How was my store visit inside a shopping mall tracked?

[TheMystic]

I was inside a shopping mall yesterday for a few hours. One of the shops/ store is an outlet of a well known electronics retail chain. I have purchased something there several months/ years back. I was inside this store yesterday too, but only briefly. I did NOT buy anything there yesterday.

When I returned home, I received an SMS from this Store thanking me for my visit.

How did this store's system know I was there?

Points to note:

1. I didn't make any transaction there yesterday.
2. I don't (never) connect my phone WiFi to outside networks. More importantly, my phone WiFi was OFF throughout my visit at the mall.

This is pretty creepy.

 

[Oswald Boelcke]

@TheMystic Pending on your settings, tracking via Bluetooth is also possible. And even if Wifi and/or Bluetooth are disabled, if you have the below shown settings enabled tracking is possible.

Spoiler

 

[TheMystic]

@TheMystic Pending on your settings, tracking via Bluetooth is also possible. And even if Wifi and/or Bluetooth are disabled, if you have the below shown settings enabled tracking is possible.

Spoiler

View attachment 5830757

Both of those were OFF.

Bluetooth was ON and connected to my watch. But I never connected my phone Bluetooth to any device in that Store.

 

[s3axel]

Scary indeed... do you have any app related to this retail chain installed and does this have location access ? How about Google location services ?

Else I'd also opt for some BT/Wifi-device tracking as indicated by @Oswald Boelcke ...

 

[TheMystic]

Scary indeed... do you have any app related to this retail chain installed and does this have location access ? How about Google location services ?

Else I'd also opt for some BT/Wifi-device tracking as indicated by @Oswald Boelcke ...

No, i don't have any related app on my phone.

Location was ON though.

Or was it my Watch WiFi (that wasn't explicitly OFF) that gave it away?

 

[Oswald Boelcke]

Both of those were OFF.

Bluetooth was ON and connected to my watch. But I never connected my phone Bluetooth to any device in that Store.

Maybe this article contains an explanation?

Google can still use Bluetooth to track your Android phone when Bluetooth is turned off

Google is disregarding the privacy settings of millions of Android phones.

qz.com

 

[TheMystic]

Maybe this article contains an explanation?

Google can still use Bluetooth to track your Android phone when Bluetooth is turned off

Google is disregarding the privacy settings of millions of Android phones.

qz.com

Thank you for this link.

This sort of tracking is indeed an invasion of privacy, and I'm pretty sure most users are unaware of this, and will never consent to such accurate tracking of their whereabouts.

This store in question may have installed Bluetooth tracking beacons to track their customers. Google is providing them with the required information so they can advertise their products in a timely manner. This is part of Google's ad business.

I guess that if I spent sometime in the TV section, I can expect to see TV ads on my Google feed and elsewhere. Google has successfully tracked not only the store where i was, but right down to the section where I spent time, and for how long. This information is linked to my Google account, and hence I see related ads in various places.

Now here is the scary part:

How did the store link my device with my phone number? This is unacceptable invasion of privacy.

I have purchased from this Store several months back, and i have given my phone number to them at the time of transaction. But how did they link my phone (Bluetooth information) with my number?

On my Google account, I have set my phone number to be used only for account security purposes. If I'm locked out of my account for any reason, I can use my phone number to receive login OTP to get back into my account. I never consented to Google using my number for any marketing purposes.

Then how did the store successfully identify my presence there and then use it send me a SMS message?

Clearly, the information collected is far from being anonymous for providing any services useful for the user (such as Maps), and Google is guilty of sharing very personal information with 3rd parties and allowing them to track individuals' whereabouts. NOT ACCEPTABLE!

 

[Oswald Boelcke]

It looks to me Google does even more! Some more reading:

https://media.kuketz.de/blog/microblog/Harmless-Science-Project_Oracle_Dec2022.pdf

 

[TheMystic]

It looks to me Google does even more! Some more reading:

https://media.kuketz.de/blog/microblog/Harmless-Science-Project_Oracle_Dec2022.pdf

This is well summarised:




I thinks things have gone too far. It is high time that regulators all over the world put a stop on this. A private corporation has no business tracking individuals in this manner. Unless ofcourse, they are just a disguised front for the security agencies of a particular country.

