NORDSTROM, an American fashion retailer, is known for its high-touch customer service, which has engendered customer loyalty ever since it was founded to supply prospectors for the Yukon gold rush. It has a liberal returns policy, pays commission in a way that discourages sales staff from being pushy and offers an enormous range of products. It also, apparently, likes to keep tabs on its customers and potential customers without the need for human intervention. For several months Nordstrom tested a system that tracked the movements of people carrying Wi-Fi-enabled smartphones and other devices as they wandered through 17 of its stores or merely walked by. The firm posted a public notice of the monitoring, prompting a report by a television station in Dallas in May, at which point the retailer pulled the plug. Then the New York Timespicked up the story, igniting a privacy debate about passive monitoring via Wi-Fi and other technologies. The system used by Nordstrom and several other firms, provided by Euclid Analytics, can precisely track the movements of individual phones, even though they never actually connect to a Wi-Fi network. How does it work? The technique takes advantage of the fact that Wi-Fi wireless networking protocols are "promiscuous": the Wi-Fi adaptors in laptops, phones and base-stations reveal a lot of information about those devices as they attempt to negotiate connections with other devices nearby. Even before a device hooks onto a Wi-Fi a network, it continuously spews identifying information, including a unique, factory-set identifier, over the air. Most devices send "probe requests" akin to a town crier shouting out the names of networks which the device has previously connected to, so that a nearby base-station that matches any of these requests can respond. The requests run unremittingly across all available frequencies until a connection is made. Even devices that are seemingly turned off, such as sleeping laptops, send out such probes, though at a slower rate. Place several Wi-Fi base-stations in a shop, then, and you can pick up these probe requests, extract the device IDs, trilaterate the positions of the devices sending them, and thus track the movements of individual shoppers, seeing which racks or displays they stop at, and what paths they follow through the store.

This is arguably just the latest development in the well-established field of "retail science", in which the movement of shoppers is tracked and analysed. This was once done using video cameras, with footage examined by operators to determine where best to place new products or displays. Analysis of video is now heavily automated, and computers grind through the data to work out when stores are busiest, when queues are longest and how the positioning of products and promotional displays affects sales. The use of Wi-Fi tracking allows merchants to anonymously track individual shoppers more accurately than is possible with video, particularly in crowded stores. It also means returning customers can be spotted without the need for facial recognition, by looking out for known device IDs.

All this is convenient for retailers, but worries privacy advocates. It is true that shoppers are on private property, and signs announce the use of tracking technologies. But improvements mean that Wi-Fi signals travel much farther than they did in the 1990s, so that people who merely walk past a store or look in a window may be picked up by internal tracking systems. More worryingly, because most Wi-Fi devices broadcast a list of known networks, a monitoring system could, in theory, collect the list and match it against databases of known Wi-Fi networks, which are used as a rough and ready alternative to satellite positioning in built-up areas. Shoppers' stored list of connections could thus reveal where they live or work, and possibly their identities. (Euclid says its system does not gather lists of network names, only device IDs, which are then anonymised.) Google faced worldwide scrutiny from regulators, and had to pay fines, after it emerged that its Streetview mapping vehicles had collected massive amounts of data broadcast publicly by Wi-Fi networks, computers and mobiles in many countries. Accordingly, Wi-Fi tracking firms now seem to be trying to get ahead of regulators. The day after the New York Times story appeared, Euclid and other firms announced a plan to partner with the Future of Privacy Forum to set rules about Wi-Fi tracking. In the meantime, if you are worried, there are two absolutely effective ways to prevent such tracking: turn off Wi-Fi and Bluetooth on your phone and laptop when out and about, or turn the devices off altogether.

Correction: This post originally stated that Nordstrom does not pay its staff commission, which was incorrect. The text has also been amended to make it clear that Euclid's tracking system does not gather the network names broadcast in probe requests. These changes were made on July 23rd.