IPC Privacy Guidelines for RFID Information Systems
(RFID Privacy Guidelines)
Information and Privacy Commissioner/Ontario
Ann Cavoukian, Ph.D., Commissioner
June 2006
INTRODUCTION
This document is intended to serve as privacy “best practices” guidance for organizations when designing and operating Radio-Frequency Identification (RFID) information technologies and systems.
The Information and Privacy Commissioner of Ontario (IPC) has a mandate to educate the public and address privacy questions raised by new information technologies, with a view to encouraging effective solutions. Accordingly, the IPC has developed these Guidelines in partnership with industry and other stakeholders1. The Guidelines are not intended to supersede any applicable privacy law or regulation.
We recognize that RFID tags are becoming more prevalent in our everyday lives, and offer many benefits and conveniences, such as from security access cards to ignition immobilizers to highway toll systems and other electronic pass systems.
RFID tags deployed in the supply chain process pose little threat to privacy – they are not linked to any individual but rather, placed on crates, pallets and cases to track products. They act as a unique identifier that uses Radio Frequency Identification for the automatic identification of products in the supply chain. These tags contain standard information pertaining to the products and do not include any personal information.
In order to allow RFID technology to realise its potential for consumers, retailers and suppliers, it is vital that we address privacy concerns prompted by the current state of the technology, while establishing principles for dealing with its evolution and implementation. Accordingly, we encourage organizations to observe and adopt the Guidelines contained in this document whenever deploying RFID technology with consumer-facing implications.
As indicated in the Commissioner’s accompanying DVD, the use of RFID tags in the supply chain management process is not the problem. The problem arises with their use at the consumer item-level. RFID tags, when linked to personally identifiable information, present the prospect of privacy-invasive practices relating to the tracking and surveillance of one’s activities. The goal of these Guidelines is to alleviate the privacy-related concerns associated with such data linkages, while increasing the openness and transparency associated with RFID systems. The use of these Guidelines will ultimately facilitate the preservation of trusted business relationships with existing customers, and perhaps assist in attracting new ones.
SCOPE
These RFID Privacy Guidelines apply to any organization that operates an information system involving the use of RFID technology on consumer products involving or potentially linking to, personally identifiable information.
“Organization” refers broadly to associations, businesses, charitable organizations, clubs, government bodies, institutions, and professional practices. In most instances, these Guidelines will be especially relevant to retailers.
“Information system” refers to any combination of RFID tags, readers, databases and networks that serve to collect, transmit, process and store RFID and RFID-linked information.
“Personal information” refers to any recorded information about an identifiable individual. In addition to one’s name, contact and biographical information, this could include information about individual preferences, transactional history, record of activities or travels, or any information derived from the above, such as a profile or score, and information about others that may be appended to an individual’s file, such as about family, friends, colleagues, etc. In the context of item-level RFID tags, the linkage of any personally identifiable information with an RFID tag would render the linked data as personal information.
These Guidelines are based upon the ten principles of the 1996 Canadian Standards Association (CSA) Privacy Code, which were formulated by a wide range of stakeholders, including business, industry and consumer groups. The principles of the CSA Privacy Code now serve as the basis for Canadian privacy laws and regulations across Canada. They are observed by Canadian organizations in their day-to-day policies and practices, and are widely recognized as being one of the strongest and clearest expressions of privacy “fair information practices.”
The Guidelines and their application are informed by the following three overarching principles:
1) Focus on RFID Information Systems, not Technologies: The problem does not lie with RFID technologies themselves; it is the way in which they are deployed that raise privacy concerns. For this reason, we prefer to speak broadly of RFID information systems. These Guidelines should be applied to RFID information systems as a whole, understood in their broader contexts, rather than to any single technology component or function.
2) Privacy and Security Must be Built in from the Outset – at the Design Stage: Just as privacy concerns must be identified in a broad and systemic manner, so too must technological solutions be addressed systemically. A thorough privacy impact assessment is critical. Users of RFID technologies and information systems should address the privacy and security issues early in the design stages, with a particular emphasis on data minimization. This means that wherever possible, efforts should be made to minimize the identifiability, observability and linkability of RFID tags with personal information and other associated data.
3) Maximal Individual Participation and Consent: Use of RFID information systems should be open and transparent, and offer individuals as much opportunity as possible to participate and make informed decisions.
This document provides voluntary, consensus-based guidance that recognizes the great variety of uses and applications for RFID technologies and information systems. Because of this heterogeneity, a degree of flexibility in its interpretation and application may be necessary.
