Your e-commerce company probably has a privacy policy (if it doesn't, then it should). But is anyone checking to see that the company follows the policy? Companies that don't follow their own privacy policies can get into legal hot water pretty quickly. That's what happened to a New York-based tracking service. 

Nomi Technologies provides mobile-based tracking services to retailers. The company places sensors in its clients' stores, and those sensors track customer traffic patterns by analyzing customers' mobile phone signals. Nomi uses the customer data to report to its clients on the percentage of consumers passing by the store versus those entering the store, the average length of time the consumer spends in the store, the percentage of repeat customers, and the number of customers who also visited another client store location.

Nomi's privacy policy says it always allows consumers to opt out of Nomi's service on its website as well as at any retail store that uses Nomi's tracking service. However, Nomi did not offer an opt-out mechanism in the retail stores using its technology, and did not require its clients to give consumers notice they were being tracked. The FTC alleged that these misrepresentations were a violation of the FTC Act, and, after an investigation, the company agreed to settle the charges. Under the proposed consent order, Nomi agreed to cease misrepresenting the options by which consumers can exercise control over their data. Nomi also agreed to cease misrepresenting the notice consumers will receive about how data from or about them, or their devices, is collected and used. The order will remain in effect for at least 20 years.

The lesson here is simple: your privacy policy must accurately reflect how your company behaves. Set a calendar reminder for your company every year to review your privacy policy to make sure that all privacy choices articulated in the policy are, in fact, available to consumers.

www.fkks.com

This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.