Quantcast StorefrontBacktalk » Blog Archive » Tip-Toeing Around Recall Notifications In A Privacy-Wary World
advertisement
advertisement

Tip-Toeing Around Recall Notifications In A Privacy-Wary World

Written by Fred J. Aun
December 9th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Beyond the ever-present convenience advantage, Mobile Commerce execs struggle to find reasons for consumers to actually make purchases from their phones, rather than merely research such purchases. One new iPhone shopping list app makes a valiant attempt by flagging government recalls associated with the intended purchase. Such data would typically not be known to that consumer if the purchase had instead been consummated on a Web site or in the physical store.

Still, the Shopper app, published by ReachEverywhere, suffers a variety of odd restrictions, such as limiting the recall data to two food-oriented agencies—the U.S. Food and Drug Administration (FDA) and the U.S.. Department of Agriculture (USDA)—while excluding recall-friendly agencies that would impact far more products, such as the U.S. Consumer Product Safety Commission (CPSC). It also only flags recall problems when the purchase is being made. So a customer who buys a product that gets recalled an hour after the purchase is completed will, by design, not be notified. (In theory, historical notification might have been an even more compelling feature.)

The vendor said adding other recall notifications is definitely planned for unspecified future versions. “Plans are to eventually have more agency input. But as the app works now, it is mainly geared toward food/consumables, so we stuck with those ratings,” said Adam Smith of ReachEverywhere. “But yes, as we expand the usage scenarios, bringing in things like baby crib recalls becomes very viable, especially when we go live with a gift list function.”

The historical alerts, however, were deliberately avoided, Smith said, because of perceived privacy concerns. “Yes, we can alert to past purchased items, but are staying away from it initially because of privacy concerns,” he said. “People aren’t too keen on you keeping track of what they are shopping for, from what we can tell thus far.”

That argument is similar to the one posited by Macy’s when pressed by Los Angeles authorities to reveal the names of customers who bought children’s jewelry tainted with dangerous lead: “Macy’s promises its customers to keep their personal information confidential except in certain limited circumstances,” said the retailer in a legal filing as it fought the city district attorney’s attempt to secure the names of those who bought the jewelry. “Macy’s customers therefore have a reasonable expectation that any identifying information collected and retained by Macy’s as a result of their purchases will be kept confidential and not disclosed unless Macy’s is compelled to do so by proper legal process.”

We’re not so sure this argument makes a lot of sense. Was Macy’s suggesting that a mother would be irritated and feel that her privacy was violated if the retailer called her and said the necklace her daughter is playing with is poisonous? Don’t you think gratitude might play a more prominent role? (OK, after the pediatrician, her next call might be to a lawyer, which is what Macy’s was truly concerned about. Whatever the reason, concern for the health of its customers and customers’ children was certainly not present.)

Is ReachEverywhere making the same argument? Call us crazy, but we’d like to be told that the box of crackers we put on our iPhone shopping list last month has now been found to be tainted. We might still have it in our pantry.

The Shopper app uses proprietary keyword matching to integrate real-time FDA/USDA recall information and issue warnings when users place recalled items on their interactive shopping lists. The vendor has put together an impressive list of retailers that are cooperating and helping the core functionality of the app, which is a mobile shopping list. Among the initial retailers publicly saying they’re integrating with the app are Target, Meijer, Babies”R”Us, Best Buy, Bloomingdales, CVS, Dick’s Sporting Goods, Dollar General, J.C. Penney, Kmart, Lowe’s, Macy’s, Office Depot, Office Max, Sears, Staples, Home Depot, Toys”R”Us, Walgreens, Ace Hardware, ABC Warehouse, AJ’s Fine Foods, Advance Auto Parts, Albertson’s, Bashas Supermarkets, Dillard’s, Food City, Giant Food, Gander Mountain, Jo-Ann Stores, Kohl’s, Marsh Supermarkets, Michaels, Nordstrom, O’Reilly Autoparts, Payless Shoes, PEP Boys, PETCO, PetSmart, Publix, RadioShack, Raley’s, Ritz Camera, Save Rite, Shaw’s Supermarkets, ShopKo, Sports Authority, Stop & Shop, Bon-Ton Stores, Tractor Supply, Winn Dixie and CompUSA.

The app’s recall integration seems to work well enough. When we placed “ground beef” on our list, the iPhone issued a small alert about a current ground beef recall.

This whole discussion also brings to mind the issue of retailer use of CRM data to reach out and warn customers. As Costco and (unfortunately only a handful of) others have demonstrated, it’s easy for retailers to use loyalty card-based purchase records to send E-mails or automated phone calls to customers who, according to CRM records, purchased products that are later found to be somehow dangerous. However, too many merchants are afraid that issuing those warnings to loyalty cardholders will make them realize just how close modern, technology-driven retailing has come to being Big Brother.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...