What Secrets Your Phone Is Sharing About You

(by Elizabeth Dwoskin, The Wall Street Journal) – Fan Zhang, the owner of Happy Child, a trendy Asian restaurant in downtown Toronto, knows that 170 of his customers went clubbing in November. He knows that 250 went to the gym that month, and that 216 came in from Yorkville, an upscale neighborhood.

And he gleans this information without his customers’ knowledge, or ever asking them a single question.

Turnstyle’s founder Chris Gilpin

Mr. Zhang is a client of Turnstyle Solutions, a year-old local company that has placed sensors in about 200 businesses within a 0.7 mile radius in downtown Toronto to track shoppers as they move in the city.

The sensors, each about the size of a deck of cards, follow signals emitted from Wi-Fi-enabled smartphones. That allows them to create portraits of roughly 2 million people’s habits as they have gone about their daily lives, traveling from yoga studios to restaurants, to coffee shops, sports stadiums, hotels, and nightclubs.

“Instead of offering a general promotion that may or may not hit a nerve, we can promote specifically to the customer’s taste,” says Mr. Zhang. He recently emblazoned workout tank-tops with his restaurant’s logo, based on the data about his customers’ gym visits.

Turnstyle is at the forefront of a movement to track consumers who are continuously broadcasting their location from phones. Other startups, such as San Francisco-based Euclid Analytics, use sensors to analyze foot-traffic patterns, largely within an individual retailer’s properties to glean insight about customer behavior.

Their success speaks to the growing value of location data. Verizon Wireless last year began crunching its own location information from customers to help retailers see which neighborhoods shoppers arrived from or limited information about their habits, such as restaurants they drive past. Apple recently released its iBeacon technology, which can be integrated into sensors to read customer’s smartphone signals in brick-and-mortar stores.

But Turnstyle is among the few that have begun using the technology more broadly to follow people where they live, work and shop. The company’s dense network of sensors can track any phone that has Wi-Fi turned on, enabling the company to build profiles of consumers lifestyles.

Turnstyle’s weekly reports to clients use aggregate [total; combined] numbers and don’t include people’s names. But the company does collect the names, ages, genders, and social media profiles of some people who log in with Facebook to a free Wi-Fi service that Turnstyle runs at local restaurants and coffee shops, including Happy Child. It uses that information, along with the wider foot traffic data, to come up with dozens of lifestyle categories, including yoga-goers, people who like theater, and hipsters.

A business that knows which sports team is most favored by its clients could offer special promotions on game days, says Turnstyle’s 27-year-old founder Chris Gilpin. Czehoski, a local restaurant, hired an ’80s-music DJ for Friday nights after learning from Turnstyle that more than 60% of the restaurant’s Wi-Fi-enabled customers were over 30.

But as the industry grows in prominence, location trackers are bound to ignite privacy concerns. A company could, for example, track people’s visits to specialist doctors or hospitals and sell that data to marketers.

“Locations have meanings,” says Eloise Gratton, a privacy lawyer. Marketers can infer that a person has a certain disease from their Internet searches. A geolocation company can actually see the person visiting the doctor, “making the inference that the individual has this disease probably even more accurate,” she says.

Mr. Glipin says his data doesn’t include doctors visits or sensitive health information, nor does he sell his profile data to marketers. He is considering offering more detailed profiles based on the logged-in information, an endeavor that would be legal in Canada as long as consumers provided consent.

“We know there is more value to be extracted from this data,” Mr. Gilpin says. “But we’re wanting to move cautiously and turn on the tap slowly – in a way that doesn’t offend customers.”

In the United States, companies don’t have to get a consent before collecting and sharing most personal information, including their location. A bill, proposed by Minnesota Senator Al Franken, would require consent before collecting location data. The U.S. Federal Trade Commission (FTC) settled its first location privacy case in December, against an app developer that misled consumers into believing their location data wouldn’t be sold to marketers.

Some customers have concerns. Aj Tin, a university student and customer at Rsquared Café, was surprised to learn that by logging into the Wi-Fi at the coffee shop, he was enabling Turnstyle to track his movements and offer other local businesses an aggregated [total; combined] profile of his activities. The disclosure form tells consumers they will be tracked, but not how aggregated personal information will be distributed. “Privacy is cheap,” Mr. Tin said.

Even as they covet the data, stores and businesses recognize it is a touchy subject. “It would probably be better not to use this tracking system at all if we had to let people know about it,” says Glenna Weddle, the owner of Rac Boutique, a women’s clothing store that is a Turnstyle client. “It’s not invasive. It might raise alarms for no reason.”

Viasense Inc., another Toronto startup, is building detailed dossiers [collection of documents] of people’s lifestyles by merging location data with those from other sources, including marketing firms. The company follows between 3 million and 6 million devices each day in a 250 mile radius surrounding Toronto. It buys bulk phone-signal data from Canada’s national cellphone carriers. Viasense’s algorithms then break those users into lifestyle categories based on their daily travels, which it says it can track down to the square meter.

For example, by monitoring how many times a consumer visits a golf course in a month, Viasense can classify her as a casual, intermediate or heavy golfer. People whose cellphones move at a certain clip across city parks between 5:30 and 8:30 every morning are flagged by the algorithm as “early morning joggers.” The company identifies “youth” by looking at phone signals coming from schools during school hours and nightclubs, and home locations by targeting the places phones spend each night.

Viasense, which says its clients are grocery chains, a large concert venue and a billboard company, then overlays that data with census and marketing lists the company buys from data brokers to deduce demographic information, like whether the cellphone’s owner is in a high-income bracket.

Viasense doesn’t gather personal information or know any of its users’ names, but CEO Mossab Basir says it is simple to figure this out. A person who has enabled location services on an app in which they upload information publicly, such as Twitter, is broadcasting their location and their identity – or at least their handle – at the same time. “People are probably unaware of how much they are making available,” says Mr. Basir. “That’s why it’s a very delicate subject for us. It’s kind of Big Brotheresque.”

A username is considered personal information, which under Canadian law can’t be collected without the consent of the user. In most of the United States, consent wouldn’t be required.

Right now, the only way to opt-out of geolocation* is to either switch off the Wi-Fi on a cellphone, or make a request through a website of one the data companies like Turnstyle that has an opt-out option.  [*Geolocation is the process or technique of identifying the geographical location of a person or device by means of digital information processed via the Internet.]

As these companies operate mostly behind the scenes, the nascent [new; recently developed] industry is keeping a close watch on Google Inc. and Apple. With their Android and iOS mobile operating systems, respectively, Google and Apple know the location of every customer’s Wi-Fi-enabled phone – far more location data than any startup could access. The Silicon Valley giants aren’t allowing access to such data by outsiders. Both Google and Apple declined to comment.

Places where people didn’t think they were being watched are now repositories for collecting information, says Ryan Calo, assistant professor at the University of Washington School of Law. “Companies are increasingly able to connect between our online and offline lives,” he says.

– David George-Cosh in Toronto contributed to this article.

Copyright 2014 Dow Jones & Company, Inc. All Rights Reserved. Originally published at WSJ Jan. 13, 2014. Reprinted here for educational purposes only. Visit the website at wsj .com.