UK retailers are able to follow and target customers using facial recognition software and handset identifiers broadcast via Wi-Fi

The UK’s data protection watchdog has warned that retailers can track every move of their customers using their phones and target them using facial recognition software.

The technology, which has been available for the last couple of years in some form, is capable of tracking a smartphone using the unique identifier that it broadcasts via Wi-Fi. It is the same as that used by beacons which track smartphones using the unique Bluetooth identifiers every smartphone puts out when the wireless communications service is switched on.

Simon Rice, the group manager for technology with the Information Commissioner’s Office (Ico) said: “This technology, which is starting to be rolled out in shops, allows retailers to use the customer journey to build up a picture as to how people typically use the store. It uses the MAC address of a smartphone which can, in many cases, be linked to a specific individual.

“Picture the scene, you’re in a department store and decide to go back and try that pair of trousers on for a second time. How would you feel if the price had changed or a display lit up with a three-for-two offer?”

The use of the technology is not confined to shops. It has been implemented in airports, transport hubs and even using city-wide Wi-Fi networks.

The difference between Bluetooth-tracking beacons and Wi-Fi tracking systems is that the modern smartphone leaves Wi-Fi on, even when manually switched off for data connectivity, as a way of pinpointing its location. It is part of the location services with GPS and cellular network triangulation, which speeds up positioning for mapping and other location-dependent services.

Rice said: “When this type of technology is used to generate aggregate statistics about daily visitor numbers or to generate an alert if an area is overcrowded, it can be done in a privacy-friendly manner.”

However, the technology is also capable of identifying individuals and tracking their movements, which would represent the use of personal data, and therefore falls under the purview of Ico.

Smart CCTV systems and facial recognition cameras are also capable of identifying individuals, Ico warns, allowing adverts for shaving products to be targeted at male shoppers, for instance.

Similar technology is used on the web to target adverts at users, based on behaviour rather than faces.

Rice said: “Even if the identification of individuals is not the intended purpose, the implications of intelligent video analytics for privacy, data protection, and other human rights are still significant. For example the technology could be used to play recorded messages to reprimand litter picking or illegal parking.”

Ico is currently drawing up guidelines on the use of the technology as part of an international working group on data protection in telecommunications, which will involve informing shoppers that they are being tracked and that facial recognition systems are being used in the area, similar to the warnings of CCTV operations.

For consumers, it could result in better footfall modelling, which would aid in the design of shopping centres, transport hubs and other public spaces. But the scope for invasive tracking and profiling is large, if the technology is not used with privacy in mind.