What Are Bluetooth Beacons, and Why Are They Following You?

(Thinkstock)

Just when we thought it was safe to take off our tinfoil hats, we learn that sensors hiding inside New York City telephone booths are secretly tracking us, according to an exclusive report by BuzzFeed.

It seems that an outdoor advertising company, Titan, had deployed Bluetooth beacons inside phone booths that would broadcast their location to passing smartphones, which would then report your location data back.

It was Mad Men meets Minority Report. Alarms were sounded, castle gates were lowered, and the paranoia threat level was raised to orange. After a hullabaloo, the city ordered Titan to remove the beacons.

Unfortunately for BuzzFeed and all the publications that carried its report, the truth was far less exciting. Bluetooth beacons can’t track you any more than stop signs or traffic lights can track you. (The apps on your phone, however, are another story.)

The fact is, there are thousands of Bluetooth beacons in the wild, including many in your favorite technology retail stores, museums, and baseball stadiums. And there will be tens of thousands more coming online in the next few years.

Here’s the 411 on how they work and what they really do.

What is a Bluetooth beacon?
A beacon is usually a small, battery-powered transmitter, such as the Gimbal Proximity Beacon or the Estimote Beacon, that broadcasts via a Bluetooth low energy antenna.

(Estimote)

It’s like a radio station that plays only one song, over and over, but instead of music the beacon sends out a unique ID number that can be read by an app on your phone. That app, in turn, can look up the location of that particular beacon and deliver information to you based on where you are.

Can a beacon read my contacts and text messages?
No. This is strictly a one-way conversation; a beacon can talk to an app on your phone, but your phone can’t talk to the beacon. And without the right apps installed, a beacon can’t talk to your phone at all.

Where can I find these things?
You can start with the Apple Store. iBeacon technology helps customers find their way to the Genius Bar in more than 250 Apple outlets across the country and works with the Apple Store app when you’re in a store. Twenty of the 30 Major League Baseball parks have installed beacons to guide fans to their seats, provide “bonus” content, and hawk team merchandise. As Virgin Atlantic passengers approach the gate at London’s Heathrow Airport, beacons trigger their smartphones to automatically display their boarding passes. Museums on both coasts have deployed beacons to beam information about exhibits to patrons’ phones, as have film and tech festivals. 

In fact, the beacons BuzzFeed uncovered were used briefly in an experiment with the Tribeca Film Festival last April. Titan installed the beacons in its booths, which triggered nearby smartphones using the festival’s app to display offers, film trailers, and surveys. The idea was to see how well the technology worked in dense urban areas, says Titan’s chief strategy officer, Dave Etherington. He adds that they are still compiling the results.

(WikiBeacon)

But the vast majority of beacons have been deployed with far less fanfare in retail outlets. Radius Networks’ WikiBeacon site has mapped approximately 10,000 beacons discovered by its beacon locator apps around the world. ABI Research predicts that more than 30,000 Bluetooth beacons will be installed inside public venues by year-end.

It’s Bluetooth. Don’t I have to pair my phone first?
No, you do not. Any device that uses Bluetooth 4.0 (also called Bluetooth Smart) and has the right apps installed can automatically detect a beacon. That includes every iPhone starting with the 4s and popular Android handsets such as some of the newer Samsung Galaxy devices, the Google Nexus 5, and the Moto X.

But I have to launch the app first, right?
You have to have an app, but you don’t necessarily have to run it. An app can be configured to “listen” for a signal from particular beacons even when the app or phone is not in use. But you will need to have installed the app, agreed to having your location data collected, and have Bluetooth turned on. Depending on the device, you may also be alerted when a beacon is found.

(Apple)

So these things only work up close?
Depends what you mean by “close.” Your phone can detect a beacon from up to 50 meters away, or about as far as Peyton Manning can throw a football. It can then infer your approximate location by measuring how strong the Bluetooth signal is. If there are three beacons within range, they can triangulate your location more accurately than any GPS system — and they can do it indoors. 

So there’s nothing to worry about?
Beacons themselves are just passive location markers, but the apps that use them can collect a trove of information about where you go and what you do. Phone apps already collect a vast amount of location data using cell towers, GPS, and WiFi mapping; Bluetooth beacons will theoretically allow them to pinpoint your location to within a few inches, indoors as well as out.

