Legal & Regulatory Resources:
- French Council of State Opinion (Feb. 8, 2017). Read original in French; Read FPF’s translated version in English. In this opinion, the highest administrative court of France upheld a decision by the CNIL to deny authorization to an outdoor advertising corporation to implement a four-week program of measuring pedestrian traffic in La Defense Plaza near Paris. The proposed method involved collection of MAC addresses from WiFi “counting boxes” installed on street furniture, to be followed by truncation of the MAC address, salting, and hashing. The decision was based primarily on France’s 1978 data protection law, which defines “personal data” broadly (“[I]t is clear from the definition of personal data [in the 1978 law] that such data can only be regarded as anonymous when the identification of the concerned person, directly or indirectly, becomes impossible by the data controller or a third party. This is not the case where it is still possible to individualize a person or to link data between two records that concern him or her.”).
New technologies, which rely on the fact that most people carry a mobile device, now allow venues such as airports, stores, and hotels to receive signals from devices that are in or near them. If your mobile device has Wi-Fi or Bluetooth turned on, it broadcasts a unique number – called a MAC address – that can be logged by Wi-Fi equipment or Bluetooth sensors. A MAC address is simply a 12-character string of letters and numbers; it doesn’t contain personal information like your name, email address, or phone number.
Since a MAC address is unique to each device, special analytics software can be used to generate reports about customer traffic in a store based on the MAC addresses that are detected at any given time (see sample reports here). For instance, a venue can learn how many unique customers walk into it, and the path customers take as they move around. A venue can then use this information to improve customer service – by making sure there are enough employees available, reducing wait times, or improving venue layouts.
Mobile location analytics companies that have agreed to FPF’s Mobile Location Analytics Code of Conduct, which was announced with Senator Schumer (D-NY) in October, will honor the requests of consumers who wish to opt-out of having their location collected. Consumers opt-out by entering their phones’ Wi-Fi or Bluetooth MAC address at smart-places.org.