Surveillance Pricing: When Your Data Sets the Price

0:02Welcome to the Shared Security Podcast, the longest running cybersecurity and privacy show for actual humans. No jargon, no hype, just honest analysis from industry veterans who've seen everything and survived it. Each week we break down the stories that matter, expose the nonsense that doesn't, and give you the tools to stay safe in a world where everything is connected and nothing is guaranteed. This is Shared Security. What if the price you see at the grocery store, on a delivery app, or an online ad is not really the price, but it's your price?

0:47So this week we're talking about surveillance pricing, the use of personal data, behavioral profiles, location shopping history, income signals, household assumptions, and AI-driven targeting to decide what price or discount different people see for the same product. Now New Jersey just passed a bill aimed at banning grocery surveillance pricing. Consumer Reports is warning about loopholes, and we've seen a Papa John's campaign that used Instacart and streaming ad data to target people when they were likely running low on groceries.

1:26So this isn't just dynamic pricing in the airline ticket sense, it's pricing based on what companies think they know about your life, when you're hungry, what your household needs, and maybe how desperate you are for a pizza. And joining me for this conversation is my co-host, Mr. Scott Wright. Hey, I'm always desperate for a pizza, man. You know, that is the one weakness I think most people have. If you see a good pizza ad show up on your streaming service, right, and you happen to be hungry and in the mood for pizza, what's the most likely thing you're going to do?

2:05Yeah. Could be streaming ads all day for pizza for me. Yes. So how are you doing, Scott? Not bad, Tom. How are you? I'm great. Too bad Kevin couldn't make it today, but this is now my second week at Secure Ideas. Yes, you are a member of the Borg. Well, I'll be sure to tell Kevin that we are the Borg, but yes, this is my second week of being professionally evil. You don't look any different. I know. I looked exactly the same. I know. Yeah. Well, it's been great.

2:39I've really enjoyed meeting the team and already digging into a lot of things in the company, so I believe I'm leading the consulting team. Awesome. That's great. Exciting. I'm really happy to be working at Secure Ideas. It's been great so far. And yeah, so maybe next time. I'll have to resist. I know Kevin's been asking me over and over again, but I've been resisting. Yes. So maybe one day we'll start a Canadian office in Ottawa, right? Well, sure.

3:12Yeah. Why not? Yes. Why not in the city that Fun forgot? Anyway. Oh, man. Yeah. I had to bring that up. I thought it was something that you maybe just think of, but I can't remember this. I thought this would be a good story for telling Tom about the city that Fun forgot. Yes. Maybe next time. But yeah, we're talking about surveillance pricing on this episode. And first I wanted to start by, and I mentioned this in the intro, was this is different than dynamic pricing that we hear about like with airlines, right?

3:45They're obviously adjusting their price based on supply and demand and the season and all of these things. Or you go to Walmart, and I don't know if you've noticed, Scott, that they all have these digital tags now. These old price tags, yeah. Yeah. And that is essentially dynamic pricing where they can just change the price as they see fit based on demand or based on other factors. But that's not actually targeting you specifically. No. And that's where...

4:16Interesting. Just a quick little interesting side note about those little dynamic price tags. I was actually commissioned like 10 years ago to do a risk assessment on those tags because you can imagine people trying to hack them, right? Yeah. Anyone. Side story. Yeah. I always think about hacking those things would be a little more difficult because in the back end, they actually have rights because that's what you're scanning the UPC code at checkouts, and so that has to match what's in the system.

4:48Right. But if a customer takes a picture of the price showing $3.99 for a car battery, right, $3.99, and then you take that picture and you say, well, this is what it said on the tag, and we have a lot of stores will honor what's shown on the tag. That's a good point. Yeah. Going to a competitor, right? And saying, hey, it was cheaper at Walmart, give me the price, and yeah, some people try to do that. All kinds of shenanigans. Oh, yeah. But what we're talking here is the surveillance pricing, which means a company or a third party has information about you, and it is influencing the price that you pay, and it's getting down to either you being in a certain demographic of people.