What are apps doing with this information?
That’s the $64 trillion question. And the answer is that app companies can do pretty much anything they want with your data, so long as they disclose what they’re doing in their privacy policies. (You know, those impossibly long, largely impenetrable legal documents you never read?) And, of course, the policies can change at any time.

(Thinkstock)

So an app can theoretically know if you visited an AIDS clinic or an adult video store, whether you frequent a mosque or a temple, and how often you attend a 12-step group meeting or visit a cannabis dispensary, based on the location of a beacon or your GPS coordinates. And the app maker can store that data for as long as it wants, use it for other purposes, sell it, or surrender it to legal authorities when presented with the proper paperwork.

Mostly, though, app makers will share it with advertising networks so they can serve ads for local businesses.

Is that legal?
One hundred percent, though that may change slightly. In March, Sen. Al Franken (D-Minn.) introduced the Location Privacy Protection Act of 2014, designed to limit the kinds of location data apps collect and to require your consent before collecting or sharing that information. It’s currently in committee.

What apps are using them?
The most common beacon-flavored apps you’ll find in the iTunes and Play stores are those used to map or manage them, like Beacon Scavenger Hunt or Estimod. Otherwise, only a few have been publicly announced: the Apple Stores app, “Star Trek: Into Darkness,” Major League Baseball’s “At the Ballpark,” and a handful of others.

How can I tell these apps to go sod off?
The easiest way may be to turn off Bluetooth detection in the app itself, says Gimbal Chief Operating Officer Kevin Hunter. But you can also turn off beacon detection at the operating system level. 

In Apple iOS 7 and later, you can turn off location services app by app. Go to Settings, select Privacy, and then Location Services. Scroll down until you find the app you want to manage, and then change Always to Never. This turns off all location sensing for the app, not just iBeacons. In iOS 8, Apple will prompt you when an app requests location information and let you decide if you want to share it.

(Apple iPad)

In Android 4.4, you’re notified at install when an app wants to collect location data or use Bluetooth services, but your controls are more limited. One way is to turn off Bluetooth, which unfortunately also disables headsets, fitness trackers, or any other devices that connect to your phone via Bluetooth. Go inside the Settings app, tap Bluetooth, and turn the slider to Off.

Fantastic. Are there other wireless tracking devices out there I don’t know about?
You betcha. Many retailers are also experimenting with Mobile Location Analytics devices, which do collect information from your phone, typically its unique Bluetooth or WiFi signatures. They do this to figure out where customers are going in their stores, how long they have to wait in checkout lines, whether changing the window display gets more people to walk in the door, and so on.

The major mobile analytics companies follow a code of conduct that requires them to notify shoppers that their mobile devices are being scanned, anonymize the hardware signatures, report only aggregate numbers to stores (not data about individual shoppers), use the data only to analyze shopping patterns, purge the information after a short period of time, and give customers the chance to remove their devices from the database.

If a vendor fails to live up to these standards, it could be subject to sanctions from the FTC, state attorney general, or local consumer affairs agency, says Jules Polonetsky, executive director of the Future of Privacy Forum.

OK, how do I stop that kind of tracking?
The Future of Privacy Forum operates a site where you can opt out of mobile analytics tracking by entering your devices’ MAC addresses. (You can find the MAC address on iOS 8 devices under Settings → About. On Android 4.4, it’s under Settings → About Phone → Status.)

(Future of Privacy Forum)

However, this applies only to companies that have agreed to follow the code of conduct and participate in the FPF’s Smart Stores project, and it does nothing to opt you out of Bluetooth beacons. For that, you have to change the location or Bluetooth settings on your device.

So should I be worried or not?
Beacons themselves aren’t a huge threat to your privacy. But you should be cautious when deciding to install apps that collect your location information. Unfortunately, what data these apps collect, how long they keep it, and what happens to it is largely a mystery. Privacy advocates and companies like Intel have called for more transparency in how this data is collected and used, but so far consumers have been left in the dark.

The surest safeguard against unwanted tracking may be consumers themselves, Polonetsky says. Retailers are still wary about bombarding shoppers’ smartphones with ads and offers when they walk by, fearing that they’ll simply turn them off.

“The best protection is an annoyed consumer with an itchy thumb who can flip the off switch,” he says.

Questions, complaints, kudos? Email Dan Tynan at ModFamily1@yahoo.com.