Are Bluetooth Beacons Tracking You?

What Are Bluetooth Beacons?

The technology is known as iBeacon, and it utilizes the Bluetooth Low Energy (BLE) short-range, wireless communication standard. BLE is supported natively by iOS, Android, Windows Phone, Blackberry, Windows 8, and Linux. Here is how iBeacon applications work.

The “beacon” is a small device that regularly sends out a brief radio signal that includes its “universally unique identifier.” Nearby devices equipped with BLE support and appropriate apps receive the signal; look up the beacon’s identifier; and take some action such as displaying a message to the user, for example:

"For 10% off your next Starbucks drink, take a left at the corner!"

"You are standing at the Neanderthal Man diorama; touch this icon to hear all about it."

"Your flight departs from Gate B26 in 30 minutes; proceed 500 yards straight ahead, then turn right through the portal marked, ‘Abandon hope, all ye who enter.’"

The beacon device itself does not collect any data from your device. But the app on your device looks up a beacon’s identifier by connecting to a remote database server. The app may transmit data about your device, location, and – potentially - personal data stored on the device during the same connection.

So whoever controls that database of beacon identifiers is the one who poses a threat to your privacy and security. If Starbucks deploys beacons in all its stores, it will have the database of all the identifiers of those beacons and can track everyone who uses the Starbucks app. The same goes for other retailers, airlines, museums, sports arenas, and so on.

But it gets better – or worse, depending on your viewpoint. Starbucks has only the data collected by the beacons it owns. The company from which Starbucks purchases beacons gets access to Starbucks’ data and the data collected by all of that beacon manufacturer’s customers: airlines, arenas, museums, retailers, music festivals, etc.

Who is Behind These Beacons?

The biggest seller of beacons is Gimbal, which is part of the retail systems division of mobile tech giant Qualcomm. The company’s privacy policy is probably worth a look if you ever install a Gimbal-based app.

The Gimbal privacy policy says that the company does not collect users’ names, email addresses, contacts, or log files of calls or text messages. It also says the privacy policy applies only to Gimbal, not the developers of apps that use Gimbal beacon technology.

Gimbal is “off by default.” That means the user must take some action to enable the collection and transmission of data the first time a Gimbal App is used. Gimbal’s software then generates a unique ID for that user, which subsequent Gimball Apps will also use. That user ID can be reset by the user, ending the chain of data about him but starting a new one with a new ID. Gimbal can be turned off on an app-by-app basis or across the entire device.

Gimbal Apps have been used at events such as the Tribeca Music Festival; venues such as ballparks and concert auditoriums; and local attractions such as museums. But now it seems poised to break out into the world at large.

In October, 2014, Gimbal beacons were discovered in 500 New York City public phone booths. Titan Advertising, the company that controls advertising on the screens of NYC’s public phones, pulled the beacons after public outcry.

Los Angeles has installed – but not yet activated – Gimbal beacons in several hundred bus stop benches and parking-restriction signs; the city has over 6,000 bus benches that could get beacons if the pilot program goes well. No one knows how many parking signs exist.

American Airlines installed beacons in its terminals at LAX, enabling frequent-flyers who have the AA app installed to receive directions to their gates. The Los Angeles Museum of Art has beacons and an app that tells visitors about the art they’re looking at.

And one has to wonder if government surveillance will expand through the use of iBeacons. We've already got cameras everywhere -- why not put these little gadgets on every street corner under the guise of homeland security?

Hold the Beacon, Please...

You can avoid any potential privacy problems by turning off (or not turning on) the Bluetooth feature on your smartphone. If you don't need Bluetooth connectivity for a headset, fitness band, hands-free calling in your car, or smartwatch, leave it turned off. (If you have an iPhone or iPad, you might notice that Bluetooth gets turned on automatically every time you install an iOS update. Hmmm...)

On both iOS and Android devices, you'll see the little Bluetooth icon in the top row of of your display, when the feature is turned on. On iPhone or iPad, Tap Settings, then General. Tap Bluetooth, then use the toggle to turn Bluetooth off. On Android devices, swipe down from the top, then tap the Bluetooth icon to switch it on or off.

If you do need Bluetooth connectivity, think twice before installing any Gimbal-based apps. Unfortunately, the people who push apps at consumers don’t label them “Gimbal-based.” So my best advice is to read the fine print carefully before and after you install an app, and uninstall any apps that you no longer need.

Your thoughts on this topic are welcome. Post your comment or question below...