We encourage organizations to adopt and to adapt these Guidelines for use in their own policies, procedures and applications, according to their own specific circumstances and needs.
RFID PRIVACY GUIDELINES
1. Accountability
An organization is responsible for personal information under its control and should designate a person who will be accountable for the organization’s compliance with the following principles, and the necessary training of all employees. Organizations should use contractual and other means to provide a comparable level of protection if the information is disclosed to third parties.
Organizations that typically have the most direct contact and primary relationship with the individual should bear the strongest responsibility for ensuring privacy and security, regardless of where the RFID-tagged items originate or end up in the product life cycle.
2. Identifying Purposes
Organizations should clearly identify and communicate to the individual the purposes for collecting, linking to, or allowing linkage to personal information, in a timely and effective manner. Those purposes should be specific and limited, and the organizations and persons collecting personal information should be able to explain them to the individual.
3. Consent
Organizations must seek individual consent prior to collecting, using, or disclosing personal information linked to an RFID tag. To be valid, consent must be based upon an informed understanding of the existence, type, locations, purposes and actions of the RFID technologies and information used by the organization. Individual privacy choices should be exercised in a timely, easy and effective way, without any coercion. Consumers should be able to remove, disable or deactivate item-level RFID tags, without penalty.
Automatic deactivation of RFID tags, at the point of sale, with the capability to re-activate, should be the ultimate goal. Consumers should be able to choose to re-activate them at a later date, re-purpose them, or otherwise exercise control over the manner in which the tags behave and interact with RFID readers.
4. Limiting Collection
Organizations should not collect or link an RFID tag to personally identifiable information indiscriminately or covertly, or through deception or misleading purposes. The information collected should be limited to the minimum needed to fulfil the stated purposes, with emphasis on minimizing the identifiability of any personal data linked to the tag, minimizing observability of RFID tags by unauthorized readers or persons, and minimizing the linkability of collected data to any personally identifiable information.
5. Limiting Use, Disclosure and Retention
Organizations must obtain additional individual consent to use, disclose or link to personal information for any new purposes. Personal information should only be retained to fulfil the stated purposes, and then securely destroyed. Retailers should incorporate the data minimization principles outlined above, into and throughout their RFID information systems.
6. Accuracy
Organizations should keep personal and related RFID-linked information as accurate, complete, and up-to-date as is needed for the stated purposes, especially when used to make decisions affecting the individual.
7. Safeguards
Organizations should protect personal information linked to RFID tags, appropriate to its sensitivity, against loss or theft, and against unauthorized interception, access, disclosure, copying, use, modification, or linkage. Organizations should make their employees aware of the importance of maintaining the confidentiality of personal information through appropriate training. Although physical, organizational and technological measures may all be necessary, technological safeguards should be given special emphasis.
8. Openness
Organizations should make readily available to individuals specific information about their policies and practices relating to the operation of RFID technologies and information systems, and to the management of personal information. This information should be made available in a form that is understandable to the individual.
9. Individual Access
Organizations should, upon request, inform the individual of the existence, use, linkage and disclosure of his or her personal information, provide reasonable access to that information, and the ability to challenge its accuracy and completeness, and have it amended as appropriate.
10. Challenging Compliance
Organizations should have procedures in place to allow an individual to file a complaint concerning compliance with any of the above principles, with the designated person accountable for the organization’s compliance.
1 EPCglobal Canada has been collaborating with the IPC in the development of these Guidelines, and will be seeking Board approval by its member companies to signify EPCglobal Canada’s endorsement of these Guidelines.
Commissioner Ann Cavoukian gratefully acknowledges the work of Fred Carter, of the IPC’s Policy and Compliance Department, in the preparation of these Guidelines.
Practical Tips for Implementing RFID Privacy Guidelines
Organizations have expressed a particular interest in receiving practical tips to complement their current consideration and use of Radio Frequency Identification (RFID) technology.
RFID technology is seen as a means to improve business process efficiency levels by, for example speeding up inventory checks and minimizing “leakage.”
Organizations must balance the advantages of using RFID technology with the potential privacy intrusions such technology can pose.
Even if an RFID tag does not contain any personal information, personally identifiable information may be created if the tag data is linked to a particular individual.
The use of an RFID system (as with other technologies) in retail and commercial environments, is appropriate within limited, controlled and well-defined circumstances.
