Nomi Technologies, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF NOMI TECHNOLOGIES, INC.

CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATION OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4538; File No. 132 3251 Complaint, August 28, 2015 – Decision, August 28, 2015 This consent order addresses Nomi Technologies, Inc.’s collection of information from consumer’s mobile devices to provide its “Listen” service without the consumer’s consent. The Commission’s complaint alleges that Nomi’s privacy policy represented that: consumers could opt out of Nomi’s Listen service at retail locations using this service, and that consumers would be given notice when a retail location was utilizing Nomi’s Listen service. The complaint alleges that Nomi violated Section 5 of the Federal Trade Commission Act by misleading consumers because, contrary to its representations, Nomi did not provide an opt-out mechanism at its clients’ retail locations and neither Nomi nor its clients disclosed to consumers that Nomi’s Listen service was being used at a retail location. The consent order requires Nomi to retain documents relating to its compliance with the order, requires all documents be retained for a five-year period. Participants For the Commission: Jacqueline Connor and Amanda Koulousiaas.

For the Respondent: Edward Holman, Lydia Parnes, and Tracy Shapiro, Wilson Sonsini Goodrich & Rosati. COMPLAINT The Federal Trade Commission, having reason to believe that Nomi Technologies, Inc., a corporation, has violated the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Nomi Technologies, Inc. (“Nomi” or “respondent”) is a Delaware corporation with its principal office or place of business at 26 West 17th Street, 2nd Floor, New York, NY 10011.

VOLUME 160 Complaint 2. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. RESPONDENT’S BUSINESS PRACTICES 3. Nomi uses mobile device tracking technology to provide analytics services to brick and mortar retailers through its “Listen” service. Nomi has been collecting information from consumers’ mobile devices to provide the Listen service since January 2013. Nomi places sensors in its clients’ retail locations that detect the media access control (“MAC”) address broadcast by a mobile device when it searches for WiFi networks. A MAC address is a 12-digit identifier that is unique to a particular device. Alternatively, in some instances Nomi collects MAC addresses through its clients’ existing WiFi access points. 4. In addition to the MAC address, Nomi also collects the following information about each mobile device that comes within range of its sensors or its clients’ WiFi access points: a. the mobile device’s signal strength; b. the mobile device’s manufacturer (derived from the MAC address);

c. the location of the sensor or WiFi access point observing the mobile device; and d. the date and time the mobile device is observed. 5. Nomi cryptographically hashes the MAC addresses it observes prior to storing them on its servers. Hashing obfuscates the MAC address, but the result is still a persistent unique identifier for that mobile device. Each time a MAC address is run through the same hash function, the resulting identifier will be the same. For example, if MAC address 1A:2B:3C:4D:5E:6F is run through Nomi’s hash function on ten different occasions, the resulting identifier will be the same each time. As a result, while Nomi does not store the MAC address, it does store a persistent unique identifier for each mobile device. Nomi collected NOMI TECHNOLOGIES, INC. 415 Complaint information about approximately nine million unique mobile devices between January 2013 and September 2013. 6. Nomi uses the information it collects to provide analytics reports to its clients about aggregate customer traffic patterns such as:

a. the percentage of consumers merely passing by the store versus entering the store;

b. the average duration of consumers’ visits; c. types of mobile devices used by consumers visiting a location;

d. the percentage of repeat customers within a given time period; and e. the number of customers that have also visited another location within the client’s chain.

7. Through October 22, 2013, Nomi’s Listen service had approximately 45 clients. Some of these clients deployed the service in multiple locations within their chains. 8. Nomi has not published, or otherwise made available to consumers, a list of the retailers that use or used the Listen service.

9. Nomi does not require its clients to post disclosures or otherwise notify consumers that they use the Listen service. Through October 22, 2013, most, if not all, of Nomi’s clients did not post any disclosure, or otherwise notify consumers, regarding their use of the Listen service.

10. Nomi provided, and continues to provide, an opt out on its website for consumers who do not want Nomi to store observations of their mobile device. Once a consumer has entered the MAC address of their device into Nomi’s website opt out, Nomi adds it to a blacklist of MAC addresses for which information will not be stored. Nomi did not make an opt out available through any other means, including at any of its clients’ retail locations.

VOLUME 160 Complaint 11. From at least November 2012, until October 22, 2013, Nomi disseminated or caused to be disseminated privacy policies on its website, nomi.com or getnomi.com, which included the following statement:

Nomi pledges to…. Always allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology. (See Exhibits A-C).

12. In order to opt out of the Listen service on Nomi’s website, consumers were required to provide Nomi with all of their mobile devices’ MAC addresses, without knowing whether they would ever shop at a retail location using the Listen service. Consumers who did not opt out on Nomi’s website and instead wanted to make the opt out decision at retail locations were unable to do so, despite the explicit promise in Nomi’s privacy policies. Consumers were not provided any means to opt out at retail locations and were unaware that the service was even being used.

VIOLATIONS OF THE FTC ACT Count I 13. As described in Paragraph 12, Nomi represented, directly or indirectly, expressly or by implication, that consumers could opt out of Nomi’s Listen service at retail locations using this service.

14. In fact, Nomi did not provide an opt-out mechanism at its clients’ retail locations. Therefore, the representation set forth in Paragraph 14 is false or misleading.

Count II 15. As described in Paragraph 12, Nomi represented, directly or indirectly, expressly or by implication, that consumers would be given notice when a retail location was utilizing Nomi’s Listen service.

NOMI TECHNOLOGIES, INC. 417 Complaint 16. In fact, neither Nomi nor its clients disclosed to consumers that Nomi’s Listen service was being used at a retail location. Therefore, the representation set forth in Paragraph 16 is false or misleading.

17. The acts and practices of respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this twentyeighth day of August, 2015, has issued this complaint against respondent.

By the Commission, Commissioner Ohlhausen dissenting. VOLUME 160 Complaint Exhibit A

VOLUME 160 Complaint Exhibit C EXHIBIT C Nomi’s Privacy Policy from approximately August 201 3 to October 22, 2013. & Nomi (omit AROOWE) — GOMPANY HR PROLEE Mier? NomiMeasure Heaton Privacy is our First Priority We do wot and will sever collect any personally identifiable data without a consumer's explicit consent via opt-in. We bult Nomi to help retailers deliver hetier service and That first phil hy informs everything we do at Nomi, from our name to our product. We also offer an easy to access opt-out option for all of our customers.

