• by Wendy Davis  @wendyndavis, April 23, 2015

Analytics company Nomi Technologies, which tracks consumers in retail environments, failed to live up to its privacy promises, the Federal Trade Commission alleged in a complaint unveiled on Thursday.

In 2013, Nomi said in its online privacy policy that people could opt out of being tracked by providing the company with their devices' 12-digit MAC addresses -- which were placed on an opt-out list. The company also promised to allow consumers to opt out “at any retailer using Nomi’s technology,” according to the FTC.

But Nomi didn't require its 45 retail clients to disclose whether they used the technology, and most of its clients didn't voluntarily do so, the FTC alleged. The result was that consumers who might have chosen to opt out at retail locations weren't able to, according to the agency.

“Consumers were not provided any means to opt out at retail locations and were unaware that the service was even being used,” the FTC said in its complaint.

Nomi agreed to settle the charges by promising that it won't in the future misrepresent its policies.

The company added in a statement that it updated its privacy policy more than 18 months ago. The current privacy policy no longer says that consumers can opt out at retail locations.

Like other retail tracking companies, Nomi provides data about shoppers' traffic patterns, such as the percentage of people who enter a store after walking by it.

Between January and October of 2013 (the time period referenced in the FTC's complaint) Nomi gathered tracking data via 12-digit “media access control” (MAC) addresses -- identifiers that mobile devices broadcast when users turn on WiFi or Bluetooth. Nomi attempted to anonymize the MAC addresses by replacing the actual series of characters with alternate, but persistent, identifiers, the FTC alleged.

Last year, Apple moved to prevent tracking via MAC addresses by reconfiguring its software. Now, iOS 8's WiFi scanning uses random, locally administered MAC addresses, instead of the permanent MAC addresses.

Commissioners Maureen Ohlhausen and Joshua Wright dissented from the decision to bring an enforcement action against Nomi.

Ohlhausen -- who described Nomi as “a young company that attempted to go above and beyond its legal obligation to protect consumers” -- wrote that the majority's decision could encourage other companies to “do only the bare minimum on privacy.”

But Commissioners Edith Ramirez, Julie Brill and Terrell McSweeny, who voted in favor of the decision, said that even though the FTC encourages companies to offer privacy choices, the agency “must take action in appropriate cases to stop companies from providing false choices.”

Wright said in his dissent that the evidence indicates that Nomi's representation regarding opting out at retail locations was “not material and therefore not deceptive.”

He also said that the FTC's order doesn't address one of the key privacy issues posed by retail tracking, which is that store owners don't have to disclose their tracking practices.

“Nomi has removed its representation about a retail level opt-out mechanism from its privacy policy. The proposed consent order does not require Nomi to offer such a mechanism, nor does it require Nomi to disclose the tracking in retail locations,” he wrote. “It is unlikely that Nomi could agree to such a condition any case -- Nomi contracts with retailers and has no control over the retailers’ premises.”