Evan Schuman's StorefrontBacktalk

The legislation reaches well beyond bookstores and physical books, covering audio books and E-readers as well as almost any retail chain that includes a books section. (Barnes & Noble? Definitely. Wal-Mart? Certainly. Safeway? Maybe.) The bad news: Retailers covered by the law will be required to create a detailed, publicly available annual report covering how much customer information was disclosed the previous year—whether it was disclosed with customer approval or not.Read more...

The program was reported on by a Florida TV station, when an apparent Macy's LP employee revealed that the slots on some dressing room doors were turned upside down, thereby providing an unobstructed view of sometimes naked customers. The station said it confirmed the program in Macy's stores in Florida and Washington, D.C.Read more...

Unfortunately, bankruptcy courts really don't care what promises were made to collect CRM data—it's an asset, so it's for sale. Unless retailers can find a way to enforce customer privacy even after the retailer has gone belly-up (something no retailer wants to think about in creating a loyalty program), there's a very real risk of losing customer trust—and gaining the unwanted attention of politicians who have discovered that privacy is now a popular buzzword.Read more...

As retailers—including Albertsons LLC and Kroger—rethink whether self-checkout still makes long-term strategic sense, loss prevention and other security considerations are shifting. It's always been known that self-checkout systems would theoretically make theft easier, so these lanes have been accompanied by more security cameras, anti-theft tactics and closer supervision than staffed lanes. But the legal issue that self-checkout lanes can make it easier for caught shoplifters to escape prosecution, now that's a new one. Associates assigned to self-checkout supervision are specifically charged with theft detection—and that's where things get legally dicey.Read more...

"I was with a large merchant last week who described NFC as Not For Commerce," Donahoe said during a quarterly earnings call. That is "simply because when you're a large merchant and you have 500 stores and 14 checkout lanes per store, you want zero friction at checkout and point of sale. And they're not going to allow anything that has friction. No proprietary systems." Beyond proprietary hardware and software, the lack of industry standards will also be a big help to PayPal, he said.Read more...

Exactly one week after that federal court decision, CAT agreed to a stipulation that it was surrendering the defense of those last three claims, effectively killing the case. They will consider an appeal—and if the appellate panel reinstates the case, everything is back on—but the case appears dead for the time being.Read more...

PayPal says it is acquiring Zong for online purchases of digital goods, which is what Zong is used for now. But Zong's approach is simple enough that it could be used for in-store payments, too—without NFC or smartphones, using existing POS hardware and without payment-card interchange or PCI requirements. Is that what PayPal has in mind?Read more...

As retailers try to master the new terrain of today—with mobile payments, item-level RFID, QR codes on subway walls or digital receipts—it’s good to know the largest insurance companies have their backs. It’s just that some of them seem to be holding knives.

At least that’s the sense one gets from The Hartford (Hartford Fire Insurance), which has now filed federal lawsuits in Illinois and New Jersey to tell two of its retail customers—Children’s Place and Crate & Barrel—that they’re on their own in defending against some POS lawsuits. The specific litigation involves consumers suing the chains because store associates asked for Zip codes at checkout. How prohibited such conduct is remains under debate, but not at Hartford, which has a fine-print exclusion for defending anything “arising out of the violation of a person’s right of privacy created by any state or federal act,” according to copies of both lawsuits. Whatever happened to the days when insurance companies saw their duty as defending their customers? (Answer: They were all April 1.)…

The European decision also points out the increasing legal split between U.S. and European E-Commerce requirements. For example, in the U.S., one-click checkout requires a license from Amazon, but cookies can be used routinely for customer tracking. In Europe, 1-Click is unpatented, but many cookies will soon require an opt-in in E.U. countries. The further the two markets drift apart legally, the more complicated cross-border E-tailing becomes.Read more...

The risk for Amazon isn't just that its referendum effort might fail. Long before the 2012 election, Amazon and California tax officials will be in court, and that could rule the law valid or not. But going after the tax through such a highly public political process is likely to put every brick-and-mortar competitor and disgruntled customer on the other side of the campaign—and to make this a referendum not just on the Amazon tax, but on Amazon itself.Read more...

On the one hand, we have a meticulously planned revenge plot of a soon-to-be-fired network admin, who the Manhattan District Attorney's office said prepared a year in advance for the assault by creating a fictitious employee and giving him high-level network access. On the other hand, would someone who had served as the Gucci network administrator for nine years create such a nefarious account using his own account name and password? Would he then access the account and E-mail repeatedly from his home, making no attempt to hide his IP address?Read more...