Retail analytics have been around far many years. The concept started with market research ploncers like Paco Underhill, who deployed rescarshers into atores to observe customer behavior through surveys and clipboards. He proved to the retall world that in-store Oehavioral analytics can the way we shop, However, as the world moved to the web, and e-commerce emerged as an important way to shop, web analytes became crucial to a retailer's strategy so that they could deliver the best shopping experience possible. Now, as the mobde revolution gains traction, Nomi is delivering the next generation of analytics so that retailers can measure customer behavior in their stores just like they can online. With these differen} generations of analytics, there is one thing that remains canstan| and that is the privacy of consumers. Whether it was market research or web analytics, the data collected lias always been anonyrnous and aggregated into demographic buckets. Norm's technology has been built from the grounc up with this legacy in mind, With privacy as ourtop priority, Nomi pledges to: 1. Keep each client's data secure and private. 2. Never tie any personally identifiable consumer data to a specific device or behavior. 3. Always allow consumers to opt out of Nomi's service on its website as well as at any retailer using Nomi's lechnalogy.

Ultimately, this is all about the © . With Nomi's software, retailers are able to get continuous feedback on the in-store experience and apti ittor a ‘CHU have to opt out of the service.

ABOLT LS COWNEST Real Teant @ Twines fetvaser Polrey wos f Feo Ong Baw LEAN Moi bw Nerd 1004 All Ruy he Gewel NOMI TECHNOLOGIES, INC. 421 Decision and Order DECISION AND ORDER The Federal Trade Commission (“Commission” or “FTC”), having initiated an investigation of certain acts and practices of the respondent named in the caption hereof, and the respondent having been furnished thereafter with a copy of a draft complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge respondent with violations of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45 et seq.;

The respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), which includes: a statement by respondent that it neither admits nor denies any of the allegations in the draft complaint, except as specifically stated in the Consent Agreement, and, only for purposes of this action, admits the facts necessary to establish jurisdiction; and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the respondent violated the FTC Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, and having duly considered the comments received from interested persons pursuant to Commission Rule 2.34, 16 C.F.R. § 2.34, now in further conformity with the procedure prescribed by Commission Rule 2.34, the Commission hereby issues its complaint, makes the following jurisdictional findings, and enters the following Order: 1. Respondent Nomi Technologies, Inc. is a Delaware corporation with its principal office or place of business at 26 West 17th Street, 2nd Floor, New York, NY 10011.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the respondent, and the proceeding is in the public interest. VOLUME 160 Decision and Order ORDER DEFINITIONS For purposes of this order, the following definitions shall apply:

A. Unless otherwise specified, “respondent” shall mean Nomi Technologies, Inc., and its successors and assigns.

B. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15. U.S.C. § 44. I.

IT IS ORDERED that respondent and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, website, other device, or an affiliate owned or controlled by respondent, in connection with the advertising, promotion, offering for sale, sale, or dissemination of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication: (A) the options through which, or the extent to which, consumers can exercise control over the collection, use, disclosure, or sharing of information collected from or about them or their computers or devices, or (B) the extent to which consumers will be provided notice about how data from or about a particular consumer, computer, or device is collected, used, disclosed, or shared.

II.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying:

A. for a period of five (5) years from the date of preparation, any documents, whether prepared by or on behalf of respondent that contradict, qualify, or call into question respondent’s compliance with this order; NOMI TECHNOLOGIES, INC. 423 Decision and Order B. for a period of five (5) years from the date of preparation or dissemination, whichever is later, all publicly disseminated statements containing any representation covered by this order, as well as all materials used or relied upon in making or disseminating the representation; and C. for a period of five (5) years from the date received, all consumer complaints directed at respondent, or forwarded to respondent by a third party, that relate to the conduct prohibited by this order and any responses to such complaints.

III.

IT IS FURTHER ORDERED that, for ten (10) years after the date of service of this order, respondent shall deliver a copy of this order to all current and future subsidiaries, current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities with respect to the subject matter of this order, and shall secure from each such person a signed and dated statement acknowledging receipt of the order. Respondent shall deliver this order to current personnel and subsidiaries within thirty (30) days after the date of service of this order, and to future personnel and subsidiaries within thirty (30) days after the person or subsidiary assumes such position or responsibilities. IV.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations arising under this order, including but not limited to: a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation(s) about which respondent learns fewer than thirty (30) days prior to the date such action is to take place, respondent VOLUME 160 Decision and Order shall notify the Commission as soon as is practicable after obtaining such knowledge. Unless otherwise directed by a representative of the Commission in writing, all notices required by this Part shall be emailed to [email protected] or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: In the Matter of Nomi Technologies, Inc., File No.132-3251/C-4538. V.

IT IS FURTHER ORDERED that respondent within ninety (90) days after the date of service of this order, shall file with the Commission a true and accurate report, in writing, setting forth in detail the manner and form of their own compliance with this order. Within ten (10) days of receipt of written notice from a representative of the Commission, it shall submit an additional true and accurate written report.

VI.

This order will terminate on August 28, 2035, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part of this order that terminated in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as NOMI TECHNOLOGIES, INC. 425 Concurring Statement though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission, Commissioner Ohlhausen dissenting. Statement of Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny We write to express our support for the complaint and proposed consent order in this case.

Nomi Technologies, Inc. is a provider of technology services that allow retailers to track consumers’ movements around their stores by detecting the media access control (“MAC”) addresses broadcast by the WiFi interface on consumers’ mobile devices.1 Services like Nomi’s benefit businesses and consumers. For example, they enable retailers to improve store layouts and reduce customer wait times.

At the same time, Nomi’s service, and others like it, raise privacy concerns because they rely on the collection and use of consumers’ precise location data. Indeed, Nomi sought to assure consumers that its practices were privacy-protecting, declaring in its privacy policy that “privacy is our first priority.” A core element of Nomi’s assurance was its promise that consumers could opt out of Nomi’s service through its website “as well as at 1 Although Nomi took steps to obscure the MAC addresses it collected by cryptographically hashing them, hashing generates a unique number that can be used to identify a device throughout its lifetime and is a process that can easily be “reversed” to reveal the original MAC address. See, e.g., Jonathan Mayer, Questionable Crypto in Retail Analytics, March 19, 2014, http://webpolicy.org/2014/03/19/questionable-crypto-in-retail-analytics/ (describing successful efforts in “reversing the hash” to identify the original MAC address).

VOLUME 160 Concurring Statement any retailer using Nomi’s technology.” Thus, Nomi made a specific and express promise to consumers about how, when, and where they could opt out of the location tracking services that the company provided to its clients.

