Most of us are aware—and to some degree have come to accept—that there's a certain amount of tracking that's happening in the background of our online activity. To completely shield ourselves from any monitoring, we’d almost have to get rid of all devices.

But that's not the end of it. We also seem to be trailed wherever we physically go. Not only trailed, surveilled. And those tracking us don’t just have a visual on us, they have a file.

At the recent hearing led by Senators Josh Hawley (R-MO) and Dick Durbin (D-IL),  the U.S. Senate Judiciary Committee Subcommittee on Crime and Counterterrorism listened to  testimony outlining the concerns of surveillance pricing and consumer data harvesting.

During the hearing, Dr. Lindsay Owens, President and CEO of Groundwork Collaborative referenced technology retailers have access to for gathering consumer data. Cameras exist that can be put into store coolers, on shelves, or grocery carts. A few years ago, Walmart even sought a patent for a grocery cart handle that could monitor your temperature and heart rate as you shopped—which then could be used for medical diagnosis, simulation, or medical data mining.

According to Dr. Owens, the more data retailers have on you to feed into consumer intelligence scores and agitation scores, the more they can convince you to shell out for their products.

Data They’re Collecting

Visa’s former Chief Data Officer Robert Hedges shared in his testimony that retailers use many sources to collect data and create a profile. These detailed profiles know your behavior, preferences, health conditions, relationship status, presence of children, and countless other behavioral attributes, and even project your future shopping needs, brand loyalty, typical shopping behavior, sense of urgency to make a purchase, and your willingness to pay.

A high willingness to pay means you're less price sensitive—you really want to purchase the product, have a strong urgent need, or simply decline to negotiate.  A low willingness means you're likely to carefully comparison shop, ask for a discount, or simply leave without making a purchase.

An example, interjected by Senator Hawley, is that Uber is known to monitor a customer’s phone battery life. One of the strongest predictors of whether a customer might be willing to pay more is if the battery is low, indicating there might be more urgency to get home.

With the collected data, retailers and others create what’s called surveillance pricing, also called personalized or individualized pricing, where prices fluctuate depending on your data. Data collected in the store can be fed into your profile in the app or the loyalty program and either be used to personalize online prices or adjust digital price tags on store shelves in real time.

Laws in the Works

Part of the purpose of the subcommittee hearing, in addition to highlighting the data collection that is occurring, was to consider what measures can be taken to protect consumers beyond the Consumer Protection Act—which doesn’t address these topics specifically.

In his testimony, Lee Hepner, senior legal counsel for the American Economic Liberties Project, thought that when it comes to writing a law around this issue, it should start with the simple premise that personal information should not be used to inform price. He added that while he hadn’t seen a case that alleges that a personalized price is inherently misleading, there's an inherent deception, an overall net impression that the consumer is being misled.

Former Data Officer Hedges suggested lawmakers first implement regulation for how consumer behavior data is allowed to be collected—with mandated, simple, and clear disclosure to the consumer; second make a consumer’s informed consent a requirement; and third, require retailers and digital platforms to inform consumers that pricing won’t be derived from consumer behavior data unless the consumer agrees to it.

Efforts already are in progress. There are more than 40 bills in 24 states and cities that have been introduced just this year prohibiting companies from using personal surveillance data such as browsing history, purchase behavior, and location to set individualized prices.

Here in Michigan, three related bills have been introduced this year:

• HB 5771 - Prohibits surveillance-based price discrimination generally.

• HB 6098-99 - Prohibits surveillance pricing on consumer items.

• Senate Bill 991 - Prohibits personalized pricing and dynamic pricing.

‍

With Laws Not Yet in Place, Here's How Stores Currently Watch You

TARGET

Since 2017, the Target app has used Bluetooth beacon technology to power “GPS for your shopping cart,” indoor mapping to show your location and help you find products. Target’s privacy policy lists your “in-store location” as coming from either your  phone “or other technologies.” Beacons also can send individualized promotional messages to you through the app.

Grocery carts and handheld baskets may carry a bolted module which Target describes as an asset tag for cart recovery. Some industry modules are able to capture dwell time (how long you study and compare a product) and whether or not you open the app. It is unknown if the modules on Target’s carts and baskets have this capability.

To date, there is no posted opt-out for a basket or cart containing a module. Turning off location in the Target app disables indoor maps and Store Mode; it does not disable store cameras or Automatic License Plate Readers (ALPR)—think Flock—which collect information in the parking lot.

The following categories in Target’s privacy policy may be collected when you're in store or interacting with the retailer online:

• Identifiers: name, mailing address, email address, phone number, payment information, driver’s license number, license plate number, device ID, IP address, online identifiers.

• Demographics: age, sex, race, date of birth, education, occupation, physical characteristics.

• Commercial information: products/services purchased, registry/list information.

• Internet or other electronic network activity: device information; online interactions with websites, mobile applications.

• Geolocation data: latitude or longitude, in-store location.

• Health data: in connection with Guest Service or product development

• Biometric information: voiceprints.

• Sensory information: audio, visual, photographs.

• Inferences: drawn from any of the above, e.g., preferences or characteristics.

Additionally, in-store cameras are used for operational purposes and, if you’ve given access for services such as product visualization or virtual try on, Target may also use your device’s camera.

According to the policy, information is collected about existing and potential guests from other sources to “improve the accuracy of our records.”

MEIJER

While similar to Target’s, Meijer's privacy policy additionally alerts customers to the use of facial recognition data and other facial geometry data that is collected at some of the stores.

WALMART

Walmart collects information similar to Target and Meijer plus:

Internet and Other Network Activity Information: such as information about your browsing or search activity.‍

Commercial Information: such as purchase and transaction history information (products or services you have purchased, rented, or returned), details about products associated with services you receive through Target (e.g., car make, model, year, odometer reading, and Vehicle Identification Number for auto related services), product reviews, travel and vacation information, and sweepstakes and contest entries.

Financial Information: such as credit or debit card numbers and financial account numbers.

Biometric Information: such as voice prints, imagery of the iris or retina, face geometry, and palm prints or fingerprints.

Background Information: such as background checks and criminal convictions.

Can You Opt Out?

The only provision there is to not participate in giving retailers the full extent of your data is for you to turn off your location data and access to the retailer apps.

Meijer gives customers the option to request what data has been collected by filling out an online form. Ironically, in order to see the data Meijer has, you are first required to supply your personal data.

In the Meantime

While waiting for bills to become law and data collection to be more regulated, there are a few measures you can take to protect your privacy when shopping in store.

Since retail Bluetooth beacons operate on a standard protocol (like iBeacon or Eddystone) that transmit a simple, unencrypted identification number at regular intervals, one Reddit commenter suggested shoppers could broadcast dozens of fake grocery cart or basket IDs simultaneously by using a smartphone equipped with a generic BLE (Bluetooth low energy) broadcasting app. The broadcast would create massive "data noise" that would make the store's collected data completely unreliable. Another option is to you could leave your phone in your car.

But once again, the most reliable option seems to be to shop locally, in person at mom-and-pop stores, farms, etc., growing and making our own products whenever feasible—at least until laws are in place or retailers get the message.

‍