Extensive Location Privacy Protections Threatening Retail Technological Breakthroughs
In a significant move, Governor Jared Polis (D-CO) signed the Colorado Privacy Act (CPA) into law in July, joining California and Virginia as the third state to create a new law regulating the collection and use of personal data. This development has far-reaching implications for the retail industry, particularly in the realm of geolocation data.
The CPA treats geolocation data as personal information, subjecting it to restrictions on processing without consumer consent, mirroring other state laws that mandate notice and allow consumers to opt out of tracking. This means retailers must obtain explicit, informed consent from consumers before collecting geolocation data, with clear, separate privacy notices explaining the purpose and usage.
Retailers have been leveraging geolocation data to enhance the shopping experience. For instance, Target and Macy's use Bluetooth beacons to guide shoppers around the store as they collect items on their shopping list, and to provide hyper-localized services in real time. However, the CPA's emphasis on consumer privacy rights like informed consent, transparency, and control, limits how retailers can track or use customers' precise location data without explicit permission.
To maintain compliance while leveraging location insights responsibly, potential solutions include implementing data minimization and privacy-by-design principles, allowing consumers to opt out of location tracking, using privacy-enhancing technologies such as anonymization, pseudonymization, or aggregated location data, and regular auditing and compliance monitoring.
The interstate nature of online commerce means retailers cannot afford to ignore any state or its regulations in the course of business operations. The growing number of state privacy laws threatens to limit the use of geolocation data in retail, potentially impacting retailers' ability to deliver more relevant advertisements, improve their advertising and marketing, enhance consumers' shopping experience, and inform business decisions.
Congress can address this problem by enacting a comprehensive national privacy framework that preempts state laws, establishes basic consumer data rights, streamlines regulation, and minimizes the impact on innovation. Such a framework should create a tiered set of rules, allowing businesses to focus on providing consumers the strongest privacy protections where it matters while avoiding unnecessary compliance costs.
It's important to note that around 70 percent of consumers are willing to share their location data, and four out of five consumers report consulting their phones before making purchases in stores. This suggests that, when given the choice, many consumers are comfortable with sharing their location data, provided it is used responsibly and securely.
In conclusion, the Colorado Privacy Act constrains retail geolocation data use by enforcing consent, transparency, and security requirements, and retailers must adapt to these changes to maintain consumer trust while continuing to innovate in the retail space.
- As a result of the Colorado Privacy Act (CPA), geolocation data, treated as personal information, is now subject to regulations that require retailers to obtain explicit, informed consent from consumers before collecting it, with clear, separate privacy notices explaining the purpose and usage.
- Retailers should implement data minimization and privacy-by-design principles, allow consumers to opt out of location tracking, use privacy-enhancing technologies such as anonymization, pseudonymization, or aggregated location data, and regularly audit and monitor compliance to maintain compliance with the CPA while leveraging location insights responsibly.
- The growing number of state privacy laws could potentially impact the ability of retailers to utilize geolocation data, constrain the delivery of relevant advertisements, enhance advertising and marketing, improve consumers' shopping experience, and inform business decisions.
- Congress can address this issue by enacting a national privacy framework that preempts state laws, establishes basic consumer data rights, streamlines regulation, and minimizes the impact on innovation, creating a tiered set of rules that allows businesses to provide consumers the strongest privacy protections where it matters while avoiding unnecessary compliance costs.
- While the Colorado Privacy Act and similar state laws have implications for the collection and use of geolocation data in the retail industry, it's essential to remember that around 70 percent of consumers are willing to share their location data, provided it is used responsibly and securely.
