Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Retail stores use Bluetooth beacons to track customers

nytimes.com

Post reply on HN
Print view View original

241–250 of 257 posts

Re: Retail stores use Bluetooth beacons to track customers

#241

Post by brlewis »

dpkonofa wrote: post #229
brlewis wrote: post #215

Earlier quoted context omitted.

Fitbit is a good example of an app that requires permanent Bluetooth access, but a terrible example of a company likely to sell user data. Fitbit's users are its customers, and are the source of $1.5 billion per year in revenue. Any money gained from selling that data would be miniscule in comparison, and would put the main revenue stream at risk by alienating customers. I work for but don't speak for Fitbit.

It's not Fitbit that necessarily is collecting this data, though. Fitbit might simply be using an SDK for Bluetooth detection, for example, that's provided by a company that does sell user data. The number of paid platforms and frameworks that are out there and used by all kinds of companies is crazy and it's not too big of a stretch to realize that some kind of tracking framework runs on the business of aggregating…

Fitbit has its own Bluetooth stack.

Re: Retail stores use Bluetooth beacons to track customers

#242

Post by nerdponx »

Spooky23 wrote: post #103
_b8r0 wrote: post #54

Earlier quoted context omitted.

If this is rage inducing, you're going to lose your mind when you find out what companies have been doing with tracking phone location via GSM.

I saw a thing 10-15 years ago with a business associate building retail. He had average income for everyone driving by, some profession data, all sources from mobile carriers.

What's funny about all this data collection is, does it really help sales all that much?

Re: Retail stores use Bluetooth beacons to track customers

#243

Post by ourlordcaffeine »

jsemrau wrote: post #201
fingerlocks wrote: post #161

Earlier quoted context omitted.

Maybe I’m one of these people. What exactly are the consequences? So far, the most damaging consequence of overreaching customer privacy is the famous teenage pregnancy leak when Target sent out coupon mailers to expecting moms based on shopping history. That’s a really weirdly specific issue, and hard to imaging a similar scenario that would affect my life in some equally horrible way. Am I missing something? Why sh…

I work in credit scoring and you should be afraid of what you will not be eligible / priced systematically for in the future. What will employers find when they use this for background checks? If you regularly buy alcohol a drinks_alcohol flag could be set or a health_indicator could increase.

I feel like this could also be used in the hiring process to discriminate against women who are pregnant or are trying for a baby

Re: Retail stores use Bluetooth beacons to track customers

#244

Post by MilaM »

gruez wrote: post #230
jschwartzi wrote: post #211

Earlier quoted context omitted.

It's very much encoded in the track data. It may not be in clear-text by the time it leaves the reader but it's encoded in the data.

Do you mind linking to a source? Wikipedia has details on it, but it doesn't say anything about names. https://en.wikipedia.org/wiki/Magnetic_stripe_card#Financial...

It's also part of the EMV Specification and can be read with any nfc or smart-card capable reader. You don't need a special payment terminal.

https://www.emvlab.org/emvtags/show/t5F20/

There is one store in my neigbourhod where the payment terminals show this field (my full name) on the screen during checkout. I was very surprised when I noticed this the first time.

But apparrently not all card issuers fill the field with correct data. One card, a prepaid Visa from a big fintech, has "N/A" programmed in the field.

Re: Retail stores use Bluetooth beacons to track customers

#245

Post by dpkonofa »

brlewis wrote: post #241
dpkonofa wrote: post #229

Earlier quoted context omitted.

It's not Fitbit that necessarily is collecting this data, though. Fitbit might simply be using an SDK for Bluetooth detection, for example, that's provided by a company that does sell user data. The number of paid platforms and frameworks that are out there and used by all kinds of companies is crazy and it's not too big of a stretch to realize that some kind of tracking framework runs on the business of aggregating…

Fitbit has its own Bluetooth stack.

That doesn't change the fact that they could be using another framework or library that has code to access Bluetooth. As long as the app has been granted access, the framework would have access too.

Re: Retail stores use Bluetooth beacons to track customers

#246

Post by clairity »

graeme wrote: post #185
clairity wrote: post #100

Earlier quoted context omitted.

i believe on iphones, the fake off-switch for bluetooth disconnects the devices you actually want connected (airpods, watch), while not being completely off for everything else, like beacons. instead, it should only maintain bluetooth connections to devices already connected (or better yet, trusted), while being invisible to everything else. i know with bluetooth this is technically difficult, if not impossible, but…

It keeps the watch, pencil and airpods connected. Disconnects my third party keyboard. Unsure how it works in the mall scenario. Anyone know? Occurs to me I could shut wifi fully off when leaving home, and turn bluetooth off with the toggle to still use my devices. Don’t know if that’s useful however. Used to use airplane mode all the time, but modern convenience became too great.

hmmm, are you sure these things stay connected? i just tried with those 3 items and none stayed connected when i fake turned-off bluetooth on my iphone/ipad.

or maybe it's a feature of the newer devices? my apple devices are older and have bluetooth 4.2 still.