As the Commission alleges in its complaint, however, this express promise was false. At no time during the nearly year-long period that Nomi made this promise to consumers did Nomi provide an in-store opt out at the retailers using its service. Moreover, the express promise of an in-store opt out necessarily makes a second, implied promise: that retailers using Nomi’s service would notify consumers that the service was in use. This promise was also false. Nomi did not require its clients to provide such a notice. To our knowledge, no retailer provided such a notice on its own.

The proposed order includes carefully-tailored relief designed to prevent similar violations in the future. Specifically, it prohibits Nomi from making future misrepresentations about the notice and choices that will be provided to consumers about the collection and use of their information.

Nevertheless, Commissioner Wright argues in his dissent that Nomi’s express promise to provide an in-store opt-out was not material because a website opt-out was available, and that, in any event, the Commission should not have brought this action because it will deter industry from adopting business practices that benefit consumers. In a separate statement, Commissioner Ohlhausen dissents on grounds of prosecutorial discretion. This statement addresses both dissents’ arguments. I. Nomi’s Express Opt-Out Promise Was False and Material, and Therefore Deceptive According to the Commission’s Deception Policy Statement, a deceptive representation, omission, or practice is one that is material and likely to mislead a consumer acting reasonably under the circumstances. “The basic question [with respect to materiality] is whether the act or practice is likely to affect the consumer’s conduct or decision with respect to the product or NOMI TECHNOLOGIES, INC. 427 Concurring Statement service.”2 Furthermore, the Commission presumes that an express claim is material,3 as is “information pertaining to the central characteristics of the product or service.”4 Importantly, Section 5 case law makes clear that “[m]ateriality is not a test of the effectiveness of the communication in reaching large numbers of consumers. It is a test of the likely effect of the claim on the conduct of a consumer who has been reached and deceived.”5 Consumers who read the Nomi privacy statement would likely have been privacy-sensitive, and claims about how and when they could opt out would likely have especially mattered to them. Some of those consumers could reasonably have decided not to share their MAC address with an unfamiliar company in order to opt out of tracking, as the website-based optout required.

Instead, those consumers may reasonably have decided to wait to see if stores they patronized actually used Nomi’s services and opt out then. Or they may have decided that they would simply not patronize stores that use Nomi’s services, so that they could effectively “vote with their feet” rather than exercising the opt-out choice. Or consumers may simply have found it inconvenient to opt out at the moment they were viewing Nomi’s privacy policy, and decided to opt out later.

These choices were rendered illusory because of Nomi’s alleged failure to ensure that its client retailers provide any signs or opt-outs at stores. Further, consumers visiting stores that used Nomi’s services would have reasonably concluded, in the absence of signage and the promised opt-outs, that these stores did not use Nomi’s services. Nomi’s express representations regarding how consumers may opt out of its location tracking services go to the very heart of consumers’ ability to make decisions about whether 2 Deception Policy Statement § I.

3 Deception Policy Statement § IV.

4 Id.

5 In the Matter of Novartis, 1999 FTC LEXIS 63 *38 (May 27, 1999). VOLUME 160 Concurring Statement to participate in these services. Thus, we have ample reason to believe that Nomi’s opt-out representations were material. In his dissent, Commissioner Wright points to certain evidence that, in his view, rebuts the notion that a consumer who viewed Nomi’s privacy policy would “bypass the easier and immediate route (the online opt out) in favor of waiting” to opt out at a retail location.6 According to Commissioner Wright, because consumers who viewed Nomi’s privacy policy opted out at a higher rate (3.8%) than what is reported for a certain method of opting out of online behavioral advertising (less than 1%),7 this shows that consumers who wanted to opt out of tracking were able to do so – and therefore, the representation that consumers could opt out at an individual retailer was not material. We do not believe the 3.8% opt-out rate provides reliable evidence to rebut the presumption of materiality.

The benchmark against which Commissioner Wright measures the Nomi opt-out rate – the purported opt out rate for online behavioral advertising – is neither directly comparable to, nor provides meaningful information about, consumers’ likely motivations in deciding whether to opt-out of Nomi’s Listen service. The difference in opt-out rates could simply mean that the practice of location tracking is much more material to consumers than behavioral advertising, and for that reason a much higher number of consumers exercised the website opt out. Indeed, recent studies have shown that consumers are concerned about offline retail tracking and tracking that occurs over time,8 as took 6 Statement of Commissioner Wright at 4. 7 Id. at 3 & n.15.

8 See New Study: Consumers Overwhelmingly Reject In-store Tracking by Retailers, OpinionLab, March 27, 2014 http://www.opinionlab.com/press release/new-study-consumers-overwhelmingly-reject-in-store-tracking-byretailers/ (44% of survey respondents indicated that they would be less likely to shop at a store that uses in-store mobile device tracking); Spring Privacy Series: Mobile Device Tracking Seminar, available at http://www ftc.gov/system/files/documents/public events/182251/140219mobiledevicetranscript.pdf; Remarks of Ilana Westerman, Create with Context, at 47-48; 50 (stating that a study of 4600 Americans showed that consumers are reluctant to give up their location histories).

NOMI TECHNOLOGIES, INC. 429 Concurring Statement place here. These relative opt-out rates could just as easily imply that many more than 3.8% of consumers were interested in opting out of Nomi’s retail tracking, and that the consumers who did not opt out on the website were relying on their ability to opt out in stores, as promised by Nomi.

In short, the 3.8% opt-out rate for Nomi’s website opt-out, along with the comparison to opt-out rates in other contexts, is simply insufficient evidence to evaluate what choices the other 96.2% of visitors to the website intended to make, given the promises Nomi made to them about their options. Commissioner Wright is simply speculating when he extrapolates from the available data his conclusion that in-store opt-out rates would have been so low as to render the in-store option immaterial. Such inconclusive evidence fails to rebut any presumption of materiality that we might apply to Nomi’s statements. II. The Proposed Order Contains Appropriate and Meaningful Relief The Commission’s acceptance of the consent agreement is appropriate in light of both Nomi’s alleged deception and the relief in the proposed order. The proposed order addresses the underlying deception in an appropriately tailored way. It prohibits Nomi from misrepresenting the options that consumers have to exercise control over information that Nomi collects, uses, discloses, or shares about them or their devices.9 It also prohibits Nomi from misrepresenting the extent to which consumers will be notified about such choices.10 Nomi may be subject to civil penalties if it violates either of these prohibitions. While the consent order does not require that Nomi provide in-store notice when a store uses its services or offer an in-store opt out, that was not the Commission’s goal in bringing this case. This case is simply about ensuring that when companies promise consumers the ability to make choices, they follow through on those promises. The relief in the order is therefore directly tied to the 9 Order § I.

