Mon Jan 1, 0001

Bluetooth, WiFi, and Retail Location Tracking

WiFi Probe Request Tracking

Phones broadcast WiFi probe requests containing MAC addresses when scanning for networks. Retailers exploited this for foot traffic analytics.

Key Companies

  • Euclid Analytics (founded 2010, acquired by WeWork 2019)
  • RetailNext (founded 2007)
  • Placed (acquired by Snap Inc. 2017)
  • InMarket (founded 2010, merged with NinthDecimal 2021)

Data Collected

Device MAC addresses, dwell time per zone, walking path through store, repeat visit frequency, cross-store movement patterns.

Nordstrom (2013)

Tested Euclid Analytics WiFi tracking across 17 stores. Customer backlash after Dallas Morning News report (May 2013). Nordstrom ended program.

MAC Randomization

  • Apple: introduced in iOS 8 (2014)
  • Android: introduced in Android 8.0 Oreo (2017), full enforcement in Android 10 (2019)
  • Effectiveness partial: devices reveal true MAC upon connecting to network. Vanhoef et al. (2016) showed randomization defeated through timing and sequence number analysis.

Bluetooth Low Energy (BLE) Beacons

Apple iBeacon (launched 2013), Google Eddystone (2015). Enable sub-meter indoor positioning. Retailers trigger push notifications and track in-store location when paired with apps containing location SDKs.

Location-Based Retargeting

Ad SDKs in apps (weather, games, utilities) harvest GPS coordinates, sold to data brokers. Companies: X-Mode Social (now Outlogic), SafeGraph, Cuebiq. Collected from hundreds of apps.

“Geofencing”: user entering competitor’s store triggers retargeted ads. Placed/Snap and InMarket offered “attribution” products connecting store visits to digital ad exposure.

FTC took action against X-Mode in January 2024 for selling sensitive location data.

Sources

  • Dallas Morning News (May 2013) on Nordstrom
  • Vanhoef et al. (2016) on MAC randomization weaknesses
  • FTC v. X-Mode/Outlogic (January 2024)