Every now and then, there’s a retail use of online that is actually likely to do good at the same as it helps retailers do well. The Retail Orphan Initiative on Tuesday (July 12) got quite close when it rolled out a charity-locator feature designed to deal with retail overstocks. One of the historic problems charities struggle with is the logical challenge of connecting companies and people with food, clothing or other items that they want to donate with entities in a position to accept and redistribute where they’re needed.

The Charity Locator is designed to help retailers get tax write-offs while dealing with some $65 billion of overstocked items every year. The locator features an interactive map of nearby charities from a RetailROI-developed database of 501c3 organizations across the country that focus on at-risk children, women in distress or families in need. The charity locator includes the top 125 cities and the top 300 largest malls in the U.S., with information on types of items each charity accepts, including clothing, food, furniture, building materials and educational materials. The system automatically recognizes the address of the retail store and suggests three to five local charities that will accept donations. It’s definitely worth considering.…

The fact that two retailers, which both own one-half of what years ago was a consolidated Albertsons chain, take divergent views on a checkout technology is not surprising. But the ferventness of the opposite positions, coupled with the intensity of the consumer love/hate for the self-checkout—note the emotionalism in the comments on both the links above—is impressive.Read more...

If a merchant rejects the transaction, the customer may be offended, confused or just go away. These are bad outcomes for the business, whether it is a retailer or a charity, pens PCI Columnist Walt Conway. On the other hand, processing the transaction means the particular communication system (and everything connected to it) is now transmitting cardholder data. This is the case even if the customer wasn't asked to provide the information. Processing the transaction can increase merchant's PCI scope, thereby leading to an even worse outcome with broad implications for the enterprise. Read more...

But the chain's mobile move is missing most of the value of mobile, and this is especially disappointing given that the free Wi-Fi is part of a major in-store television rollout. The chain's 5,600 locations will have video throughout the store that will "feature engaging content such as music, lifestyle, entertainment and sports, and also free Wi-Fi to keep our consumers connected with their friends." That sounds fine, although it's supremely vague, even for a news release. ("Hmmmm. What type of engaging content will you offer?" "Entertainment." "You sold me.") But here's where it starts to get sad. Is that informational—as in "alert me if severe weather is suddenly predicted for the area I am in" or "message me if there's news on any of the following keywords"—or is it merely ads?Read more...

Indeed, the vendor—Card Activation Technologies (CAT)—probably knew that the 74-page ruling was going against it when the judge wrote on page 33 that "it takes some chutzpah" for CAT to have made some of its arguments. The fact that the judge's day job is serving as a member of the U.S. Court of Appeals for the Third Circuit probably made it sting all the more. Not that RadioShack, 7-Eleven, Nordstrom, Macy's, JCPenney, Sears, OfficeMax and the many other retailers that have been sued by CAT would take any pleasure in the ruling. The ruling also dealt with the specifics of the payment system. "CAT asserts that a general authorization code is disclosed by the terminal ID. CAT's argument boils down to its claim that the terminal ID is a general authorization code because 'it is a precondition for establishing communication with a host computer.' CAT confuses the ultimate effect of the terminal ID with the purpose of it."Read more...

The first bill, introduced by Senator Al Franken (D-Minn.), is called The Location Privacy Protection Act of 2011. It is trying to force telcos and retailers to get the consumer's "express consent before collecting his or her location data and to get that customer's express consent before sharing his or her location with third parties." The second bill, introduced by Senator Ron Wyden (D-Ore.), is called The Geolocational Privacy and Surveillance (GPS) Act. It is designed to restrict how government investigators can access mobile-location data. The key problem is that these bills are focused on location-based mobile services, and they tend to forget that the most common location-based mobile service is getting the phone to ring when receiving a call.Read more...

PCI Columnist Walt Conway is not convinced that requiring every merchant to use SAQ D, with its 280-plus requirements, makes sense. It is just too daunting for a small or midsize merchant. On the other hand, we see increasing numbers of hacking attacks on these same merchants who use the shortened SAQs, so they need to be more secure. Maybe a better course is to upgrade the shortened SAQs or even change them into "guidance" documents. Read more...

One key problem: tracking interchange rates for each network available for each card. That is hard enough for a retail IT shop to do now, before the Fed's rules kick in. And although your CFO will probably want you to minimize interchange fees for each card as it's processed, automating that won't be cheap—whether you're paying your processor to pick the best deal or doing it yourself—and may not be worth the trouble.Read more...