10 Id.

VOLUME 160 Concurring Statement deceptive practices alleged in the complaint.11 The order will also serve to deter other companies from making similar false promises and encourage them to periodically review the statements they make to consumers to ensure that they are accurate and up-to-date.

In their dissents, however, Commissioners Wright and Ohlhausen argue that the Commission should have declined to take action in this case. Commissioner Ohlhausen views this action as “encourag[ing] companies to do only the bare minimum on privacy, ultimately leaving consumers worse off.”12 Similarly, Commissioner Wright argues that the action against Nomi “sends a dangerous message to firms weighing the costs and benefits of voluntarily providing information and choice to consumers.”13 The Commission encourages companies to provide privacy choices to consumers, but it also must take action in appropriate cases to stop companies from providing false choices. Our action today does just that. Indeed, this case is very similar to prior Commission cases involving allegedly deceptive opt outs.14 We 11 After arguing primarily that Nomi did not violate Section 5, Commissioner Wright argues in the alternative that the proposed order is too narrow. See Statement of Commissioner Wright at 4 (stating that “the proposed consent order does nothing to alleviate such harm [from retail location tracking]” because it does not require Nomi to offer, and provide notice of, an in-store opt out). This argument is based on a misunderstanding of the injury at issue in this case. Here, the injury to consumers was Nomi’s allegedly false and material statement of the opt-out choices available to consumers. The proposed order prohibits Nomi from making such representations and thereby addresses the underlying consumer injury.

12 Statement of Commissioner Ohlhausen.

13 Statement of Commissioner Wright at 4. 14 See U.S. v. Google Inc., No. CV 12-04177, (N.D. Cal. Nov. 16, 2012) (stipulated injunction) ($22.5 million settlement over Google’s allegedly deceptive opt out, which did not work on the Safari browser); Chitika, Inc., No. C-4324, (F.T.C. June 7, 2011) (consent order) available at http://www.ftc.gov/enforcement/cases- proceedings/1023087/chitika-inc-matter (alleging that advertising network deceived consumers by not telling them that their opt out of behavioral advertising cookies would last only 10 days); U.S. Search, Inc., No. C-4317 (Mar. 14, 2011) (consent order) available at http://www ftc.gov/enforcement/cases-proceedings/us-search-inc (alleging that NOMI TECHNOLOGIES, INC. 431 Concurring Statement do not believe that any of these actions – including the one announced today – have deterred or will deter companies from providing truthful choices. To the contrary, companies are voluntarily adopting enforceable privacy commitments in the retail location tracking space15 and in other areas.16 * * * * * * The application of Section 5 deception authority to express statements likely to affect a consumer’s choice of or conduct regarding a good or service is well established. For close to a year, Nomi claimed to offer two opt-out methods but in fact it provided only one. We believe this failure was material and that Nomi had a legal obligation to fulfill the promises it made to consumers.

a data broker deceived consumers by failing to disclose limitations of its opt out).

15 The Future of Privacy Forum has developed an entire self-regulatory code that requires industry members to provide such choices. See also JAN LAUREN BOYLES ET AL., PEW INTERNET PROJECT, PRIVACY AND DATA MANAGEMENT ON MOBILE DEVICES 2 (2012), available at http://www.pewinternet.org/files/old-media/Files/Reports/2012/PIPMobile PrivacyManagement.pdf (reporting that 19% of consumers “turned off the location tracking feature on their cell phone because they were concerned that other individuals or companies could access that information) and Westerman, supra note 8, at 50-52 (describing sensitivity of location history, based on study of 4600 U.S. consumers).

16 See, e.g., Future of Privacy Forum, K-12 Student Privacy Pledge Announced (Oct. 7, 2014), available at http://www futureofprivacy.org/2014/10/07/k-12student-privacy-pledge-announced/.

VOLUME 160 Dissenting Statement Statement of Commissioner Julie Brill I vote to finalize the Nomi case, for the reasons articulated in the Majority Statement.1 In her dissent, Commissioner Ohlhausen expresses concern that our order will deter companies from offering privacy choices in the marketplace.2 I agree that, in approving our orders, we should always consider whether they provide the appropriate marketplace incentives. I believe this order provides companies with an incentive to periodically review the statements they make to consumers, and make sure their practices line up with those statements. In this case, we took issue with the fact that Nomi offered a deceptive choice to consumers for nearly a year. Our order today makes sure that this doesn’t happen again. In addition, the concern that our order will deter companies from offering choices is belied by the fact that, like many of its competitors in retail mobile location tracking, Nomi continues to offer an online choice to consumers to opt-out of retail mobile tracking. However, as a result of our order, the company no longer offers a deceptive choice.

1 Statement of Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny, In the Matter of Nomi, Inc. (“Majority Statement”) at 2-3(Apr. 23, 2015), available at https://www.ftc.gov/system/files/documents/public statements/638351/150423 nomicommissionstatement.pdf.

2 Dissenting Statement of Commissioner Ohlhausen, In the Matter of Nomi, Inc., at 2 (Aug. 28, 2015).

NOMI TECHNOLOGIES, INC. 433 Dissenting Statement DISSENTING STATEMENT OF COMMISSIONER MAUREEN K. OHLHAUSEN On April 23, 2015, a divided Commission issued a complaint and accepted a proposed consent order with regard to the practices of Nomi Technologies, Inc., a startup company offering its retail merchant clients the ability to analyze aggregate data about consumer traffic in the merchants’ stores.1 The Commission subsequently published a description of the consent agreement package in the Federal Register, seeking public comment.2 The comment window closed on May 25, 2015.3 The record now before the Commission confirms that the FTC should not have adopted this complaint and order because it undermines the Commission’s own goals of increased consumer choice and transparency of privacy practices and because the order imposes a penalty far out of proportion to the non-existent consumer harm.

The FTC has long called on companies to implement best practices “giving consumers greater control over the collection and use of their personal data through simplified choices and increased transparency.”4 Consistent with such best practices, Nomi went beyond its legal duty by offering increased transparency and consumer choice through an easy and effective global opt-out. Granted, part of Nomi’s privacy policy was 1 In the Matter of Nomi Technologies, Inc., FTC File No. 132-3251, Compl. ¶ 3 (Apr. 23, 2015). I dissented in this matter, as did Commissioner Wright. See Dissenting Statement of Commissioner Maureen K. Ohlhausen (April 23, 2015), available at https://www.ftc.gov/system/files/documents/public state ments/638361/150423nomiohlhausenstatement.pdf; Dissenting Statement of Commissioner Joshua D. Wright (April 23, 2015), available at https://www.ftc.gov/system/files/documents/public statements/638371/150423 nomiwrightstatement.pdf.

