It’s no secret marketers are trying to get information about customer activity and habits online. Now some businesses are taking it a step further–using pocket-sized sensors to glean information from consumers’ Wi-Fi-enabled smartphones as they go about their day. Is this behavior tracking going too far?

Elizabeth Dwoskin of the Wall Street Journal examined several startups that are using data from smartphones to help businesses better target customers based on their activities and interests. She interviewed the founders of several startup companies using this technology and their customers, as well as privacy experts.

Euclid Analytics, a San Francisco-based tech company founded by the team behind Google Analytics, works with retailers to assemble and analyze foot traffic patterns in restaurants and coffee shops, specialty retailers and big box stores. The technology works like this: sensors the size of a deck of playing cards are placed in the store that pick up “pings” off smartphones, and are used to gather information about shoppers.

Two Toronto-based companies take it a step further. Turnstyle Solutions, Inc. tracks information such as how long a shopper stays in a store, whether a promotion brought them in, and whether it’s their first visit or they’re a repeat customer. The owner of Happy Child, an Asian restaurant in Toronto, used Turnstyle to discover that a number of his customers belonged to gyms, so he started selling workout gear with the restaurant’s logo on it. “Instead of offering a general promotion that may or may not hit a nerve, we can promote specifically to the customer’s taste,” Fan Zhang told the Journal.

Viasense, Inc. allows businesses to track where consumers go before and after their visit, whether they’re joggers or golfers, and other demographic information like age, income, gender, and ethnicity. While these companies aren’t gathering personally identifiable information about customers such as their name or address, it’s not difficult to find this information if they’ve enabled location services on apps like Twitter, said Viasense CEO Mossab Basir. “People are probably unaware of how much they are making available. That’s why it’s a very delicate subject for us. It’s kind of Big Brotheresque,” Basir said.

Dworkin also spoke with Eloise Gratton, a Montreal-based privacy lawyer, who noted that geolocation companies could infer from a customer’s online searches that he/she has a certain illness, and may track that customer to his/her doctor or hospital, before potentially selling that information to marketers. While this is a relatively new area, the Federal Trade Commission (FTC) provides guidance for businesses creating apps, some of which is instructive here, while the Mobile Marketing Association (MMA) also offers best practices in this area.

The FTC and MMA recommend having a plan in place to protect user privacy from the beginning, such as limiting the information you collect, securing data, aggregating information, and deleting information when it’s no longer necessary.