investment research firm. But retailers want their own privacy. Macy’s, for example, employs video analytics, according to printed promotional materials from Cisco, a maker of such systems, but a Macy’s spokeswoman didn’t return our repeated calls for comment. A Target spokesperson refused to comment about the store’s use of video analytics and other tools, even though its privacy policy states that the retailer collects information ‘recorded by in-store cameras.’

Smart-phone tracking

Your mobile phone is an excellent device for tracking your shopping route. So retailers and malls are beginning to monitor all visitors’ cell signals, which help create ‘heat maps’ that glow red where the most foot traffic is’perfect for showing where to best place displays, in-store ads, and high-margin merchandise. The retailer tracking systems can identify individual shoppers by monitoring your phone’s International Mobile Subscriber Identity number (constantly transmitted from all cell phones to their service providers) or Media Access Control address (transmitted when the device’s Wi-Fi is enabled, which is the default setting on most devices). That phone ID lets stores know when you shop’not just today but also every day your ID signal comes back in range.

What’s creepy about it: Cisco, the technology giant, is testing a system at an undisclosed store. It automatically detects your mobile device and connects you to the retailer’s free Wi-Fi network. ‘Once the customer gets on the network, he has opted in, and the privacy concerns are allayed,’ says Sujai Hejela, general manager of Cisco’s wireless networking group.

That allows the retailer to keep you on the store’s network, which can also detect when you search other online sellers for lower prices. ‘The retailer is not controlling but is managing the flow of information, and the shopper sees the retail brand as helping her shop,’ says Jon Stine, director of Internet business solutions at Cisco. That’s not necessarily bad for shoppers. For example, if you check prices online while you’re in the store, you might get messages that the store will match the lower prices you find.

What’s in it for you: Stores can use the information to improve service. Also, you can get coupons and discounts. ‘Our research shows consumers don’t trust retailers with their personal information, but if an attractive offer is made, they will give it,’ Hetu says.

Who’s using it: Lots of retailers and malls have Wi-Fi networks.

Personalized advertising

When you look at onscreen video ads, they might be looking right back at you. Tiny pinhole cameras can be built into the monitor. Facial-detection technology determines your age group, sex, ethnicity, and maybe even your mood, so it can serve up a message targeted to you. And radio-frequency identification (RFID) tags placed on the merchandise detect when you pick up an item. They can trigger a nearby digital sign to feed you targeted ads or details about the product. Kiosks and interactive touch screens often do the same thing.

What’s creepy about it: Not only are stores doing little or nothing to disclose that signs are watching you, but some privacy advocates also fear that the technology also could be used for discriminatory pricing based on age, sex, or ethnicity.

What’s in it for you: Ads can be more targeted to your needs.

Who’s using it: Vendors, analysts, and critics say big retail chains commonly use digital signage, but the stores we checked either denied it or didn’t respond to our inquiry.

Return rewards

Stores have been monitoring and tracking returns and exchanges for years to identify and prevent the 1 percent that are fraudulent. Now some stores are rewarding the honest 99 percent of customers who return items with special offers’say, a 20 percent discount or $10 off a specific item’to encourage them to spend their refund in the store.

What’s creepy about it: The reward is designed to appeal to you, based on statistical models that predict consumer behavior. It’s usually valid for only 1 to 2 hours, so you’re pressured to use it or lose it. The offers work to serve the retailer’s needs’as a result, the deals might be on stuff that’s about to be marked down for clearance anyway, or for a brand that you don’t usually prefer.

What’s in it for you: Money-saving opportunities, if you can resist buying stuff you don’t need.

Who’s using them: The Retail Equation, which markets the system to stores, did not return our repeated phone calls.

Your privacy rights

Privacy rights spring from a mishmash of implicit and explicit language in the U.S. Constitution, some state constitutions, state and federal laws, court rulings, and contracts between businesses and consumers. Those rights are constantly evolving as technology finds new ways to pry into your affairs and consumer advocates push back with new protections. Last year, the Obama administration neatly framed the matter into a Consumer Privacy Bill of Rights proposal. The main provisions would give consumers:

• The right to control how a company collects, uses, and discloses your data to others and the option of giving, withdrawing, or limiting your consent.
• Up-front explanation of what data is being collected, why, what users will do with it, how long they’ll store it, and whom they’ll share it with.
• A requirement that users protect consumer data from hackers, thieves, and other unauthorized parties.
• The ability to see and correct the information being collected and stored.

It’s just a proposal at this point. We think it’s a very good start. But you should also protect your own privacy. Always read privacy policies on retailers’ websites. Also read the permissions you’re asked to give to an app before you download it to your phone. Be sure to recheck those policies periodically.