A recent New York Times story by Charles Duhigg revealed that the retailer Target not only keeps track of what we purchase, but also uses that information to learn about us, and our major life experiences. Indeed, Target has developed a “pregnancy prediction” score to figure out when women are expecting a child—perhaps even before the women themselves have made that news public—and thus to market baby-related products and services to them.
While this practice may sound fairly harmless, in at least one case, a teenager’s father discovered that she was pregnant because she received Target coupons for baby items in the mail. The father had stormed into a Target store near Minneapolis to complain to the manager that his daughter was receiving coupons for cribs and baby clothes in the mail. As it turns out, however, Target had accurately predicted that his daughter was pregnant—and the father apologized.
In this column, I will discuss some of the perils that consumers face, with respect to the tracking of their buying habits and other consumer activity, and a set of recent proposals from the White House that seeks to address this issue. I argue that retailers should be more transparent about their practices, should disclose for what purposes they aggregate our data, and should realize that there are certain private areas where they probably should not venture.
Tracking Consumer Habits 101
Whenever we shop, online or offline, retailers compile information about us: what we buy, how much we spend, whether we seem to have kids in our household, what our brand preferences are, and so on. This information leads to our receiving instantly-printed coupons in the grocery-store checkout line that reflect our preferences as to, say, pasta or breakfast cereal. (Stores may either give you a discount on your favorite product, to make sure you keep buying it, or offer a discount on a competitor’s product to tempt you to try it next time.) Obviously, the store needs to know about your purchasing habits in order to be able to customize the coupons you receive. Similarly, Amazon and other websites customize the recommendations you receive, based on your prior purchase history. Online sellers also exchange information about you with their affiliates, or sell it to third parties such as advertisers.
Many consumers like this type of customization, as it provides recommendations, discounts, and coupons for products that the consumer tends to need or like. But opting out of all tracking is not easy—unless you shop only offline and pay for everything with cash, which is rare. And serious privacy issues may crop up due to certain instances of customization—such as the Target pregnancy-prediction software.
How Target’s Guest ID System Works
Like many other retailers, Target—which sells groceries and a vast array of consumer goods—has a very sophisticated data-collection process that assigns each shopper a unique Guest ID. Every time you buy detergent, clothing, or other items with your debit or credit card; visit Target’s website; or interact with Target in any other way, the new information that Target learns about you is connected to your Guest ID.
Target then works with statisticians and behavioral expects to try to determine which consumer-buying patterns serve as good predictors for future consumer behavior. Pregnancy prediction is surprisingly easy: In the first 20 weeks of pregnancy, women purchase lots of vitamin and mineral supplements such as calcium, magnesium and zinc. Once Target sees those purchases, it apparently assumes that the customer is pregnant and offers coupons accordingly.
Due to the Guest ID system, Target may know not only what a customer might want to buy, but also when he will likely want to buy it. Thus, if a customer comes in only on Saturdays, that might impact when a coupon is mailed. Target may also use the Guest ID data to choose which way it will approach a given customer: Is she most likely to respond to online ads, email specials, or mailers? Target tracks our purchases, as well as our habits, in order to predict our future behavior.
Systems Like Target’s May Reveal Major Life Changes and Other Very Personal Information
Major life disruptions—from moves, to separations and divorces, to health issues—can trigger changes in spending habits. Retailers know this, and they use the information to get us to buy more goods and services. Some consumers may be disturbed simply by the tracking itself, while others may only object to such tracking when a retailer’s mailing of fliers or coupons exposes information that they had wanted to keep secret – as in the case of the teenage girl whose pregnancy was revealed to her father. And of course, a person’s status may change. What if a woman miscarries in the first trimester only to receive coupons for baby products in the mail? Will Target know to stop sending coupons, or will it continue to market to her through her probable due date?
Are such tracking practices currently legal? The answer is likely “Yes.” Indeed, Target has issued a statement, in response to the New York Times piece, representing that it complies with all relevant federal and state privacy laws. Target also complies with its own privacy policy—which allows it to collect data to market to customers, and also allows it to share data with other affiliate companies so they can market to us too. What does this mean? Theoretically, Target could sell its pregnancy prediction score to other companies. Target is in compliance simply because its privacy policy informs consumers that it does, indeed, collect and share their data. But many consumers may want more protection than that. Accordingly, the White House is considering new measures relating to consumer privacy.
