Ubiquitous RFID and Privacy

By Mark Roberti

As radio frequency identification proliferates, the potential for abusing the technology will rise—but democratic capitalist societies have mechanisms to respond to and limit abuses.

I received an e-mail from a reader in Michigan who expressed some concern regarding potential abuses of radio frequency identification. This did not come from some ill-informed opponent of the technology, so I think it's worth quoting in detail before I respond:

I would like to pose a question that you might want to address within the scope of promoting RFID technology. I am opposed to the proliferation of this technology. My concern is not where [RFID] is now—in its infancy—but where it is going. I wonder if you might have the courage to address the direction of tracking as it pertains to the tracking of a private person's lifestyle with RFID. I will give you one example, but you know many more [where] your industry might be heading.




Trash recycling at the curb now tracks, with RFID technology, who recycles and who does not. Those who do receive "rewards" for their efforts based on recycling volume, and receive payment based on information created with RFID. My understanding is one of the goals of RFID is to eventually track each item recycled or trashed, using RFID technology. What is recycled/trashed will be uploaded to direct-marketing businesses and other interested parties for a fee.

The direct-marketing industry works hard to glean our private information, even using less-than-honest methods like college-scholarship search engines, taking advantage of our young children to glean private information. It is this side of your business that needs to be addressed.

This is a valid concern, and it's one I have thought deeply about over the past eight years. Today, most companies are looking at RFID as a way to improve their operations, but as the technology becomes ubiquitous—and RFID is on most packaging and embedded in some items—there will be opportunities to analyze the data collected, and that will, as my correspondent suggests, gain the attention of marketers. But I also believe that democratic capitalist societies have mechanisms to respond to and limit abuses.

One check is that those who employ RFID data inappropriately will fail to realize the benefits they set out to achieve in the first place. Let me provide a few examples.

RFID tags used in toll-collection systems could be utilized to reduce speeding. Police could set up checkpoints 65 miles apart in a 65-mile-per-hour speed zone, and mail a ticket to every person who passes the second reader in less than one hour. Sounds like a great idea for raising revenue and reducing speeding, but no one has done this and the reason is simple: After getting your first ticket, you'd toss away your tag, and then the primary purpose of that tag—to reduce congestion at toll booths—would be lost.

The benefit of tagging recyclable items is to increase the amount of goods recycled, and to improve sorting so they can then be recycled more easily. So let's say a municipal government agreed to provide data to marketers, or to allow the company performing the recycling to sell that information. What would be the result? Obviously, people who didn't want marketers to know everything they buy would cease recycling, thereby defeating the purpose of tagging in the first place.

Retailers also have a disincentive to collect information about customers who don't explicitly opt in. Many people don't want to have their purchases tracked. They don't want ads to target them personally, as they did through retina scans in the movie Minority Report. So retailers that utilize RFID data to target advertising to customers without their knowledge or permission would likely lose revenue.

Some retailers might foolishly attempt to track people without their knowledge, and then use that data either in aggregate form, or to target ads to specific customers, but when they were found out—and they would be found out—they would have a huge public relations problem on their hands. And they would lose business, because people opposed to this kind of tracking would not shop at their stores. That would be an object lesson for other retailers: Abuse your customers' trust, and you'll lose their business.

As I expected, market forces are shaping RFID's evolution to enhance customer privacy. Impinj and NXP, for example, have developed RFID chips with enhanced privacy features that not only enable you to kill a tag at checkout (a feature of EPC tags from the beginning), but actually allow a retailer to replace the Electronic Product Code with a random serial number. That way, if a person walks out of a drugstore with a bottle of Viagra, no one could read the tag and know what the product was.

There will be cases in which unscrupulous companies or individuals abuse the technology, just as some Web sites have collected data from children. But when there are common abuses and no market forces to prevent them, governments step in and pass laws against the bad behavior, so that the police can put a stop to the abuse. All of us who believe RFID will deliver great benefits to companies and consumers are opposed to laws that limit the technology, but we are in favor of those that restrict bad behavior.

There is no doubt that new technologies can have a significant impact on consumer privacy. Facebook and YouTube have had their share of issues, for instance, and RFID undoubtedly will as well. But I don't worry that the technology will have a negative impact on consumer privacy. Instead, I worry that ignorant legislators trying to score points with uninformed voters will pass laws that limit the many benefits RFID can deliver—and that is a much bigger threat to consumers.

Mark Roberti is the founder and editor of RFID Journal. If you would like to comment on this article, click on the link below. To read more of Mark's opinions, visit the RFID Journal Blog or the Editor's Note archive.