Nordstrom Phone-Tracking Trial Raises Customer-Theft Threat

Nordstrom (NYSE:JWN) is six months into a 17-store trial in which shoppers are counted by way of Wi-Fi signals from their smartphones. The 236-store apparel chain is not storing any customer personal information from the trial, and it's only being given aggregated data on customers by the vendor handling the trial. But that vendor, Euclid, is storing hashed versions of customer Wi-Fi MAC addresses—and is also running trials for some 35 other of the nation's 100 largest retailers. That presents what could easily become an irresistible cross-retailer mobile tracking temptation.Two very desirable—and potentially lucrative—sets of shopper data are being captured and saved here, but the retailers and the vendor involved are all pledging to not use it. The first is cross-retailer data, which is where the vendor will recognize a shopper's phone's MAC address when the shopper repeatedly walks into a Nordstrom and will then detect that same shopper walking into a Nordstrom competitor. How much would that rival pay for such information? The second data set: Once one of those MAC addresses makes a purchase, the chain could connect that MAC address with the payment information. Voila, instant CRM-friendly data on whenever that customer walks into a store and, with enough sensors, every aisle he or she visits and how long the shopper lingers.These temptations, for the moment, are all weighing upon Euclid and other mobile vendors. In this instance, Euclid is only delivering aggregated data to the retailers, listing how many shoppers were in a store, how long they stayed and how many repeat customers were in that crowd. Depending on the store, the number of sensors and prior arrangements, even the specifics of that shopper's movements may not be reported back to Nordstrom."We're making trade-offs on location granularity," said Euclid CEO Will Smith. "We're not telling them which aisle they were in. We're talking more like which floor people are on." Asked why the geolocation data isn't more specific, Smith said, "Because retailers won't pay us for it."Smith clarified that the data limits generally speak to the number of sensors—and all the associated set up required if those sensors are being connected with physical wires. A sensor costs about $200, and the maximum distance is about 60 yards. When asked how reliable the data was on the periphery of that distance, Smith said, "very inaccurate."To be precise, the MAC addresses of those shoppers are not being stored by Euclid; instead, a hashed version of those MAC addresses is being stored. But as long as that information is enough to detect that it's the same shopper when the phone is detected in any store involved in a trial, the ability to track a shopper is still happening.Euclid offers shoppers the ability to opt-out on its site, although it's not clear how many shoppers would bother to go to the site, fill out the form, identify their MAC address and key it in—when they could achieve tracking protection by simply turning off the phone or even just the phone's Wi-Fi connection. The opt-out does, however, promise to delete historical data about that shopper, which would address any activity that was logged before the shopper thought to turn off the phone or Wi-Fi.The nature of the opt-out mechanism, though, will make clear to shoppers that there is a file of data specifically linked to their phones. That's a message retailers may not want to stress, especially because the retailer itself is not benefitting from that customer-specific information (beyond a generic "18 of these customers had been in the store six times this month").These mobile-data fears are not new. A couple of retailers at an MCX panel at the National Retail Federation's show last month said fears of data-selling from mobile vendors was one of the driving forces behind MCX's formation. Jay Culotta, the treasurer at regional convenience chain Wawa, said many of the mobile vendors say they are not—today—planning on sharing data, but they refuse to say what will happen down the road. "It's not a forever situation," Culotta said, adding that the temptations for leveraging such data will likely be overwhelming. "It's unclear what their business case would be without monetizing that data."A Lowe's (NYSE:LOW) executive on the panel—VP, Operational Controller John Manna—agreed and painted a scenario where a mobile vendor knew that a Lowe's customer made regular purchases at Lowe's and then walked right by an Ace Hardware store. And if an Ace Hardware corporate manager is then talking with that vendor, will the very substantial dollars Ace would likely pay for that list of customers be set aside? Manna indicated he would rather not find out.At its most innocuous core, the Euclid system is simply a customer counter. But is it a more accurate one? In its favor, argues Euclid's Smith, is that a system based on mobile—rather than one that counts customers based on breaking a beam or being detected by a thermal pattern—can be more selective. "We don't count kids who run in and out of the store multiple times," Smith said. "And we don't count sales associates." Associates are excluded based on how many hours they stay in the store.On the down side, mobile tracking is thwarted by anyone who doesn't have a smartphone or who has the phone—or even just the Wi-Fi—turned off. In Euclid trials, Smith said, the vendor says typical stores in San Francisco and New York saw that about 70 percent of their shoppers had smartphones turned on—with Wi-Fi activated—while visiting. That number