The following practical tips are intended to help organizations develop retail RFID projects that address privacy issues and preserve consumer trust and confidence.
These practical tips will also help organizations comply with privacy legislation and other best practices, such as the IPC RFID Privacy Guidelines.
1. Accountability
• Organizations should have an effective privacy policy in place which recognizes the unique issues presented by RFID technology.
• Organizations with the most direct and primary relationship with the consumer, usually retailers, bear the strongest responsibility to protect consumer privacy.
• Organizations are accountable to the individual consumer for all disclosures of personal information to partners, affiliates, and third parties.
2. Identifying Purposes
• Organizations should only collect, use or disclose RFID-linked personal information for purposes that a “reasonable person” would consider appropriate in the circumstances. A reasonable purpose excludes the following:
o price discrimination;
o tracking and profiling individuals without their informed, written consent.
Notice
• Organizations should notify consumers if products contain an RFID tag, through clear and conspicuous labelling on the product itself.
• Organizations should notify consumers of RFID readers on their premises, using clearly written signage, prominently displayed at the perimeters.
• Signs at the perimeter should identify someone who can answer questions about the RFID system, and include their contact information.
• Consumers should always know when, where, and why an RFID tag is being read. Visual or audio indicators should be built into the operation of the RFID system for these purposes.
3. Consent
• Organizations should have a clear policy for obtaining consent to collect, use and disclose RFID-linked personal information, taking into consideration the nature, sensitivity and intended use of the products.
• Unless the consumer chooses otherwise, removal, destruction, or de-activation of RFID tags should be the default actions at the time of purchase for products that are worn or carried by the consumer, or which may reveal sensitive information (e.g., medications).
4. Limiting Collection
• Before introducing RFID tags linked to consumer information, organizations should first consider alternatives which achieve the same goal, without collecting any personal information. A Privacy Impact Assessment (PIA) is critical.
• Wherever possible, organizations should seek to limit collecting RFID-linked consumer information to the minimum necessary.
5. Limiting Use, Disclosure, and Retention
• Organizations should not use or disclose RFID-linked consumer information for any purpose to which the individual has not consented.
• Organizations should not disclose RFID-linked consumer information to third parties who may profile or perform surveillance on individuals.
• Organizations should delete all RFID-linked consumer information as early as possible.
6. Accuracy
• Organizations that use RFID-linked consumer information for the purpose of making decisions affecting individuals should ensure that the information is as accurate, complete, and up-to-date, as is necessary for that purpose.
7. Safeguards
• Organizations linking RFID tags to personal information should take appropriate measures, beginning with a thorough PIA, to ensure that:
o RFID tags do not contain personal information
o RFID tags are not read by unauthorized parties, either within or outside the organizations’ premises; and
o all linkages between RFID tags and consumer information are minimized and kept secure.
• Whenever RFID tags are in the possession of consumers, such as at the time of purchase, they should:
o be able to choose to have RFID tags removed, destroyed or de-activated easily and without penalty or consequence; and
o have the ability, upon return of a product, to ensure that their personal information is de-linked from the product item.
8. Openness
• Organizations should publish, in compliance with applicable laws, information on their policies respecting the collection, retention, and uses of RFID-linked consumer information.
• Organizations should make available to the public general information about the RFID technology in use and the meaning of all symbols and logos used.
9. Individual Access
• Consumers should have a right to know what personal information, if any, is stored inside their RFID tags, or else linked to them.
• Upon demand, organizations should provide the consumer with an account of all uses and disclosures of RFID-linked personal information.
• If RFID-linked information is incorrect or unnecessary, there should be a means by which to correct or amend it.
10. Challenging Compliance
• Organizations should inform consumers of their rights and available procedures to challenge that business’ compliance with these privacy principles.
• Organizations may wish to ensure that the use and security of any RFID technology or system is subject to regular audits. For example, the audit could address the company’s compliance with the operational policies and procedures.
416-326-3333
1-800-387-0073
Fax: 416-325-9195
TTY (Teletypewriter): 416-325-7539
Website: www.ipc.on.ca
2 Bloor Street East
Suite 1400
Toronto, Ontario
M4W 1A8
Information and Privacy Commissioner/Ontario
|
Search Through All Stories
Questions dominate a Dec. 20 incident where some 8,000 Macy's customers had their debit cards charged as many as three times for the same transaction. One source said it involved a payment processor's slowdown.