Re: Retail stores use Bluetooth beacons to track customers

#247

Post by prirun »

bfdm wrote: post #232
Spooky23 wrote: post #219

Earlier quoted context omitted.

Yes, you are. The events surrounding what happened to my wife was very painful (an ectopic pregnancy that nearly killed her), and a thoughtless reminder was very unwelcome. I still feel violated and betrayed. In our case, I found out the marketing list from Enfamil and bought it for my zip code. I complained to the hospitals’ privacy officer and the state regulator and found that everything was legal. There is a lot…

That's really awful. I hope you both are doing better gradually. How the hell was trading individually identifiable hospital admittance and treatment information not a HIPAA violation?

It's not a HIPPA violation because they give the information to one of their "partners", and you agree to this in all the crap that gets signed.

I went to a Norton Hospital Immediate Care Center and paid cash because I didn't have insurance at the time. Because I paid cash, Norton turned all of my contact information over to a company that sells health insurance and gives loans to pay for medical services. They bugged the everlovin' shit out of me with automated phone calls until I decided enough is enough.

The Immediate Care Center denied giving any information out and were shocked this was happening, but Norton central billing knew about it, said they would remove me, but the 3rd party already had my info so it was too late.

The 3rd party were complete assholes, and when I got fired up because I wouldn't give them even MORE personal info to be removed from their call list, they said it was my fault: if I had just called them back and given them the 15-digit code, an agent would have removed me. That's also a lie, because I eventually did try that.

To protect my privacy, I told Norton my phone number had changed, and my new number was 812-555-1212, which is the 812 area code directory assistance number.

They did the same thing to my sister when she paid with cash because her husband had just changed jobs and she didn't have the new insurance info yet.

HIPPA is a joke.

Re: Retail stores use Bluetooth beacons to track customers

#248

Post by prirun »

peteretep wrote: post #203
jsemrau wrote: post #201

Earlier quoted context omitted.

I work in credit scoring and you should be afraid of what you will not be eligible / priced systematically for in the future. What will employers find when they use this for background checks? If you regularly buy alcohol a drinks_alcohol flag could be set or a health_indicator could increase.

This feels like it should be better dealt with via legislation. Already sounds like health data, which is legislated to high-heaven in the US, and also sounds like the juiciest ever GDPR suit waiting to happen in the EU.

Health data may be legislated to high heaven, but it's easy to get around: they can give it to "partners", in other words, anyone they want.

Re: Retail stores use Bluetooth beacons to track customers

#249

Post by dragonwriter »

Spooky23 wrote: post #219
remarkEon wrote: post #216

Earlier quoted context omitted.

If what you are saying is true (I'm genuinely asking), that sounds like behavior that should absolutely be made illegal and severely punished. I try to maintain a "lite" internet footprint (no facebook, only social media is LinkedIn, I use a VPN when I can) ... it's a little disturbing to think that someone can just purchase my buying history and use it as, essentially, an attack vector to serve me ads or gaslight me…

Yes, you are. The events surrounding what happened to my wife was very painful (an ectopic pregnancy that nearly killed her), and a thoughtless reminder was very unwelcome. I still feel violated and betrayed. In our case, I found out the marketing list from Enfamil and bought it for my zip code. I complained to the hospitals’ privacy officer and the state regulator and found that everything was legal. There is a lot…

> I complained to the hospitals’ privacy officer and the state regulator and found that everything was legal.

Both of those are the wrong venue for complaint on this issue; the hospital privacy officer exist to protect the hospital from liability and will never confirm to an outside party, especially a complaining party, that an act is a violation of the hospital’s legal duty, and the state regulator isn't responsible for enforcing federal law.

The right place for complaint is the federal Department of Health and Human Services Office or Civil Rights, which is actually responsible for enforcing the privacy provisions of HIPAA. Or getting your own attorney.

Re: Retail stores use Bluetooth beacons to track customers

#250

Post by [deleted] »

gruez wrote: post #209
jonahhorowitz wrote: post #130

Earlier quoted context omitted.

And when you swipe your card to check out they have your name, even if you don't use a loyalty card. Name + Face, along with some bluetooth tracking data. They can now track you forever, even if you delete the app, stop using your credit cards, etc.

>And when you swipe your card to check out they have your name, even if you don't use a loyalty card I thought the name’s embossed on the card, but not on the magstripe/EMV chip data?

[deleted]
Post reply on HN