plunged to about 40 percent for the same type of store in Atlanta. "It all involves smartphone penetration by region," Smith said.No system is perfect, and the accuracy Achilles heel in the Euclid mobile system is being unable to factor in the unknowable. The Euclid system has no idea how many people are in the store without a phone, or without the right type of phone or without Wi-Fi activated, which means it doesn't really know how many shoppers are in the store.Smith said Euclid tries to factor that in by periodically having people literally count customers in the stores, to match against the results of the mobile system. Tara Darrow, a spokesperson for Nordstrom, said her chain also watches customers in other ways, to keep the Euclid system honest. "We also have some anecdotal data, based on years of staffing," Darrow said.Among the largest chains, Nordstrom is often touted as the quintessential customer service giant, along with Trader Joe's and Whole Foods (NASDAQ:WFM). For that reason, a key Nordstrom concern was making sure the move didn't make any Nordstrom customers feel uncomfortable. Indeed, "this is our first attempt at looking at where the customers are in the store," Darrow said.The reality is that, as the program is currently being used, the stores aren't being told anything about what a specific shopper is doing, so there truly are no privacy issues—yet.Still, signage announcing the program at the test stores caused some confusion among shoppers, who feared that they were being tracked in an identifiable way and that the store was being told about what they looked at and didn't buy. This prompted the store to change the wording on its signage, to stress to customers that shutting off the phone or Wi-Fi connection would end the issue. "This is something we want our customers to be aware of," Darrow said. "At the end of the day, we don't want our customers to be confused."Frustratingly, alerting customers to the program is likely to generate more confusion, as references to aggregated and hashed data may not communicate that much to distracted shoppers. They may merely glance and conclude that, somehow, their favorite store is tracking their phone and that that feels invasive in a way other customer-counting systems might not.This is solely psychological fear, but it's real nonetheless. Mobile phones are with the customer always, and those devices contain some of the most private information possible (personal photos, bank account access, E-mail and text content, etc.). Even if it's simply counting pings from the phone—something that cell towers have done for decades—it can set off (potentially unwarranted) privacy concerns.The problem with those shopper concerns is that, like the worries expressed by Lowe's and WaWa, the lack of privacy intrusions is a very much "for now" situation. Once mobile tracking becomes commonplace, will consumers be able to stop it? Will retailers? Will vendors be able to resist forever the dollars to be made selling that data?There is another obligation here. The fact that Nordstrom is regarded so highly by its customers—given the proverbial white-glove treatment the chain pushes—is the reason it has much more to lose with this mobile gambit. If Walmart (NYSE:WMT), Target (NYSE:TGT) or 7-Eleven tried this program, few customers would likely get upset, because they don't expect those chains to aggressively protect shopper privacy. That's the plus side of treating shoppers like walking wallets. It's much harder to lose their respect.That obligation is to protect your shoppers. Nordstrom not getting—for the moment—any customer-specific data is fine, but the chain is putting in place a system that allows their shoppers' data to be in play. It puts it in the hands of a profit-driven vendor, which is already known to be taking money from many other rival chains.If that data—even two to three years from now—starts turning up in unexpected places, Nordstrom shoppers will be angry and will feel unprotected (dare we say betrayed?). The idea that Nordstrom itself didn't benefit or have access to customer-specific data won't reduce that anger any. In other words, Nordstrom's self-restraint is admirable, but it may not be sufficient.Euclid's Smith said the company currently pledges to retailers that it won't share identifiable shopper data, nor will any data travel from one retailer to another. "That's the way our contracts have been written," Smith said. "It's a fundamental product direction."But what about the future? Smith said he does not expect that to change, because retailers will likely understand the long-term customer alienation risks associated with giving into a desire for more location-based mobile CRM data. Referring to mobile vendors and major retail chains, he said: "Our interests are fairly well aligned. To the extent that I upset retailers," that's bad for business.That's true. But in the historic battle of short-term greed and desire versus long-term best interests, betting that marketshare-desperate retailers will continue to make the wisest moves is hardly a sure thing. Even worse, this could slip into a digital domino situation, where a few mobile vendors—backed by just a handful of retailers—start to track customers more aggressively. Then their rivals will feel extreme pressure to either do the same or suffer a competitive disadvantage.For this to stay pure, not only do the top chains need to hold firm to strict "don't show me more than I need to see" mobile policies, but their rivals must, as well. Yep, maybe shoppers have good reason for those signs to make them nervous.