This App Tracks You While You Shop

What's to come?
Jan. 28 2014 8:01 AM

Track Star

This app follows you while you shop—and it needs a clearer privacy policy.

(Continued from Page 1)
140127_FUT_Shopkick

In other words, knowing exactly who you are is important to Shopkick’s honchos, and they will seek that information out.

Once Shopkick has your data, what does it do with it? More importantly, who does it share it with? Shopkick’s policy says, “We may also share this Non-Personally Identifiable Information with our Affiliated Partners.” It’s not clear what an
“Affiliated Partner” is, though.

Does the privacy policy tell us enough to make an informed decision about whether to use the app and hand over our data? Not really. It is vague and misleading (and also typical) on several important points.

Advertisement

First, it is hard to tell what data is being collected. Even though Shopkick’s privacy policy provides an extensive list of data it collects, a lot is left unsaid. For example, does Shopkick access your microphone and listen in any time it’s open? Is it monitoring what you say about a product when you look at it or try it on? Does it record that audio? Is that ever shared?

I reached out to Shopkick and a representative told me that, while the microphone is on when you have the app open, it does not listen to human voices. She explained the TV commercial initiative was old and that the microphone is currently used only to decode inaudible audio signals that are part of its in-store communication setup. The fact that it doesn’t listen to you talk is good, but the language of the privacy policy seems that it would cover audio eavesdropping. The fact that there is ambiguity about what Shopkick does and what it could do in the future is both problematic and common among privacy policies.

Second, when an app or website shares or sells your data, that data enters the hands of another company whose privacy policies we don't know. Those third parties might be stores that can make us useful offers based on our data. But what if the third party tells insurance companies how much time you spend shopping in your local tobacco shop, liquor store, or marijuana dispensary? Since there are no clear restrictions on the companies that receive our data, we are left to wonder how they use it.

Finally, most privacy policies are extremely misleading about “non-personally identifiable information.” Bits of data that feel anonymous are anything but when taken together. The Electronic Frontier Foundation provides an excellent overview of academic research that shows these traits can uniquely identify a vast majority of the U.S. population. For example, the combination of ZIP code, birthdate, and gender—all “non-personal information” that Shopkick and many other services collect—is unique for about 87 percent of U.S. residents. That means if an app has this data, it usually has enough that you can be individually identified.

The vast majority of companies creating these apps are not malicious. They are trying to provide a service that people find valuable, and there is nothing inherently wrong with profiting from that. Our data helps them provide these services to us, and it helps them make money.

Right now, users are deciding to share their data based on an analysis of the benefits. But that decision should come from an analysis of the risks, too. That requires transparent and informative privacy policies, but the state of privacy policies today is quite the opposite. They are opaque and misleading. Before granting companies access to such critical components of our lives, we should know exactly what they will collect and how well it will be protected. Without that knowledge, we are forced to operate entirely on trust.

This article is part of Future Tense, a collaboration among Arizona State University, the New America Foundation, and SlateFuture Tense explores the ways emerging technologies affect society, policy, and culture. To read more, visit the Future Tense blog and the Future Tense home page. You can also follow us on Twitter.

Jennifer Golbeck is director of the Human-Computer Interaction Lab and an associate professor at the University of Maryland.

TODAY IN SLATE

Justice Ginsburg’s Crucial Dissent in the Texas Voter ID Case

The Jarring Experience of Watching White Americans Speak Frankly About Race

How Facebook’s New Feature Could Come in Handy During a Disaster

The Most Ingenious Teaching Device Ever Invented

Sprawl, Decadence, and Environmental Ruin in Nevada

View From Chicago

You Should Be Able to Sell Your Kidney

Or at least trade it for something.

Space: The Next Generation

An All-Female Mission to Mars

As a NASA guinea pig, I verified that women would be cheaper to launch than men.

America’s Fears of Immigration, Terrorism, and Ebola Are Combining Into a Supercluster of Anxiety

The Legal Loophole That Allows Microsoft to Seize Assets and Shut Down Companies

  News & Politics
Jurisprudence
Oct. 19 2014 1:05 PM Dawn Patrol Justice Ruth Bader Ginsburg’s critically important 5 a.m. wake-up call on voting rights.
  Business
Business Insider
Oct. 19 2014 11:40 AM Pot-Infused Halloween Candy Is a Worry in Colorado
  Life
Outward
Oct. 17 2014 5:26 PM Judge Begrudgingly Strikes Down Wyoming’s Gay Marriage Ban
  Double X
The XX Factor
Oct. 17 2014 4:23 PM A Former FBI Agent On Why It’s So Hard to Prosecute Gamergate Trolls
  Slate Plus
Slate Picks
Oct. 17 2014 1:33 PM What Happened at Slate This Week?  Senior editor David Haglund shares what intrigued him at the magazine. 
  Arts
Behold
Oct. 19 2014 4:33 PM Building Family Relationships in and out of Juvenile Detention Centers
  Technology
Future Tense
Oct. 17 2014 6:05 PM There Is No Better Use For Drones Than Star Wars Reenactments
  Health & Science
Space: The Next Generation
Oct. 19 2014 11:45 PM An All-Female Mission to Mars As a NASA guinea pig, I verified that women would be cheaper to launch than men.
  Sports
Sports Nut
Oct. 16 2014 2:03 PM Oh What a Relief It Is How the rise of the bullpen has changed baseball.