2 Nomi Technologies, Inc., Analysis of Proposed Consent Order to Aid Public Comment, 80 Fed. Reg. 24923 (May 1, 2015), available at https://www.ftc.gov/system/files/documents/cases/150501nomifrn.pdf. 3 Id at 24924.

4 Fed. Trade Commu, PROTECTING CONSUMER PRIVACY IN AN ERA OF RAPID CHANGE, at i, (Mar. 2012).

VOLUME 160 Dissenting Statement inaccurate because the company promised, but failed to implement, an additional privacy choice for consumers. However, by applying a de facto strict liability deception standard absent any evidence of consumer harm, the proposed complaint and order inappropriately punishes a company that acted consistently with the FTC’s privacy goals by offering more transparency and choice than legally required. The record demonstrates that this enforcement action may, ironically, undermine the FTC’s own established privacy goals. Commenters generally agree that the order will diminish companies’ incentives to be transparent about their privacy practices.5 Commenters also generally agree that the Order will discourage companies from offering privacy choices to consumers. As one commenter explained, “[T]he consent order could discourage companies from offering choices to consumers about data collection and use practices…” because “[c]companies may be justifiably concerned that communicating those options clearly and accurately to consumers is difficult, and that even harmless communications errors will result in harsh penalties.”6 Another commenter concluded, “This enforcement action sends a message to any business considering privacy-by-design: if you 5 Comments of Application Developers Alliance, at 2 (May 26, 2015) (“[C]companies may change their privacy policies to make broad statements to eliminate or at least mitigate the risk of violating its own promises… result[ing] in less transparency for consumers.”) (“ADA Comments”); Comments of Computer & Communications Industry Association at 2 (May 26, 2015) (“[T]he FTC’s action against Nomi will ultimately result in adverse outcomes for consumer protection by leading to reduced transparency and fewer privacyprotective choices for consumers.”); Comments of Information Technology & Innovation Foundation, at 3 (May 26, 2015) (“[C]companies like Nomi would be better off providing no privacy guarantees to their consumers…”) (“ITIF Comments”); Comments of the International Center for Law & Economics and TechFreedom, att. at 2 (May 26, 2015) (“Out of a desire to encourage – effectively require – companies to disclose data collection, the FTC is actually discouraging companies from doing so.”). See also, Comments of Chamber of Commerce, at 1 (May 22, 2015) (arguing that such aggressive Section 5 enforcement could “dissuade [smaller entities] from voluntary adoption of consumer privacy protections.”). All public comments on this matter are available at https://www ftc.gov/policy/public-comments/initiative-608. 6 ADA Comments at 2.

NOMI TECHNOLOGIES, INC. 435 Dissenting Statement attempt to protect consumers’ privacy in multiple ways, you multiply your legal risk of FTC prosecution.”7 I share one commenter’s particular concern that “the takeaway for most companies will be: if you do not want the FTC to come after you, do the bare-minimum on privacy.”8 In response to the case’s release, one legal analyst advised readers that “giving individuals more information is not better” and that where notice is not legally required, companies should “be sure the benefits of notice outweigh potential risks.”9 Another pointed out that “[t]he ironic upshot of the majority decision is that Nomi could have avoided the FTC enforcement action altogether by not posting a privacy policy, not describing its practices to consumers, and not offering an opt-out mechanism at all.”10 Indeed, upon learning of the Commission’s investigation, Nomi simply eliminated a potential privacy choice from its privacy policy. This record contradicts the majority’s belief that its decision in this case will not “deter companies from providing truthful choices.”11 The majority justifies this belief by arguing that some companies continue to voluntarily adopt privacy commitments despite past deceptive opt out cases. However, the responses of commenters and the reaction of analysts show that this order will 7 Comments of NetChoice, at 3 (May 26, 2015) (“NetChoice Comments”). 8 ITIF Comments at 3.

9 Elizabeth Litten, When Privacy Policies Should NOT Be Published – Two Easy Lessons from the FTC’s Nomi Technologies Case, HIPPA, HITECH & HIT (May 26, 2015), http://hipaahealthlaw.foxrothschild.com/2015/05/articles/privacy/whenprivacy-policies-should-not-be-published-two-easy-lessons-from-the-ftcsnomi-technologies-case/.

10 James DeGraw, David Cohen and Joe Cleemann, Nomi Highlights Risks of Publicizing Privacy Policies, LAW360 (May 27, 2015), http://www.law360.com/articles/659398/nomi-highlights-risks-of-publicizingprivacy-policies.

11 In the Matter of Nomi Technologies, Inc., FTC File No. 132-3251, Statement of Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny (April 23, 2015), available at https://www.ftc.gov/system/files/documents/public statements/638351/150423 nomicommissionstatement.pdf.

VOLUME 160 Dissenting Statement certainly deter some companies from providing truthful consumer privacy choices. Thus, the record clearly demonstrates that overly aggressive deception enforcement comes at a cost to the FTC’s privacy goals and to consumers.

Furthermore, the record supports rejecting the order as too severe given the nature of Nomi’s violation. Commenters argue that the proposed order “is disproportionate and heavy-handed” and “the equivalent of calling in the SWAT team to take down a driver for a broken tail light.”12 Several argue that because there was no evidence of consumer harm in this case, the more appropriate response would have been for FTC staff to notify the company of the problem and verify that it was corrected.13 Alternatively, one commenter suggested “an order with a shorter enforcement period or a less onerous compliance requirement could have been tailored for a startup company that made a harmless error.”14 For the reasons discussed above, I conclude that the comments on the record and the marketplace reaction to the complaint and order provide additional persuasive evidence that the costs of this enforcement action outweigh the benefits. The Commission therefore ought to vacate the proposed complaint and consent order. Because the majority declines to do so, I dissent. 12 ADA Comments at 1; ITIF Comments at 3. See also, Comments of James C. Cooper at 5 (May 26, 2015) (“[I]t is simply not in the public interest to subject an innovative firm to an invasive twenty-year order for an oversight that harmed no one” because this will “hobble Nomi’s ability to compete [and] threatens to chill innovation more generally…”). 13 ITIF Comments at 3; NetChoice Comments at 3-4; ADA Comments at 2. 14 ADA Comments at 2.

