Retail stores use Bluetooth beacons to track customers

Yes that's exactly how this gets implemented in practice.

I did quite a bit of client work here too, specifically around using already existing surveillance camera networks to build user profiles.

At the end of the day the goal is to optimize for the intersection of "what the user wants" and "what we want to sell." So, a low collection system will give bad recommendations and a really good recommendation system will have an immense amount about the user.

Now that I talk with people on the other side of this, it's clear that most don't really care as long as they are getting good suggestions. I had this conversation just a few weeks ago with a young lady and her take was: "It's kind of creepy, but if it gives me good suggestions, I don't really care."

> Some random third-party app has to be running on your phone to detect beacons and send the data back

They don't have to be running. Here's my understanding (for iOS anyway):

1. Apps have the ability to subscribe to bluetooth callbacks from the OS, which is constantly scanning for them (about once a second, from memory). It will be something like, "wake me up when you detect that beacon with UUID ABCD123 is in range". ABCD123 would be the standard ID of a marketing company's beacons - there could be millions of them.

2. The beacon also have sub-IDs identifying the exact beacon being used. The marketing company will know which are where.

3. Whenever the beacon is in range, the OS pings the app with the data, which decides what to do with it in the same manner as a background data refresh. This could be something useful, like waking up to let you know your suitcase is nearby - but it could also be silently uploading that data to a server.

4. The software to do this is being bundled as a paid SDK in a great many seemingly-unrelated apps, such as weather apps.

5. This behaviour is not counted as location services in the OS, and may or may not be disabled even when bluetooth is "off" on the phone

Corrections welcome but I believe that's roughly what's going on.

I'd greatly appreciate something like Little Snitch on the iPhone so I could see which apps are doing this and delete them with extreme prejudice. Back in reality, I'm glad this is getting attention - at the very least Apple should be providing a list of apps requesting BT access, and indeed any network access over time.

You're on HN and "What's the difference" is really your question? 1. Friendly private human interaction shared by two people. 2. Data is collected, sent, analyzed, sold, shared, distributed, stolen, and abused in order to maximize profit across expansive markets at the expense of any respect for the user's privacy. The user is tracked, distracted, and tricked into obeying algorithmic market forces of massive and opaque breadth. Every piece of data ever accrued is collected and stored in order to create an invasive profile of a user's movements, decisions, actions, and relationships, so that predictive programming can be implemented in attempts to guess the state of the user's mind prior to the user coming to these conclusions, or at least to convince the user that this is what the user wants. The end goal is technology that effectively usurps the user's free will, so that the user is completely reliant upon it for basic decision-making. The goal is to destroy free will. A society in which every individual action is known by governments and corporations is not a healthy society. It is an electronic prison.

They have security cameras too. Correlate video with AP locations and you can probably figure out whos phone it. Tie that in with some facial recognition database and can really identify people.

Walmart has been adding cameras on high shrink isles that are almost eye level. At some point they might add even more cameras for "security" that are also used for eye tracking. Think of all the opportunities to optimize product and ad placement.

i believe on iphones, the fake off-switch for bluetooth disconnects the devices you actually want connected (airpods, watch), while not being completely off for everything else, like beacons.

instead, it should only maintain bluetooth connections to devices already connected (or better yet, trusted), while being invisible to everything else. i know with bluetooth this is technically difficult, if not impossible, but that would be the more customer-friendly implementation.