Some of the latest stats pouring in from the 2008 holiday shopping season are raising some interesting trends, including a sharp (not-before-seen) increase in traffic right after Dec. 25 along with a much deeper cut in site visits from those earning more than $150,000/year.
Amazon.com issued a statement on Thursday (Dec. 30) giving its customers fewer than 12 hours' hours notice that it was cutting off Bill Me Later as a payment option as of Dec. 31. The highly anticipated move was a result of Ebay's purchase of Bill Me Later in October.
E-Commerce holiday purchases this year dropped 3 percent from the corresponding period last year, hitting $25.5 billion, according to ComScore.
Allowing customers of Gap.com to easily jump to other Web sites in the Gap family, and put all their selections in one shopping cart, undermined perception of the brand and eroded user satisfaction, said the president of a company that tracks E-tail site satisfaction.
For years, Google has given its Google Checkout service to retailers for free, as long as they bought ads on Google. Alas, no more. Explained one Google manager: "Why have it as a loss leader if it's doing OK? We saw very healthy results after we decided to charge for the service."
Amidst the avalanche of downright depressing retail economic news this holiday season, there are recurring hints that E-tailers—as a group—fared far better. But because we're starving for any sign of optimism, are we interpreting those signs unrealistically?
As retailers debate how much they truly want to embrace mobile payment efforts, the Mercator Advisory Group is reporting that the tide will soon become unavoidable.
Extensive analysis of a consumer's Web interactions has been used for years to try and target sales pitches more effectively. But new research suggests that such analysis may pale in comparison to the next wave, where every digital comment made by consumers anywhere—in a product comment, an IM, on a social network site, in E-mail and via exchanges with a live chat tech support person, coupled with Web traffic analysis—can be mined for hints as to their emotions and other thoughts.
Tracking global retail from the United States, it's clear that Canada is the country most similar to the United States when it comes to retail procedures. Surprisingly, the next closest region is not the United Kingdom but Australia, and then arguably South Africa. So it's always interesting to see the few technology areas where American and Australian retailers diverge, and EPC is shaping up to be one of them.
Kraft Foods, Nestle and Procter & Gamble are now able to synchronize item data with Metro Group stores in Russia, a collaborative effort being touted by the players as a "landmark" deal that illustrates the rapid expansion of the Global Data Synchronization Network (GDSN). Not all are convinced, though.
The story of the technologist who crafted an elaborate RFID poker table, complete with an HD camera to stream real-time games globally, is interesting mostly in how he attached ultra-thin and extra-flexible RFID tags to each playing card in such a way as to make it not interfere with the way the cards felt. But does it have implications for the future of retail?
'Tis the season to be jolly. Unless you're in charge of uptime at upscale retailer J,Crew's Web site. Having suffered outages during Cyber Monday, J.Crew again became unavailable—to at least some prospective customers—for an extended period Wednesday (Dec. 17).
Despite the putrid economy and the tightening of holiday shopping lists globally, the number of site visits logged in at comparison shopping sites has gone down sharply, some 15 percent lower than was recorded during last year's identical period, according to Hitwise. More logically, Hitwise found an even larger increase—25 percent—in the number of visits to Web coupon sites this year.
In a sharply down economy, retail IT budgets are going to go on a roller coaster ride in the need for greater efficiency. And given how small a percentage of corporate spending is typically represented by the IT capital expenditure budget, IT will probably feel less of the pain than many other divisions. But...
One of every three customers walking into an Office Max store to buy a consumer electronics product left empty-handed (and probably bitter) this year because the product was unavailable, according to new research by IHL Group. But Office Max certainly wasn't alone in the research company's hall of shame, with Office Depot and Circuit City keeping it company.
On the one hand, many clicks on a retailer Web site indicate user engagement. And that's a good thing, unless cumbersome site design is forcing users to click unnecessarily. In its recent audit of Cyber Monday shopper activity, site-monitoring company ClickStream Technologies found that too many clicks during the checkout process prompt frustrated buyers to wriggle from the hook.
Online retailers are relying too little on automation to thwart online fraud, meaning too many employee hours are spent reviewing orders that shouldn't have raised any flags of suspicion.
Gift card exchange site Leverage, which had pushed one of the more creative CRM ideas out there, has laid off its entire workforce and is hoping economic fortunes will improve next year, according to company CEO/Co-Founder Mark Edward Roberts.
Around this time of year, GuestView Columnist David Taylor starts to wax nostalgic about the good old days at Gartner when he used to make grand announcements about his vision for the future of technology.