 

[TheMystic]

I guess that if I spent sometime in the TV section, I can expect to see TV ads on my Google feed and elsewhere. Google has successfully tracked not only the store where i was, but right down to the section where I spent time, and for how long. This information is linked to my Google account, and hence I see related ads in various places.

This is what I meant:

Yes, i visited a Bookstore yesterday in the same mall. Today I see this notification on my phone.

 

[xXx yYy]

Install AppWarden to get an idea what apps / who are tracking you.

 

[TheMystic]

Install AppWarden to get an idea what apps / who are tracking you.

It is clear Google is responsible for this level of tracking. As demonstrated in the link shared by @Oswald Boelcke above, even turning OFF several settings doesn't stop Google from collecting information and tracking you accurately. The electronics store was huge, but the bookstore was only a fraction of its size. Yet Google knew accurately which store i was in and passed on the information to 3rd parties.

In my Google account settings, my phone number is to be used only for account security purposes, yet Google gave that away to 3rd parties. I don't think stores by themselves have any way to link my device with my phone number. They obtained that information from Google.

Going forward, they will start tracking you even when your phone is switched OFF. Apple has already started doing this.

 

[Oswald Boelcke]

@TheMystic Gratefully, I've never made your experiences. But Google hasn't changed its "policies" just recently. They're the same already for many years and become refined every day.
Already many years ago, I decided to never use genuine, original Android (i.e. Google) but to go with costum ROM's, without any Google services but with microG due to the very few apps I use that need Google services, and to never have any Google application on my device. I check all my apps by the tool mentioned by @xXx yYy plus Exodus Privacy. Furthermore, I spoof ID's by XPrivacy Lua.

 

[TheMystic]

@TheMystic Gratefully, I've never made your experiences. But Google hasn't changed its "policies" just recently. They're the same already for many years and become refined every day.
Already many years ago, I decided to never use genuine, original Android (i.e. Google) but to go with costum ROM's, without any Google services but with microG due to the very few apps I use that need Google services, and to never have any Google application on my device. I check all my apps by the tool mentioned by @xXx yYy plus Exodus Privacy. Furthermore, I spoof ID's by XPrivacy Lua.

Unfortunately, I use Google apps heavily as they make life really easy. Google Photos is one service that I find extremely safe to store my camera roll, along with the convenience of accessing them from any device (iOS, Windows, macOS). I'm aware of the ability to host my own cloud server for this purpose, but unfortunately don't have the expertise to keep it safe for online access.

The technology has evolved to a point where too much data is being collected and used in many more ways than what is declared. I haven't experienced something like this earlier, so it shows how much more efficient these tools have become.

Earlier, if I do a manual search on Google for a product, I would see related ads on Amazon, Facebook and elsewhere. That was fine. But now things have evolved to a point where products are being recommended to me and 3rd party entities are able to contact me based on where I was, with so much accuracy that makes me uncomfortable.

There has to be a solution from authorities where large corporations (or any entity) cannot invade into people's privacy in this manner. They can't say I have the option to not use their products or services, such as not using the phone itself. Because that would make me uncompetitive, giving my peers and competitors an unfair advantage.

Apple is conveniently using CSAM as a legal excuse to scan people's private photos and videos. Next they will scan all documents, chats and emails for 'security' reasons or some lame excuse. Apple, Google and Microsoft are already doing this on some scale. It is only set to get worse from here, unless there is legal/ governmental intervention.

 

[xXx yYy]

Wondering why not all people prevent Google tracking / spying you via Android's hosts file:

hosts file for blocking basically all Google connections

hosts file for blocking basically all Google connections - hosts

gist.github.com

 

[TheMystic]

Wondering why not all people prevent Google tracking / spying you via Android's hosts file:

hosts file for blocking basically all Google connections

hosts file for blocking basically all Google connections - hosts

gist.github.com

Requires root.