The White House’s Response: A Consumer Privacy Bill of Rights
This past week, the White House called for a new consumer privacy “Bill of Rights.” While the proposed Bill of Rights principles focus more heavily on Internet privacy, they apply to both the online and offline worlds. “American consumers can’t wait any longer for clear rules of the road that ensure their personal information is safe online,” said President Obama in a statement.
The document outlines seven rights that all consumers should have. The White House says it will work with Congress to pass legislation in these areas:
- Individual Control: Consumers have a right to exercise control over what personal data organizations collect from them and how they use it.
- Transparency: Consumers have a right to easily understandable information about privacy and security practices.
- Respect for Context: Consumers have a right to expect that organizations will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data.
- Security: Consumers have a right to expect their data will be stored and transmitted securely.
- Access and Accuracy: Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data are inaccurate.
- Focused Collection: Consumers have a right to reasonable limits on the personal data that companies collect and retain.
- Accountability: Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.
What the Enactment of a Consumer Privacy Bill of Rights Would Mean for Retailers
These new principles serve as good guideposts for retailers to follow. What, in particular, might they mean for retailers like Target?
First, retailers should give customers better choices about what data is collected and, more importantly, how such data is used for marketing.
Second, in accord with the idea that retailers must show “respect for context,” retailers should look to consumer expectations about how their data will be used, once it is collected. For example, consumers likely understand that Target and similar stores collect data on what groceries they buy, in order to market more groceries to them. But it is unlikely that Target consumers knew that the store was trying to predict when female customers would get pregnant, or discern when they already were pregnant. Similarly, customers might not have guessed that retailers were predicting or discerning job loss; marriage; separation or divorce; or a critical illness.
In addition to a respect for context, businesses are meant to engage in “focused collection,” meaning that consumers have a right to “reasonable limits” on the data collected on them. In the case of Target, this might suggest that the company should not use an early ”pregnancy prediction” score but instead wait for consumers to start purchasing formula, diapers, and the like, before marketing baby products to them.
Consumers who are concerned about their privacy will have to wait and see how the vague language of the Consumer Privacy Bill of Rights will translate into specific, actionable rules. Interestingly, if Congress does not act in this area, the Obama Administration has indicated that it may bypass Congress altogether to create its own enforcement regime. The Administration’s position is that “even without legislation, the administration will convene multistakeholder processes that use these rights as a template for codes of conduct that are enforceable by the Federal Trade Commission.”
What Consumers Can Do To Protect Their Privacy Right Now
Meanwhile, while we wait for possible Congressional legislation, FTC action, or industry self-regulation in this area, there are online tools that allow consumers to opt out of data collection and online tracking. However, an October 2011 Carnegie Mellon University study found that tools meant to limit online behavioral advertising were either ineffective, or too confusing for most consumers to use effectively. That included browser do-not-track tools, third-party blocking tools, and tools allowing consumers an opt-out from several online-advertising networks.
Consumers can also safeguard their information by only visiting websites that respect their privacy. A new site allows users to identify such sites. If you enter a site’s URL into privacyscore.com, it will rate the site from zero to 100, based on the number of trackers on every page of the site. The site has listed the three worst offenders so far: merriam-webster.com, tvguide.com and nypost.com. (Target.com, by the way, has a middling privacy score of 49.)
Following the White House announcement, the Digital Advertising Alliance—an umbrella group of seven trade associations representing the online-marketing industry—said that it is beginning to develop tools that enable consumers using web-browser software to make their privacy preferences easily known. The program is expected to be ready in nine months. Google also announced that it would create a Do Not Track feature for its Chrome browser.
While much of this news is promising, the solutions’ focus on Internet browsing still leaves consumers vulnerable when they shop at brick-and-mortar stores. If you don’t want Target to market to you after it has collected your data, you can “opt out” by calling 1-800-440-0680. That won’t stop the company from collecting data about you, but it will stop it from sharing that data with affiliates, or sending you marketing materials. Still, unlike on the Internet, we will not have ready access to a “do not track” feature at the checkout – unless someone comes up with a great app that somehow allows us to do that. Let’s hope that this situation will soon change, for we all deserve to have our privacy protected, wherever we may choose to shop.