NOMI TECHNOLOGIES, INC. 437 Dissenting Statement Dissenting Statement of Commissioner Joshua D. Wright Today, the Commission finds itself in the unfortunate position of trying to fix a problem that no longer exists by stretching a legal theory to fit the unwieldy facts before it. I dissent from the Commission’s decision to accept for public comment a consent order with Nomi Technologies, Inc. (Nomi) not only because it is inconsistent with a fair reading of the Commission’s Policy Statement on Deception, but also because even if the facts were to support a technical legal violation – which they do not – prosecutorial discretion would favor restraint. Nomi does not track individual consumers – that is, Nomi’s technology records whether individuals are unique or repeat visitors, but it does not identify them. Nomi provides analytics services based upon data collected from mobile device tracking technology to brick-and-mortar retailers through its “Listen” service.1 Nomi uses sensors placed in its clients’ retail locations or its clients’ existing WiFi access points to detect the media access control (MAC) address broadcast by a consumer’s mobile device when it searches for WiFi networks. Nomi passes MAC addresses through a cryptographic hash function before collection and creates a persistent unique identifier for the mobile device.2 Nomi does not “unhash” this identifier to retrieve the MAC addresses and Nomi does not store the MAC addresses of the mobile devices. In addition to creating this unique persistent identifier, Nomi collects the device manufacturer information, the device’s signal strength, and the date, time and locating sensor of the mobile device. This information is then used to provide analytics to Nomi’s clients. For example, even without knowing the identity of those visiting their stores, the data provided by Nomi’s Listen service can generate potentially valuable insights about aggregate in-store consumer traffic patterns, such as the average duration of customers’ visits, the percentage of repeat 1 In the Matter of Nomi Technologies, Inc., FTC File No. 132-3251, Compl. ¶ 3 (Apr. 23, 2015).

2 For more information on cryptographic hashing, see Rob Sobers, The Definitive Guide to Cryptographic Hash Functions (Part I), VARONIS (Aug. 2, 2012), http://blog.varonis.com/the-definitive-guide-to-cryptographic-hashfunctions-part-1/.

VOLUME 160 Dissenting Statement customers, or the percentage of consumers that pass by a store rather than entering it. These insights, in turn, allow retailers to measure how different retail promotions, product offerings, displays, and services impact consumers. In short, these insights help retailers optimize consumers’ shopping experiences,3 inform staffing coverage for their stores, and improve store layouts. The Commission’s complaint focuses upon a single statement in Nomi’s privacy policy. Specifically, Nomi’s privacy policy states that “Nomi pledges to . . . Always allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.”4 Count I of the complaint alleges Nomi represented in its privacy policy that consumers could opt out of its Listen service at retail locations using the service, but did not in fact provide a retail level opt out. Count II relies upon this same representation to allege a second deceptive practice – that the failure to provide the opt out in the first instance also implies a failure to provide notice to consumers that a specific retailer would be using the Listen service.5 The Commission’s decision to issue a complaint and accept a consent order for public comment in this matter is problematic for both legal and policy reasons. Section 5(b) of the FTC Act requires us, before issuing any complaint, to establish “reason to believe that [a violation has occurred]” and that an enforcement action would “be to the interest of the public.”6 While the Act 3 See, e.g., Alyson Shontell, It Took Only 13 Days for Former Salesforce Execs to Raise $3 Million for Their Startup, Nomi, BUSINESS INSIDER (Feb. 11, 2013), http://www.businessinsider.com/former-salesforce-and-buddy-mediaexecutives-raise-3-million-nomi-2013-2 (“The moment you open Amazon.com, your entire retail experience is personalized, down to the promotions you see and the products you are pushed. That’s because e-commerce is a data-driven industry, and websites know a lot about customers who stumble on to their websites. Physical stores however, where 90% of all retail purchases still occur, know nothing about the customers who walk in their doors.”). 4 Compl. ¶ 12.

5 Compl. ¶ 16-17.

6 15 U.S.C. §45(b).

NOMI TECHNOLOGIES, INC. 439 Dissenting Statement does not set forth a separate standard for accepting a consent decree, I believe that threshold should be at least as high as for bringing the initial complaint. The Commission has not met the relatively low “reason to believe” bar because its complaint does not meet the basic requirements of the Commission’s 1983 Deception Policy Statement. Further, the complaint and proposed settlement risk significant harm to consumers by deterring industry participants from adopting business practices that benefit consumers.

The fundamental failure of the Commission’s complaint is that the evidence simply does not support the allegation that Nomi’s representation about an opportunity to opt out of the Listen service at the retail level – in light of the immediate and easily accessible opt out available on the webpage itself – was material to consumers. This failure alone is fatal. A representation simply cannot be deceptive under the long-standing FTC Policy Statement on Deception in the absence of materiality.7 The Policy Statement on Deception highlights the centrality of the materiality inquiry, observing that the “basic question is whether the act or practice is likely to affect the consumer's conduct or decision with regard to a product or service.”8 The materiality inquiry is critical because the Commission's construct of “deception” uses materiality as an evidentiary proxy for consumer injury: “[i]njury exists if consumers would have chosen differently but for the deception. If different choices are likely, the claim is material, and injury is likely as well.”9 This is a critical point. Deception causes consumer harm because it influences consumer behavior – that is, the deceptive statement is one that is not merely misleading in the abstract but one that causes cause consumers to make choices to their detriment that they would not have otherwise made. This essential link between materiality and consumer injury ensures the Commission’s deception authority is 7 Fed. Trade Commu, Policy Statement on Deception (1983), appended to Cliffdale Assocs., Inc., 103 F.T.C. 110, 175, 182 (1984) [hereinafter FTC Policy Statement on Deception], available at https://www ftc.gov/publicstatements/1983/10/ftc-policy-statement-deception. 8 FTC Policy Statement on Deception, 103 F.T.C. at 175. 9 Id. at 183.

VOLUME 160 Dissenting Statement employed to deter only conduct that is likely to harm consumers and does not chill business conduct that makes consumers better off.

This link also unifies the Commission’s two foundational consumer protection authorities – deception and unfairness – by tethering them to consumer injury.

The Commission does not explain how it finds the materiality requirement satisfied; presumably it does so upon the assumption that “express statements” are presumptively material.10 However, that presumption was never intended to substitute for common sense, evidence, or analysis. Indeed, the Policy Statement on Deception acknowledges the “Commission will always consider relevant and competent evidence offered to rebut presumptions of materiality.”11 Here, the Commission failed to discharge its commitment to duly consider relevant and competent evidence that squarely rebuts the presumption that Nomi’s failure to implement an additional, retail-level opt out was material to consumers. In other words, the Commission neglects to take into account evidence demonstrating consumers would not “have chosen differently” but for the allegedly deceptive representation. Nomi represented that consumers could opt out on its website as well as in the store where the Listen service was being utilized. Nomi did offer a fully functional and operational global opt out from the Listen service on its website.12 Thus, the only remaining potential issue is whether Nomi’s failure to offer the represented in-store opt out renders the statement in its privacy policy deceptive. The evidence strongly implies that specific representation was not material and therefore not deceptive. Nomi’s “tracking” of users was widely publicized in a story that 10 See POM Wonderful LLC, 2013 FTC LEXIS 6, *121 (2013); Novartis Corp., 127 F.T.C. 580, 686 (1999); American Home Prods., 98 F.T.C. 136, 368 (1981).