What about users who use Google Photos, Gmail, Google Drive, Google Keep, etc.?

Only YouTube has alternatives. More importantly, I don't think many users will be comfortable using modded apps for the above.

Is there a good alternative to Google Maps that doesn't rely on Google Play Services and Google Location services?

Turning OFF Bluetooth effectively means the smartwatch will only show time.

 

[V0latyle]

I don't see how such an entity could send you a text message without first knowing your phone number. I assume you've made purchases there before, and gave them your phone number when you did so? Without having that store's app on your phone, I don't see how else they would know what your phone number is, and unless you've had that app on your phone before, I don't see how they could identify your device via BlueTooth. If you're an established customer there, it's a remote possibility that they use facial recognition software with their security cameras, although that's rather unlikely...

My point is, this doesn't really add up. While Google apps use your location data to provide targeted ads, they don't share your phone number with advertisers without your consent.

 

[TheMystic]

I don't see how such an entity could send you a text message without first knowing your phone number. I assume you've made purchases there before, and gave them your phone number when you did so? Without having that store's app on your phone, I don't see how else they would know what your phone number is, and unless you've had that app on your phone before, I don't see how they could identify your device via BlueTooth. If you're an established customer there, it's a remote possibility that they use facial recognition software with their security cameras, although that's rather unlikely...

My point is, this doesn't really add up. While Google apps use your location data to provide targeted ads, they don't share your phone number with advertisers without your consent.

I have purchased from this Store several months back, and i have given my phone number to them at the time of transaction. But how did they link my phone (Bluetooth information) with my number?

I guess you haven't read through the comments.

I never installed the store's app. Facial recognition is a highly unlikely scenario in this case.

Even though I am a customer of that store and they have my phone number, how did they identify my presence there? I never connected my phone to anything in that store or even the mall.

I can't think of anything else except that Google violated my account settings and shared my phone number:

On my Google account, I have set my phone number to be used only for account security purposes. If I'm locked out of my account for any reason, I can use my phone number to receive login OTP to get back into my account. I never consented to Google using my number for any marketing purposes.

 

[V0latyle]

I guess you haven't read through the comments.

I admit I skimmed

I never installed the store's app. Facial recognition is a highly unlikely scenario in this case.

I know, that's why I said it was a distinctly remote possibility

Even though I am a customer of that store and they have my phone number, how did they identify my presence there? I never connected my phone to anything in that store or even the mall.

Yeah, that's the mystery. I can see getting a text message after making a purchase - they have your phone number after all. Maybe it's some sort of social program with employees to recognize and reach out to repeat customers in an effort to build rapport?

I can't think of anything else except that Google violated my account settings and shared my phone number:

It wouldn't be the first time.

Bottom line is...if there's nothing on your phone associated with the store, I don't think they identified you by means of your phone or your watch. Google does know you were in the general vicinity, but providing location data to third parties is a great way to get sued so I really don't think they're doing that...

 

[TheMystic]

Maybe it's some sort of social program with employees to recognize and reach out to repeat customers in an effort to build rapport?

I have been to this store a long time back (more than a year) and none of the employees there knew me, and vice versa. I barely interacted with anyone there this time. Spent just about 5 minutes and then walked out.

It wouldn't be the first time.

Bottom line is...if there's nothing on your phone associated with the store, I don't think they identified you by means of your phone or your watch. Google does know you were in the general vicinity, but providing location data to third parties is a great way to get sued so I really don't think they're doing that...

Bluetooth beacons may be present in that store that could identify me as 'someone who has been here before'. This is how Google can accurately pinpoint your location (precise location). As mentioned in post #10, I saw ads for books from Amazon the next day.

But I can't think of anything at the store level that could link this with my identity (phone number). So somewhere Google has knowingly or unknowingly given that information away.