Marie Hartley, a 33-year old retail worker from Huntington, Indiana, who loves to shop for bargains was surprised to discover a tag inscribed with a metallic squiggle attached to a bra she purchased online from Victoria’s Secret in January.
She’s previously bought items with these kinds of tags from Victoria’s Secret and Walmart stores. But since she stopped shopping as much in stores over the course of the pandemic, she hadn’t yet seen one in an online purchase.
“I am used to the big, plastic, bulky ones that were anti-theft,” she said. “The newer ones are ultra thin and you barely notice them.”
Months after a string of high-profile retail thefts, retailers are looking to turn the itchy tags attached to the back of a blouse or new pair of jeans fresh off the rack into a more sophisticated piece of covert tracking technology used to set off store alarms or help identify stolen products being sold online.
While there is no specific data about how many retailers are using the radio frequency identification, or RFID, technology to track shoplifters, an estimated 15 percent of retailers have adopted it, according to retail security experts.
Victoria’s Secret, among other retailers, attaches the tags to online orders to track merchandise across its supply chain, Brooke Wilson, a company spokeswoman, said. It also is testing the tags to prevent theft, she added.
“What you’re seeing now across retail and the staffing challenges for law enforcement is a greater need for retailers to package the cases to do all the investigation,” Joe Coll, vice president of asset protection, operations and strategy at Macy’s, said during a webinar last week hosted by the trade publication RFID Journal. “RFID gives you that ability.”
But while retailers say the technology helps them track inventory and stop theft, some consumer advocates are concerned about shopper privacy. Although the tags can be removed by customers once they leave the store and don’t by themselves allow stores to identify shoppers, privacy advocates are concerned that customers could be tracked in stores without consent.
“They are essentially just a little bit of technology and it has a little data that is usually a unique identifier,” said Eric Null, director of the privacy and data project with the nonprofit Center for Democracy and Technology. “So anyone who has access to a reader can track that RFID wherever it goes if they’d like to.”
RFID has privacy implications particularly because of a company’s ability to track people inside their store to provide very finely targeted ads based on a shopper’s movement patterns or whether and where a person lingers, he said.
However, retail security experts point out this technology is not very sophisticated. It does not allow retailers to broadly track a customers' whereabouts if they are wearing the clothes and cannot even help track items if they’re stolen or lost. Instead, RFID chips require specific reader guns to access the information contained in the tag and these reader guns only work from 10 to 30 feet away, said Dean Frew, the chief technology officer and senior vice president of RFID Solutions for SML Group. This would make it nearly impossible for the tags to be read by someone without a RFID gun from far away, he said.
“What is going to be attached to that file is not what you think,” said Read Hayes, director of the Loss Prevention Research Council. He added that the tag includes data such as the size or the color of the clothing or shoes. “It’s not ‘I’m Read Hayes. I live at this address and this is how much I make.'”
In a retail store setting, RFID tags originally took the form of hard plastic pins fastened to products that couldn’t be removed without a magnetic device at a checkout counter by a store clerk. But now, they typically appear as small metal prints on a cloth tag along with a garment’s sizing and cleaning information. The devices contain a tracking number associated with that particular item’s model, color or size.
These tags have traditionally been used by retailers to track products along the supply chain and to alert store associates when an item might be low and need restocking. But with the RFID tagging becoming more common, retailers have started to use the tags to combat theft. Customers can remove the tags once they purchase the item.
As one of the early adopters of the technology, Macy’s has used RFID to track items for theft prevention since 2014, according to Karina Frayter, a company spokeswoman. The department store installed “smart exit” sensors at both customer and employee store exits which are rigged with technology designed to recognize a tag’s merchandise number, Coll said. If the store suspects the item was stolen, Macy’s can then review video footage and determine who swiped the merchandise, he added.
“It was basically like bringing TSA to our exits in our stores having the ability to truly understand with a significant level of confidence about what product was leaving our building,” he said, referring to the Transportation Security Administration.
The technology also helps Macy’s determine which types of items are more likely to be stolen at what times of year, and repeat shoplifters, Coll said. For example, during the late summer the company found shoplifters walking out of the store with stacks of coats.
Retail’s demand for more robust security technologies has increased over the last two years, according to asset protection experts.
Organized retail theft, in which a group of people strategically and routinely steal from stores, has always been an issue in the retail industry. But what has changed is the public nature of some of the more violent headline-grabbing theft incidents and the sophistication of security technology which allows retailers to covertly police stores while keeping up a peaceful shopping experience for consumers, said Wouter Ubbels, vice president of sales with Nedap, a Netherlands-based retail RFID company that works with stores such as Under Armour and Sephora.
“The way a store looks and the experience has become so much more important,” he said. “Security has been forced to become more innovative because it’s not allowed anymore to show you think your customers might be thieves.”
While the technology is limited, these tiny RFID tags allow retailers to track when inventory goes missing, which helps alert store managers to a potential theft, he said. Stores have real-time insight into what inventory is on the store floor or if an employee gave a refund or a store credit to someone for the tagged merchandise that was never actually purchased. It can also be used to spot returns fraud where someone steals an item from one store and attempts to return it at another store for a refund or store credit.
Tony D’Onofrio, the CEO of Prosegur Security global retail business, a global security technology company, said retailers are working with the company to upgrade their tagging systems so that they can gather more information to help police with their investigations.
“Retailers want to move faster,” he said. “With the way communication is now, we have to move much more aggressively.”
But as retailers speed ahead with RFID-enabled security strategies, consumer advocates raise concerns about how such tags could be used by retailers for marketing purposes without shopper consent.
Stores can use the tags to track anonymous shopper behavior information in stores to learn more about consumer preferences without their expressed consent, Null said. Retailers could also share that tracking data with third-party sellers, he said.
“Consent is absolutely necessary (and the bare minimum requirement) when tracking people’s physical location,” he wrote in an email.
Already, several retailers have experimented with RFID tagging for marketing and consumer behavior analytics. In 2016, Burberry rolled out RFID tagging on select merchandise at its flagship store on London’s Regent Street that can trigger a television display or ad when the tag crosses a sensor. Burberry did not respond to NBC News’ request for comment.
A year later, Rebecca Minkoff rolled out a line of “smart bags” fashioned with an RFID tag customers can use in their stores, and a unique QR code that allows shoppers to engage with the company about their specific product online or receive news about special offers. Rebecca Minkoff did not respond to NBC News’ request for comment.
But Hayes of the Loss Prevention Research Council, said shoppers are typically comfortable giving up some level of information — even if it’s anonymous — for convenience or entertainment.
“If we buy online, we’re giving up a lot of privacy compared to brick and mortar because a company is not just going to ship something out anonymously,” he said.
Regulations around RFID tracking technology are spotty, Null said. Europe has been developing extensive regulation regarding RFID technology since 2009 by requiring retailers to make customers aware it’s being used and what data is collected through the tags. In the U.S., some states have laws that prohibit unauthorized access to data on an RFID chip, including California, Nevada, Washington, Alabama and Illinois. But shoppers are largely at the whim of retailers’ voluntary disclosures.
Hartley said she’s not worried about tracking, but perceived health risks. A World Health Organization review of scientific literature showed there is no evidence of any health consequences from exposure to low level electromagnetic fields such as the ones required to read an RFID tag. Still, she believes shoppers should be aware.
“I believe in personal responsibility and individual personal choice,” she said. “I think it’s important as a person to be aware of what’s around you.”