Information Privacy in an Age of Invisible Shopper Tracking: Who Will Pay the Price for Stores of the Future?
Kristin Harripaul
Georgia State University College of Law, kharripaul1@student.gsu.edu
[Page 1077]
Explosive growth in technology has brought a unique opportunity to the doors of brick-and-mortar retail—a nearly $3.38 trillion industry struggling to regain relevance among modern, digitally enabled shoppers. Specifically, in-store analytics, or shopper tracking technologies, are allowing these retailers to better compete with online stores by tapping into consumer data unprecedented in the brick-and-mortar context. With these technologies, stores now have access to detailed metrics, like consumer dwell times, journeys, product engagement, product views, and demographic data such as age and gender, which can be used to optimize store operations and marketing and promotions.
Recent events, however, including a string of data breaches and the passage of strict privacy laws in Europe and California, have renewed efforts for broad information privacy reform that could have deleterious consequences for these technologies. This Note examines the current state of privacy law; two approaches to information privacy reform that appeared before the 116th Congress, namely consumer control and business accountability; and the potential impact of these two regulatory approaches on in-store analytics technologies. It concludes that properly balancing consumer privacy and business interests through regulation requires more than a one-size-fits-all federal band-aid. Instead, it proposes starting with targeted federal acts aimed at the bigger gaps and outliers in existing
[Page 1078]
information privacy law, like brick-and-mortar technologies. Addressing in-store analytics, specifically, it recommends federal regulation focused on business-accountability and expanded FTC powers, and it outlines specific considerations for a targeted act.
[Page 1079]
Introduction..............................................................................1080
I. Background..........................................................................1084
A. In-Store Tracking and Related Privacy Concerns............1087
B. Protections Under Current Privacy Laws........................1089
II. Analysis................................................................................1094
A. The Current Notice-and-Choice Regime .......................... 1097
1. FTC "Common Law".................................................1098B. Moving Beyond Notice-and-Choice .................................. 1101
2. Implications for Brick-and-Mortar.............................1100
1. Consumer Control Approach......................................1102
2. Business Accountability Approach.............................1106
III. Proposal................................................................................1108
A. A Uniform Privacy Landscape .......................................... 1109
B. A Targeted Brick-and-Mortar Technology Privacy Act ... 1111
C. More Business Accountability and FTC Enforcement......1113
D. Specific Brick-and-Mortar Considerations ...................... 1116
1. Fixed, Narrow Definition of PII.................................1116
2. General Duty of Care ................................................. 1118
3. Reasonable Consumer Control...................................1119
4. Notice Through 21st Century Technology..................1120
Conclusion.................................................................................1123
[Page 1080]
In 2019, the Federal Trade Commission (FTC) made history by imposing a record-breaking $5 billion civil penalty on social media giant Facebook for privacy-related violations.1 According to the FTC, the penalty "is one of the largest penalties ever assessed by the U.S. government for any violation" and is "almost [twenty] times greater than the largest privacy or data security penalty ever imposed worldwide."2 But what even warranted such action, and why are some policymakers saying that the settlement, which includes a twenty-year agreement for independent privacy oversight, still was not severe enough?3 The answer lies at the heart of a privacy debate that has been brewing in the United States for decades, a debate that grows more complex in an increasingly digital world.4
[Page 1081]
For a long time, information privacy concerns have focused on cyberspace—social media and e-commerce.5 But now, a new wave of connected technologies and inexpensive forms of data storage are bringing these concerns to the doors of brick-and-mortar stores, an industry under particular pressure to transform and regain relevance among digitally enabled shoppers.6 Specifically, growth in in-store analytics—or shopper-tracking technologies, which monitor shoppers' movements in-store via mechanisms such as video analytics and mobile tracking—is quickly erasing differences between how precisely shoppers can be tracked online and inside a physical store.7
[Page 1082]
For shoppers, the promise of these tracking technologies is a tailored and convenient shopping experience that is more consistent with their online experiences.8 However, the premise of in-store tracking has left some consumer advocates, academics, and key committee leaders in both the House and Senate uneasy.9 This uneasiness is further underscored by the fact that these tracking technologies are often invisible to the average shopper.10 Despite these concerns, however, no uniform information privacy law exists—U.S. privacy law has remained largely self-regulatory and sectoral, unlike many industrialized nations that protect personal data in an omnibus fashion.11 An array of "constitutional protections, federal and state statutes, torts, regulatory rules, and treaties" regulate different industries and economic sectors, leaving gaping holes with little recourse for these new technology-driven problems.12
[Page 1083]
Historically, efforts to create a broad information privacy framework governing how businesses collect, use, share, and protect personal information have struggled to gain traction.13 But on the heels of the strict online privacy rules established by the 2018 General Data Protection Regulation (GDPR) of the European Union (EU) and the 2019 California Consumer Protection Act (CCPA), privacy advocates and business groups alike are now calling on Congress to create some uniformity amid a growing patchwork of privacy standards.14 Oddly, despite brick-and-mortar's control over the majority of consumer sales, its technologies often figure little into narrow, online-focused privacy rhetoric or legislation, and what little guidance does exist leans toward treating online and brick-and-mortar tracking the same.15
[Page 1084]
As such, in-store tracking technologies could be one of the first casualties of new privacy reform laws, hampering the brick-and-mortar retailer's ability to compete in an increasingly complex and digital world.16 The following Note discusses how policymakers should address shopper-tracking practices in brick-and- mortar amidst prompts for privacy reform. Part I examines key in-store tracking practices and concerns and the current state of privacy law. Part II analyzes various bills and proposals, from privacy advocates and business groups alike, for privacy reform. Part III proposes specific considerations to balance privacy rights against support for the next phase of brick-and-mortar innovation—the store of the future.
Over the last decade, explosive growth in technology has changed the rules of engagement, providing businesses with access to massive pools of data across almost every aspect of consumers' lives.17 These technologies have built a rich digital economy and left a trail of electronic breadcrumbs that businesses, under competitive pressures, are driven to turn into profit.18 Furthermore, in an intriguing paradox,
[Page 1085]
consumers have been willing contributors to this digital economy despite mistrusting companies that monitor their behavior.19 They confess their problems on social media, allow apps to track their mobile location, and welcome an increasing number of smart technologies into their lives in exchange for convenience and other value.20 As a result, industry experts estimate that this digital economy is "doubling the volume of . . . information in the world every two years."21
This nonstop disruption has shaken up the very foundation of retail, "creating opportunities for new entrants, and making transformation an imperative for [brick-and-mortar] incumbents" that are sorely ill-prepared for this digitally enhanced marketplace.22
[Page 1086]
Modern shoppers—with increased access to information and growing expectations—have created a nightmare of a moving target for traditional retail stores that rely on limited transactional and loyalty data with little visibility into shopper behavior and what shoppers actually experience inside the physical environment.23 Additionally, because extracting insight from these traditional sources has minimal effect on daily decision making, brick-and-mortar retailers have little means to control their bottom line by adjusting and improving the shopping experience in real-time.24
As such, analysts believe the retail industry is at "a major inflection point."25 Unsurprisingly, brick-and-mortar "retailers are increasingly turning to data and analytics," with shopper-tracking being the number one technology on retailers' list of technology-enabled growth strategies for 2021.26 With everything to lose, brick-and-mortar is now looking to join the race to turn shopper data into a meaningful business advantage before online players
[Page 1087]
render stores obsolete.27 Despite a general lack...
