A company that tracks customers as they walk through retail stores reached a settlement with the Federal Trade Commission this week after it found itself in regulatory cross-hairs for reneging on its promise to notify customers in-store that they could opt out of the tracking.

Nomi Technologies (now known as Nomi Corporation after its merger with video intelligence company Brickstream in October) deploys sensors throughout a participating retail store or relies on existing Wi-Fi access points to collect the MAC addresses of all the smartphones in the area searching for a Wi-Fi signal. Nomi stores a “hashed” MAC address but keeps the hash unique to the phone so that if the customer returns to the store later, or visits another participating retail store, or even passes by a participating store, Nomi can track that device over time.

According to the FTC complaint (PDF), in addition to collecting the MAC address hash, Nomi can also determine the phone's signal strength and the device manufacturer. It takes note of the phone's proximity to a sensor and the date and time that the phone is observed, as well. Add that all up and you get a pretty clear picture of who your customers are and how they shop, something that brick-and-mortar shops are eager to learn with more precision as they compete with online retailers.

While this practice is not illegal, Nomi found itself in hot water with the FTC because its privacy policy between 2012 and 2013 implied that customers entering a store with Nomi tracking would be informed of the fact, and it promised that it would allow customers to opt out of the service in-store. While Nomi does allow people to place their MAC address on a blacklist, the company never informed customers of Nomi's presence, so there was effectively no way for people to know that they could opt out.

The FTC says that in October 2013 Nomi had 45 clients, some of whom used the service throughout multiple locations in a chain. The company does not publish a list of its clients, nor did it respond to Ars' request for a list.

“Nomi collected information on about nine million mobile devices within the first nine months of 2013,” the FTC said in a press release.

Nomi's not the only one in the business, of course. Several customer-tracking companies have sprung up in recent years, looking to profit by selling retail stores the kind of analytics that online competitors like Amazon have at their fingertips through the use of tracking cookies.

Nomi's product can tell companies how many people pass by a store rather than enter a store, how long a customer spends in a store, what kinds of phones customers are using, how many customers are repeat customers, and how many customers have visited another location within a retailer's chain.

Another company called RetailNext gathers similar information but adds video taken from surveillance cameras placed around the store. Brickstream, the company with which Nomi merged last year, uses video footage to tell adults and children apart.

None of these companies are required to make their presence known in stores, and in many cases they probably prefer not to. According to a New York Times story from 2013, Nordstrom did some initial testing of customer tracking technology and posted a sign telling customers they were being watched. The department store received some complaints and ended the test, in part because of those complaints.

The FTC says that it was “false and misleading” (PDF) for Nomi to promise that it would let consumers opt-out of tracking at retail locations, because no retail locations notified customers of Nomi's presence. Still, going forward, Nomi will not be required to inform customers that they're being tracked in the future—instead, it will simply be “prohibited from misrepresenting consumers’ options for controlling whether information is collected, used, disclosed or shared about them...”

In an e-mailed statement to Ars, Nomi wrote that the settlement changed little that hadn't already been changed years ago: “We are pleased to reach this agreement. We continually review our privacy policies to ensure that they follow best practices and had already made the recommended changes in pursuit of that goal by updating our privacy policy over a year and a half ago, while we were still an early-stage startup that was less than a year old.”

Two FTC commissioners, Maureen Ohlhausen and Joshua Wright, dissented from the FTC's decision to publicly censure Nomi. Ohlhausen in particular wrote (PDF) that because Nomi didn't store actual MAC addresses and gave people an option to blacklist their MAC address on its website, Nomi had already gone above and beyond what other companies of its caliber do. “It is important to note that, as a third-party contractor collecting no personally identifiable information, Nomi had no obligation to offer consumers an opt out. Yet from the inception of the service, Nomi offered all consumers the opportunity to opt out globally.”

“[W]e should not apply a de facto strict liability approach to a young company that attempted to go above and beyond its legal obligation to protect consumers but, in so doing, erred without benefiting itself,” Ohlhausen continued. “I fear that the majority’s decision in this case encourages companies to do only the bare minimum on privacy, ultimately leaving consumers worse off.”