Last month, the New York Times reported that Euclid Analytics “uses the Wi-Fi antennas inside stores to see how many people are coming into a store, how long they stay and even which aisles they walk. It does this by noting each smartphone that comes near the store, feeding on every signal ping the phone sends.” Sen. Al Franken (D-Minn.), chairman of the subcommittee on Privacy, Technology and the Law of the Senate Judiciary Committee, sent a letter to Euclid asking about the data collection, which is opt-out for individuals, and what privacy protections the company used to secure individuals’ sensitive personal data, including medical information.
Now, Franken announces that he has received Euclid’s answers. Although he “believe[s] that Euclid has a sincere desire to protect consumer privacy […] Euclid’s use of opt-out location tracking – regardless of whether a consumer actually enters a store equipped with this technology – simply doesn’t meet the standard of privacy Americans should be able to count on. I’m pleased that privacy is a priority for Euclid, but their continued use of opt-out technology underscores the need for Congressional action to protect consumer location privacy.”
Here’s an excerpt from the response (pdf) that Euclid sent to Franken:
We support your efforts and we therefore renew our dedication to bringing value while striving to protect consumers and their right to privacy. To that end, Euclid reaffirms its commitments that protect consumer privacy:
- Our sensors receive only the following basic data: MAC address, manufacturer code (Apple, Samsung, etc.), signal strength, and, if the device is currently connected to a specific Wi-Fi network, the name of that Wi-Fi network.
- We cannot and never will receive any information relating to names, addresses, phone numbers, emails, etc.
- We never share information on individual devices.
- We never link data to specific individuals.
- We never share information between our clients.
- We provide a permanent opt-out process for any customer who wishes to do so. Our in-store notices direct customers to our website, which features a simple process by which customers can permanently opt out and delete data from our service.
In addition, Euclid makes the following new commitments to further protect consumer privacy:
- We will include posted customer signage as a stipulation in our contracts with all retailers going forward.
- We will institute a new and comprehensive education program about the opt-out process that we will require all retailers to undergo.
- We will create a formal policy outlining our requirements for a warrant or court order to comply with any request for data, which we will rely on in case we should ever receive such a request.