We're watching: malls track shopper's cell phone signals to gather marketing data

Online retailers have long gathered behavioral metrics about how customers shop, tracking their movements through e-shopping pages and using data to make targeted offers based on user profiles. Retailers in meat-space have had tried to replicate that with frequent shopper offers, store credit cards, and other ways to get

shoppers to voluntarily give up data on their behavior, but these efforts have lacked the sort of data capacity provided by anonymous store browsers—at least until now. This holiday season, shopping malls in the US have started collecting data about shoppers by tracking the closest thing to "cookies" human beings carry—their cell phones.

The technology, from Portsmouth, England based Path Intelligence, is called Footpath. It uses monitoring units distributed throughout a mall or retail environment to sense the movement of customers by triangulation, using the strength of their cell phone signals. That data is collected and run through analytics by Path, and provided back to retailers through a secure website.

On March 31, Path CEO Sharon Biggar presented the tech at the ICSC Fusion conference in Los Angeles. She discussed how data collected by Footpath could be used by retailers to boost revenue. Options include tracking response to mailers and other advertising by providing the equivalent of web metrics like unique visitors, "page impressions" (measuring how many people walked past a display or advertisement), and "click-through" (determining how many people who passed an advertisement then visited the store associated with it). "Now we can produce heat maps of the mall and show advertisers where the premium locations are for their adverts," she said, "and perhaps more importantly we can price the advertising differently at each location."

In the US, Footpath is being trailed in two malls by Forest City, a mall real estate company that owns malls and shopping centers nationwide. Promenade Temecula in Temecula, California, and Short Pump Town Center in Richmond, Virginia are the sites of choice; the trial starts today, and will run through New Years. In a written statement, Forest City's spokesperson Lindsey Cottone said that Forest City was being "totally transparent" about the trial, posting signage to "inform customers that the survey is taking place."

Forest City's senior vice president of marketing, Jane Lisey, emphasized that the company was not collecting personally identifiable information about shoppers from their phones, and that customers' phone numbers and other information were protected by their wireless carriers. "Before agreeing to test this technology it was essential to determine and guarantee that the personal information of our shoppers would be completely anonymous to all parties," she said.

While Footpath uses only the signal fingerprint of the phone, it does give a fairly accurate record of where the phone has travelled through a mall. According to the editor of trade site Storefront Backtalk, Evan Schuman, the data can be paired with other sources of data, including surveillance video and point-of-sale transaction information. If they went this route, retailers would get a very detailed profile of who's carrying each phone. 

"Some malls are even using facial recognition software," Schuman told Ars Technica in a phone interview, with the primary purpose of "loss prevention"—identifying shoplifters. But that data, he said, could be tied to location data to be turned into customer relationship management data. Mall operators could then theoretically sell data to retailers, alerting them when big-ticket shoppers were approaching so that they could be given personalized service.

There's just one problem with this type of detailed tracking: it's technically illegal, according to Mark Rasch, the director of cybersecurity at CSC. Thanks to court interpretations of provisions in the USA PATRIOT Act, he said in a recent blog, devices that measure cell phones' signal strength could be considered to be "pen registers"—monitoring devices that require a warrant. 

"Although this mall technology might not identify specific individuals, it raises a bunch of privacy red flags," he wrote. "First, the instant the consumer identifies himself or herself anywhere in the mall (say, by using a credit or debit card to buy something), it is a trivial task to cross reference the cell phone data with the payment data and realize that the person hanging around outside the Victoria’s Secret dressing room was your 70-year-old neighbor."

That's more information than many consumers are interested in divulging. So far, however, there's been no sign that the legality of the service will be tested in court. And retailers could conceivably use the same justification for the technology that they use for facial recognition software: "loss prevention." In many jurisdictions, real estate owners are given wide latitudes about what they monitor on their own premises.