Amazon.com this week jumped in with a clever gift card strategy that bordered on brilliant, a tactic that could simultaneously boost revenue and steal sales from multiple competitors. So with such a wonderful plan, what would possess Amazon to put a statement that, at the most charitable, could be described as a phrasing so deceptive that even a New Jersey or Illinois politician would find it too over the top?
Amazon is far from alone this holiday season is pushing some new mobile efforts, standing alongside Walmart, Target, Gap and Sears in the popular holiday "let's fling random things at the cellular tower and see what sticks" game.
As the hoopla surrounding Black Friday and Cyber Monday mercifully subsided, some e-tailers were still struggling to keep their sites up, with Office Depot and Sephora suffering repeated outages while Walmart and Office Max—among others—experienced more sporadic mishaps.
The early holiday shopping season found fewer consumers hitting U.K. retail Web sites compared with last year's identical period, with some major sites seeing double-digit declines, according to Comscore.
Payments for taxis, parking and movies may prove less patient in waiting for new technologies than E-Commerce, a move that could be a bad sign for once-promising mobile payment method Near Field Communication (NFC).
Dollar General, the $10 billion discount retail chain, on Wednesday (Dec. 10) agreed to install specially-designed POS units intended to safeguard the privacy of visually-impaired consumers in all of its 8,300 stores in the U.S. "in less than eighteen months." The intent is to give those shoppers an alternative to touchscreen interfaces by offering tactile keys.
The economy sucks so GuestView Columnist David Taylor suggests that this would be an ideal time to shift budget away from regulatory compliance and spend it on something that will actually make money for your company, like direct mail advertising. No, he doesn't actually believe that, but he has the feeling that some executives are on the defensive when it comes to maintaining a focus on their areas during these dark times.
E-Commerce avatars—computer-generated 3-D replicas of consumers with precise measurements to help purchase clothes that fit better—may soon use digital video to incorporate a consumer's posture, facial expressions and smile.
Best Buy Chief Technologist Bob Anderson has been talking lately about the value of lending an ear to young innovators in the company. "You don't need a big, honking server and lots of funding or 50 people to start something innovative."
One columnist writes about the stampede death of a Wal-Mart assoiciate in New York when he was opening the doors for Black Friday shoppers. "No doubt," he wrote, "they were the same shoppers who complained bitterly about the ‘appalling lack of help' in the store." Indeed.
A service level agreement (SLA) is a guarantee from a site that its uptime will be as promised, n'est pas? Actually, quite the opposite. It's more likely a complicated document designed to protect the site (not the retailer) in case of any problem.
Walmart.com is saying that they want to clarify that position, but then E-mailed a statement that, well, doesn't clarify much of anything. But it does do a nice job of hinting at something without actually saying it.
Whether the wing flapping of a bug can eventually cause a tornado is debatable, but Cyber Monday 2008 should serve as a warning to E-tailers to avoid the lesson learned by Staples and Dell on Monday (Dec. 1): Don't ignore the butterfly effect.
At about 6 AM New York time on Black Friday (Nov. 28), Wal-Mart's site went down for about an hour and then came back up. But this time, the company had moved its content pages to an outside service. Wal-Mart said this was a scheduled change, a concept that Gareth Evans, head of client services at Web tracking firm Sitemorse, finds unlikely.
Microsoft's Live Search cashback program—which gives rebates to those who comparison shop online and choose stores that are part of the program—was a bit too popular on Black Friday (Nov. 28) and crashed for several hours, leaving consumers with no cashback and a lot of anger.
Sears.com suffered the worst Web problems on Black Friday (Nov. 28), experiencing a series of complete site crashes for much of the day. Although no other major retailer came close, according to preliminary reports, many of the industry's largest merchants suffered site slowdowns or other Web problems, including Walmart, Kmart, Saks, Overstock, Amazon, Target, Kohl's, Costco and Buy.com.
In a trial initially limited to the United Kingdom, Switzerland, Israel and Italy, Visa Europe is starting a trial this month of a card with an 8-digit alphanumeric display, 12-button keyboard and a long-life battery. The card has the ability to offer reciprocal authentication, which is designed to allow consumers "making transactions via phone or the Web a way to identify the party on the other end before transmitting identifying credentials."
Black Friday (Nov. 28) E-Commerce sales hit $534 million, reflecting a one percent increase from last year's Black Friday, ComScore reported Sunday (Nov. 30).