Sources within both Kroger and Albertsons LLC cited the same self-checkout concern, which is that many customers perceive it to be less customer-service-oriented than staffed checkout lanes. Also, an increasing number of products require staff intervention, and that—coupled with consumers making errors in using the systems—can slow the self-checkout lines dramatically.Read more...

But E-tailers' legal dance to avoid paying the sales taxes that brick-and-mortar retailers collect and remit every day may be futile. Although their move might buy them a bit of time, in the end, death and (sales) taxes are inevitable. Allowing states to collect Internet taxes will literally require an act of Congress—and such a law could be introduced this month.Read more...

The curse of the Web site upgrade has struck again. But fortunately for Amazon, which Web-monitoring service Pingdom reported to be down for more than three days last week, the E-tailer’s site was working fine. The Amazon-is-down alert “referred to a problem we had getting to Amazon due to something they’d done with their system,” a Pingdom spokesman later explained. “Amazon started treating monitoring services [and most bots in general, if they presented themselves as such] slightly differently for a while. Most likely it wasn’t even intentional, just some side effect.”

This isn’t the first time E-tail updates have wrecked havoc with uptime tracking systems, as 1-800-Flowers discovered in February. Exactly what Amazon changed to confuse Pingdom’s bots isn’t clear; Amazon wouldn’t comment. And in fairness, it’s not an E-tailer’s job to play nice with monitoring services. But something at Amazon continues to drive monitoring sites a little crazy. On July 1, after the Pingdom problem was cleared up, there was a rash of Twitter reports that Amazon was down. They were based in part on the popular downforeveryoneorjustme.com site, which reported: “It’s not just you! http://amazon.com looks down from here.” As of tonight, that site still thinks Amazon is down.…

Pity poor Google. The only major technology company with a number for a name spent last week bidding for a set of patents from Nortel, the bankrupt Canadian telecom company. According to Reuters, Google’s only bid that wasn’t unusual was its $900 million stalking-horse bid. Then came $1.902160540 billion (which is a number very close to Brun’s constant, the sum of the reciprocals of all twin primes), followed by $2,614,972,128 (a multiple of the Meissel-Mertens constant, and trust us, you don’t want to hear what that represents), and then pi billion.

Opinions are split over whether Google was being seriously nerdy with its bids or just running up the final price with bids that were part of an elaborate mathematical prank. The oddball bids clearly annoyed the sober Wall Street types closely following the bidding, and in the end it was a coalition of Apple, Microsoft, RIM, Ericsson, EMC and Sony that paid $4.5 billion for the patents after Google dropped out. Too bad—if only Google had bid the first Feigenbaum constant, it might have walked away the winner.…

Apparently, the latest retail trend is walking out of a Walgreens with a cash register. That happened three times last month: First in Orlando on June 10, when a man was spotted on surveillance cameras only after he disconnected an unattended cash register and walked out, according to local news reports. Five days later, a man in Gary, Ind., disconnected an unattended cash register at a Walgreens cosmetics counter and walked away with it. Ten days after that, a man in a different Orlando Walgreens again walked off with an unattended cash register (this time he dropped it in the parking lot before driving away).

Many Walgreens stores have modular POS systems that include a separate (and unattached) cash drawer under the counter, and maybe that’s what newspaper reports called a “cash register.” But when a thief can walk in, duck behind a counter and spend three minutes unplugging any piece of a POS, then walk away unnoticed, maybe it’s time to start making it a little less easy to swap out those modular POS pieces—or maybe add an alarm when the cash drawer is removed. At least these thieves weren’t tampering with PIN pads. Er—has anyone seen the PIN pads lately?…

Groupon’s subsidiary in India, Sosasta, has exposed the E-mail addresses and unencrypted passwords of all 300,000 of its users. The Sosasta user database was found on the Internet by Australian security consultant Daniel Grzelak, who was using ordinary Google searches to hunt for exposed databases. Grzelak notified Groupon last Thursday (June 23), and the company said it immediately locked down the database and began notifying subscribers.

Groupon, which acquired Sosasta in January, said in a statement: “Sosasta runs on its own platform and servers, and is not connected to Groupon sites in other countries. This issue does not affect data from any other country or region.” In light of recent E-mail spills from Epsilon and Sony, maybe it’s a good thing that Groupon hasn’t had time to properly integrate a new acquisition. And with the new data-privacy rules that India has enacted since Groupon bought Sosasta, at least now Groupon knows it has a problem.…