11 FTC Policy Statement on Deception, 103 F.T.C. at 182 n.47. 12 As such, the facts of this case are distinguishable from the cases cited for support by the majority in its statement. In the Matter of Nomi Technologies, Inc., FTC File No. 132-3251, Statement of Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny 5 n.14 (Apr. 23, 2015). NOMI TECHNOLOGIES, INC. 441 Dissenting Statement appeared on the front page of The New York Times,13 a publication with a daily reach of nearly 1.9 million readers.14 Most likely due to this publicity, Nomi’s website received 3,840 unique visitors during the relevant timeframe and received 146 opt outs – an opt-out rate of 3.8% of site visitors. This opt-out rate is significantly higher than the opt-out rate for other online activities.15 This high rate, relative to website visitors, likely reflects the ease of a mechanism that was immediately and quickly available to consumers at the time they may have been reading the privacy policy.

The Commission’s reliance upon a presumption of materiality as to the additional representation of the availability of an in-store opt out is dubious in light of evidence of the opt- out rate for the webpage mechanism. Actual evidence of consumer behavior indicates that consumers that were interested in opting out of the Listen service took their first opportunity to do so. To presume the materiality of a representation in a privacy policy concerning the availability of an additional, in-store opt-out mechanism requires one to accept the proposition that the privacy-sensitive consumer would be more likely to bypass the easier and immediate route 13 Stephanie Clifford & Quentin Hardy, Attention, Shoppers: Store is Tracking Your Cell, NEW YORK TIMES (July 14, 2013), http://www.nytimes.com/ 2013/07/15/business/attention-shopper-stores-are-tracking-your-cell html?page wanted=all& r=0.

14 The Associated Press, Top 10 Newspapers by Circulation: Wall Street Journal Leads Weekday Circulation, HUFFINGTON POST (Apr. 30, 2013), http://www.huffingtonpost.com/2013/05/01/newspaper-circulation-top- 10n3188612.html.

15 In perhaps the most comparable circumstance -- Do Not Track mechanisms - - the opt-out rate is extremely low. See, e.g., Jack Marshall, The Do Not Track Era, DIGIDAY (Feb. 27, 2012), http://digiday.com/platforms/advertising-inthe-do-not-track-era/ (“[a]ccording to data from Evidon, which facilitates the serving of those icons, someone clicks and goes through the opt-out process once for every 10,000 ad impressions served”); Matthew Creamer, Despite Digital Privacy Uproar, Consumers are Not Opting Out, ADVERTISING AGE (May 31, 2011), http://adage.com/article/digital/digital-privacy-uproarconsumers-opting/227828/ (“Evidon, which has the longest set of data, is seeing click-through of 0.005% with only 2% opting out from 30 billion impressions”). See also Richard Beaumont, Cookie Opt-Out Stats Revealed, THE COOKIE COLLECTIVE (Feb. 19, 2014), http://www.cookielaw.org/blog /2014/2/19/cookie-opt-out-statistics-revealed/. VOLUME 160 Dissenting Statement (the online opt out) in favor of waiting until she had the opportunity to opt out in a physical location. Here, we can easily dispense with shortcut presumptions meant to aid the analysis of consumer harm rather than substitute for it. The data allow us to know with an acceptable level of precision how many consumers – 3.8% of them – reached the privacy policy, read it, and made the decision to opt out when presented with that immediate choice. The Commission’s complaint instead adopts an approach that places legal form over substance, is inconsistent with the available data, and defies common sense.

The Commission’s approach here is problematic for another reason. To the extent there is consumer injury when consumers are offered an opt out from tracking that cannot be effectuated, or that more generally, consumers are uncomfortable with such tracking and it should be disclosed to them, the proposed consent order does nothing to alleviate such harm and will, instead, likely exacerbate it. Nomi has removed its representation about a retail level opt- out mechanism from its privacy policy. The proposed consent order does not require Nomi to offer such a mechanism, nor does it require Nomi to disclose the tracking in retail locations.16 It is unlikely that Nomi could agree to such a condition any case – Nomi contracts with retailers and has no control over the retailers’ premises. The order does not – and cannot – compel retailers to disclose the tracking technology. Even assuming arguendo Nomi’s privacy policy statement is deceptive under the Deception Policy Statement, the FTC would better serve consumers by declining to take action against Nomi. The analytical failings of the Commission’s approach are not harmless error.

Rather, aggressive prosecution of this sort will inevitably deter industry participants like Nomi from engaging in voluntary practices that promote consumer choice and transparency – the very principles that lie at the heart of the Commission’s consumer protection mission.17 Nomi was under no legal obligation to post a 16 In the Matter of Nomi Technologies, Inc., FTC File No. 132-3251, Proposed Consent Order Part I (Apr. 23, 2015).

17 In addition, Nomi arguably offered a product that was more privacyprotective than other, more intrusive methods that retailers currently employ, NOMI TECHNOLOGIES, INC. 443 Dissenting Statement privacy policy, describe its practices to consumers, or to offer an opt-out mechanism. To penalize a company for such a minor shortcoming – particularly when there is no evidence the misrepresentation harmed consumers – sends a dangerous message to firms weighing the costs and benefits of voluntarily providing information and choice to consumers. Finally, market forces already appear to be responding to consumer preferences related to tracking technology. For example, in response to potential consumer discomfort some retailers have discontinued or changed the methods by which they track visitors to their physical stores.18 Technological innovation has also responded to incentives to provide a better consumer experience, including a Bluetooth technology that provides not only an opt-in choice for consumers,19 but also gives retailers the opportunity to provide their consumers with a more robust shopping experience.20 Notably, Nomi itself has responded to such as video cameras. See Clifford & Hardy, supra note 14 (“Cameras have become so sophisticated, with sharper lenses and data-processing, that companies can analyze what shoppers are looking at, and even what their mood is.”).

