The Ads are Watching: Digital Signage Needs Privacy Standards

Editor’s note: This is a guest post by Harley Geiger from the Center for Democracy & Technology (CDT), a non-profit public interest organization based in Washington, DC. CDT’s mission is to keep the Internet open, innovative, and free.

The digital signage industry has established a burgeoning offline version of the behavioral advertising that currently occurs online. Digital signage companies increasingly use facial recognition, RFID, Bluetooth, and other technologies to track consumers and tailor ads to their personal information. Several uses of these technologies have proven controversial, and some systems‚ such as one using license plate scanners, have been scrapped altogether due to privacy issues.

(What is digital signage? See my previous post, Ads with Eyes. Or, for a dramatization of digital signage gone wrong, watch the famous advertising scenes from the movie Minority Report.)

In the near future, digital signage will likely identify individuals on a widespread basis because it will be profitable to do so. Privacy controls are essential for the digital signage industry to preserve consumer trust. In a 2009 study, 90% of young adults rejected advertising based on information gathered about their offline activities. Unless the industry self-regulates, it is likely to face consumer backlash and reactive government regulation that may stifle this innovative communications medium. It will only take a few bad apples that flout consumer privacy expectations to spoil the image of the whole industry.

At present, however, the digital signage industry has no generally accepted set of privacy standards for these marketing methods. The absence of such guidance is all the more troubling as companies continue to build the infrastructure to support the pervasive use of tracking technologies combined with digital signage. Two recent examples:

• Japanese commuter train stations are currently in the midst of a pilot project trialing digital signage equipped with facial recognition‚ perhaps the largest networked system of its kind to date. The cameras record the age and gender of passing commuters, which marketers then use to model their advertising campaigns, but do not yet store any images of individuals.
• This past summer, a biometrics firm announced that it will blanket Leon, Mexico, with iris scanners over the next three years. The system will record the individual identities of the city‚ 1.2 million citizens and create a database of irises for public safety and commercial purposes. A senior company representative specifically discussed digital signage marketing as an application for this system. The citizens of Leon must opt in to participate, but the company warns: “Opting out puts more of a flag on you than just being part of the system.”

To encourage self-regulation in the industry, the Center for Democracy & Technology (CDT) recently issued a set of model guidelines for digital signage privacy. CDT guidelines encourage digital signage companies to be transparent about their use of identification technologies and give consumers choices about how they are marketed to. CDT guidelines include recommendations that digital signage companies

• Publish privacy policies describing what consumer data is collected, how long it is retained, and with whom it is shared;
• Give consumers clear notice of digital signage units that collect consumer data at each physical location in which the units operate. There should be no hidden receivers, cameras, or sensors used exclusively for marketing;
• Refrain from using digital signage units to collect information linked to individual identity or an individual property (such as a mobile phone or license plate) without the consumer’s explicit permission.

Digital signage companies have the opportunity to enter a new era of responsible, consumer-friendly interactive marketing, but only by incorporating strong privacy standards into their business models. The future of digital signage clearly includes greater adoption of identification and surveillance capabilities, not less. The only real question is the extent to which the industry will rise to the ethical challenge of protecting consumer privacy and maintaining public trust.