A Web-generated wakeup phonecall to get customers to in-store early morning sales may not have a material impact on quarterly sales, but it's a creative touch for the E-Commerce site JCPenney relaunched right before Black Friday (Nov. 28). Even if the system's in-store inventory update isn't quite accurate.
A group of credit card thieves in Seattle tried to maximize their profits by using their stolen credit card data to open a loyalty card account with Best Buy, where they could get could extra benefits along with their stolen products, according to a federal indictment filed Nov. 19. One had tried a similar rewards scam with a Home Depot reward card and a Sears gift card.
Recently released numbers raise questions as to whether online will be much of a savior at all. New figures from eMarketer project that E-Commerce sales will top last year's numbers by some $5.6 billion, a 4.1 percent increase from $136.8 billion to $142.4 billion.
Eduardo Perez of Visa has called its fines for non-compliance "nuisance" fines. In other words, the fines are not large enough to be a big financial burden to retailers but are large enough to get the CFO pissed off about having to pay them and maybe large enough to get a CEO to at least show up for a meeting to discuss PCI.
The IT struggle with knowing where all payment data is—let alone trying to enforce rules that pretty much try and keep it there—was the topic of a StorefrontBacktalk a podcast this week with our own PCI columnist, David Taylor, and security specialist J.D. Oder, the chief technology officer at Shift4.
Wal-Mart has agreed to pay $1.4 million to settle complaints that it overcharged customers in California. The Nov. 24 deal involved the mispricing of some 1,043 items over four years. Some of the problems happened because associates would make pricing changes to items in the store's register database but not in the aisle.
There's an E-mail campaign that says consumers can identify American products by the first three digits of the barcode. In theory, this would allow people who only want to buy American products an easy way to do that. The only problem is that the trick doesn't always work, which means it could have the opposite effect.
When are related product lists helpful and when are they distracting? Is it an obviously useful upsell or is it doomed to the fate of the salesperson who shows a customer one too many choices? HP thinks it's often the latter and has sharply trimmed the number of related items it shows. And the company is claiming a 30 percent sales increase as a result.
As more retailers try to go where the customers are rather than getting them to come to the retailer, TiVo and Domino's are taking the next logical step with a TV-as-E-Commerce-Device approach.
We make calls on PCs and surf the Web on our phones. The lines of separation are blurring fast. But in the world of retail technology, the difference between a kiosk and digital signage is one of the more difficult distinctions to make. How to describe that difference? To one CFO, the answer was obvious: A poem. In rhyming verse. Rhyming verse that is so bad it's almost good.
The further employees get from corporate, and from corporate networks, the more likely they are to do things with their computer that security managers would rather they didn't. GuestView Columnist David Taylor asks if these people might be doing things (e.g., downloading malware) that could bring down your company?
Podcast panelists debate card replacement problems, including inadvertently printing encryption keys on customer receipts and the refusal of the card brands to shorten how long expiration dates are valid. "We now have to worry about data that's been there as many as 12 years."
A loyalty card that consumers can turn on and off could potentially usher in a consumer revolution of sorts, allowing the majority to punish merchants they see as misusing CRM data that has been entrusted to them. At least that's one scenario painted by the president of the company that is pushing the card.
Amidst an avalanche of hype about the desirability of gift cards this holiday season, the National Retail Federation on Tuesday (Nov. 18) predicted a six perfect drop in gift card sales this season, from $26.3 billion spent during last year's holiday season to a projected $24.9 billion for this season.
Some 30 meters below solid bedrock underneath Stockholm, an abandoned nuclear bunker has been transformed into what could only be described as the world's coolest datacenter.
Several factors are lining up—including rushed technology upgrades, more site handoffs for everything from mobile to social networking widgets and a surge in traffic from bargain hunters—that could easily make this holiday shopping season one of the crashiest in years, if not the crashiest. (Note to copydesk: I don't care if crashiest is not a word. It should be.)
When Sears rolled out its mobile effort (Sears2go) this month, it illustrated the challenges for a retailer trying to craft a clean and stable mobile strategy at a time of extreme flux for the mobile space.
When E-Commerce execs try and understand abandoned shopping carts, they often overlook concrete clues. One of the best is whether shoppers clicked on the store locator link right before leaving. But deciding what to do about abandoned carts, that gets complicated. The innocuous-looking store locator is akin to waving a red cape in front of the face of an E-Commerce manager bull.