18 See, e.g., Amy Hollyfield, Philz to Stop Tracking Customers via Smartphones, ABC 7 NEWS (May 29, 2014), http://abc7news.com/ business/philz-to-stop-tracking-customers-via-smartphones/83943/; Peter Cohan, How Nordstrom Uses WiFi to Spy On Shoppers, FORBES (May 9, 2013), http://www forbes.com/sites/petercohan/2013/05/09/hownordstrom-and-home-depot-use-wifi-to-spy-on-shoppers/. 19 See, e.g., Siraj Datoo, High Street Shops are Studying Shopper Behaviour by Tracking their Smartphones or Movement, THE GUARDIAN (Oct. 3, 2013), http://www.theguardian.com/news/datablog/2013/oct/03/analytics- amazonretailers-physical-cookies-high-street (“If customers create accounts on the wireless network - something millions have done - they first have to accept terms and conditions that opts them in to having their movements monitored when inside the stores”); Jess Bolluyt, What’s So Bad About In-Store Tracking?, THE CHEAT SHEET (Nov. 27, 2014), http://www.cheatsheet.com/technology/whats-so-bad-about-in-store-tracking html/?a=viewall (“customers have to turn on Bluetooth, accept location services, and opt in to receive notifications”). 20 See, e.g., Greg Petro, How Proximity Marketing Is Driving Retail Sales, FORBES (Oct. 8, 2014), http://www forbes.com/sites/gregpetro/2014/10/08/ how-proximity-marketing-is-driving-retail-sales/ (“[This will] allow Macy’s to send personalized department-level deals, discounts, recommendations and rewards to customers who opt-in to receive the offers”); Datoo, supra note 20 VOLUME 160 Dissenting Statement these market changes and no longer offers the MAC address tracking technology to any retailer other than its legacy customers.

Accordingly, I dissent from the issuance of this complaint and the acceptance of a consent decree for public comment. (after opting in, “[u]sers can then add their loyalty card numbers to receive personalised recommendations.”).

NOMI TECHNOLOGIES, INC. 445 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, a consent order applicable to Nomi Technologies, Inc. (“Nomi”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. Nomi uses mobile device tracking technology to provide analytics services to brick and mortar retailers through its “Listen” service. Nomi has been collecting information from consumers’ mobile devices to provide the Listen service since January 2013. Nomi places sensors in its clients’ retail locations that detect the media access control (“MAC”) address broadcast by a mobile device when it searches for WiFi networks. A MAC address is a 12-digit identifier that is unique to a particular device. Alternatively, in some instances Nomi collects MAC addresses through its clients’ existing WiFi access points. In addition to the MAC address, Nomi also collects the following information about each mobile device that comes within range of its sensors or its clients’ WiFi access points: the mobile device’s signal strength; the mobile device’s manufacturer (derived from the MAC address); the location of the sensor or WiFi access point observing the mobile device; and the date and time the mobile device is observed.

Nomi cryptographically hashes the MAC addresses it observes prior to storing them on its servers. Hashing obfuscates the MAC address, but the result is still a persistent unique identifier for that mobile device. Each time a MAC address is run through the same hash function, the resulting identifier will be the same. For example, if MAC address 1A:2B:3C:4D:5E:6F is run through Nomi’s hash function on ten different occasions, the resulting identifier will be the same each time. As a result, while Nomi does not store the MAC address, it does store a persistent VOLUME 160 Analysis to Aid Public Comment unique identifier for each mobile device. Nomi collected information about approximately nine million unique mobile devices between January 2013 and September 2013. Nomi uses the information it collects to provide analytics reports to its clients about aggregate customer traffic patterns such as: the percentage of consumers merely passing by the store versus entering the store; the average duration of consumers’ visits; types of mobile devices used by consumers visiting a location; the percentage of repeat customers within a given time period; and the number of customers that have also visited another location within the client’s chain. Through October 22, 2013, Nomi’s Listen service had approximately 45 clients. Some of these clients deployed the service in multiple locations within their chains.

Nomi has not published, or otherwise made available to consumers, a list of the retailers that use or used the Listen service. Nomi does not require its clients to post disclosures or otherwise notify consumers that they use the Listen service. Through October 22, 2013, most, if not all, of Nomi’s clients did not post any disclosure, or otherwise notify consumers, regarding their use of the Listen service.

From at least November 2012, until October 22, 2013, Nomi disseminated or caused to be disseminated privacy policies on its website, nomi.com or getnomi.com, which included the following statement:

Nomi pledges to.... Always allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.

Nomi provided, and continues to provide, an opt out on its website for consumers who do not want Nomi to store observations of their mobile device. In order to opt out of the Listen service on Nomi’s website, consumers were required to provide Nomi with all of their mobile devices’ MAC addresses, without knowing whether they would ever shop at a retail location using the Listen service. Once a consumer has entered the MAC address of their device into Nomi’s website opt out, Nomi adds it to a blacklist of MAC addresses for which information will not be NOMI TECHNOLOGIES, INC. 447 Analysis to Aid Public Comment stored. Consumers who did not opt out on Nomi’s website and instead wanted to make the opt out decision at retail locations were unable to do so, despite the explicit promise in Nomi’s privacy policies. Consumers were not provided any means to opt out at retail locations and were unaware that the service was even being used.

The Commission’s complaint alleges that Nomi’s privacy policy represented that: (1) consumers could opt out of Nomi’s Listen service at retail locations using this service, and (2) that consumers would be given notice when a retail location was utilizing Nomi’s Listen service. The complaint alleges that Nomi violated Section 5 of the Federal Trade Commission Act by misleading consumers because, contrary to its representations, Nomi did not provide an opt-out mechanism at its clients’ retail locations and neither Nomi nor its clients disclosed to consumers that Nomi’s Listen service was being used at a retail location. The proposed order contains provisions designed to prevent Nomi from engaging in the future in practices similar to those alleged in the complaint. Part I of the proposed order prohibits Nomi from misrepresenting: (A) the options through which, or the extent to which, consumers can exercise control over the collection, use, disclosure, or sharing of information collected from or about them or their computers or devices, or (B) the extent to which consumers will be provided notice about how data from or about a particular consumer, computer, or device is collected, used, disclosed, or shared.

Parts II through VI of the proposed order are reporting and compliance provisions. Part II requires Nomi to retain documents relating to its compliance with the order. The order requires that all of the documents be retained for a five-year period. Part III requires dissemination of the order now and in the future to all current and future subsidiaries, principals, officers, directors, and managers, and to persons with responsibilities relating to the subject matter of the order. Part IV ensures notification to the FTC of changes in corporate status. Part V mandates that Nomi submit a compliance report to the FTC within 90 days, and periodically thereafter as requested. Part VI is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

VOLUME 160 Analysis to Aid Public Comment The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed complaint or order or to modify the order’s terms in any way.

DOLLAR TREE, INC. 449 Complaint