5:32So I think there's been some examples, and we'll link some of these in the show notes of past things like Tinder, the dating app. They offered higher prices for older people than younger people. Like, that's just a simple example of based on your demographics, they're going to have some type of custom pricing for you. But where it gets interesting is, and I like the Papa John's example, which was about Instacart and the partnership they had with Instacart, and they would be getting shopping data from Instacart of what people were purchasing, when they were purchasing it, location information, and those types of things, and they had some algorithms that could determine you might be hungry for a pizza during this time based on your shopping history and through, I think it was like NBC Universal, the streaming app, it would know you are watching based on your data and who you are matching that data up and then serve you ads for pizza based on that data.

6:37Yeah, I mean, it makes sense, especially in the streaming media world, because they're constantly recommending stuff for you, so they have the algorithms to decide how to present stuff to you based on your habits, right, from just viewing, and it makes sense they could take different data about you and say, well, instead of recommending certain content or shows to watch, let's put up different ads for them. And that's, it almost, to me, starts to sound like the minority report. Yeah, the movie is Tom Cruise going through the stores and seeing all these ads flashing up. That's going to get annoying real fast, right? Yeah, yeah, it is. And I think it just opens up a conversation about you don't know what companies or who is doing this, right? So the transactions you're making on a daily basis when you purchase products, I mean, even just think about Amazon, right, like they could easily, I mean, 100% are probably using doing some type of surveillance pricing. I mean, just looking at the price of things and it's more than just, oh, hey, we see that you've bought this thing five times in a row. Now, Amazon, when they're

7:54right now, will tell you, hey, you should sign up for a subscription and we'll give you a small discount, you know, because this is something you reorder all the time. But there's nothing stopping them from taking that further, you know? And I think there are certain, I guess, challenges or obstacles to them doing this, you know, to the nth degree, because in a lot of markets, you kind of have to publish a list price. But in cases where you've got a loyalty program, for example, and you've signed up for things and you might get extra points or what amounts to a discount, I think it's probably much more workable that even for fixed price items, based on your behavior, they could offer you a different amount of points and turn that into a certain value. And all it comes down to is a value exchange, right? It's your giving up your personal data about, you know, your habits and things you like in exchange for reduced value or reduced costs on things you're buying. So in a loyalty card sense, I don't think it's a real problem. I think it's like you said earlier, it's a real capitalist model. There's no real

9:12issue that where I think there becomes a huge issue is when it's done without your knowledge or consent and you're tracking people's location data or, you know, any other things that they might be doing inadvertently and not knowing that they're being tracked in some way. And I can imagine, for example, take a grocery store that buys data about their customers, you know, if they know your address or your phone number, they can probably buy a whole bunch of other data about you that will help them in some ways target you or whatever. But what if they start gathering additional information about you and then augment the two or combine the two together? Maybe that's worth something for them to sell without your knowledge, right? So it gets into a gray area for sure when you look at what they could be doing with that data or collecting information about you without your knowledge.

10:04Mobile apps are just part of everyday life now. Banking, healthcare, shopping, entertainment, you name it. And with that comes a lot of trust because users are putting their personal data directly into your app. But here's the reality. Mobile apps are a growing target. A recent survey found that 72% of organizations experienced a mobile app security incident last year. And 92% say threats are only increasing. And the way attackers are going after apps is pretty sophisticated.

10:35They're reverse engineering them, modifying them and redistributing fake versions through phishing campaigns, side loading and even third party app stores. So from a user's perspective, everything can look completely legitimate. That's why taking a proactive approach to mobile app security really matters. You want to stay ahead of these threats not react after the damage is done. This is where Guard Square comes in. They provide advanced protection for both Android and iOS apps, along with automated security testing to catch vulnerabilities early and real time threat monitoring. So you can actually see what's happening out there.

11:12If your mobile app is critical to your business, and it probably is, this is something worth paying attention to. You can learn more at guard square.com. That's guard square.com. Yeah, I 100% agree. And I think you mentioned just like grocery stores and grocery pricing, I think is the, the big area that we are seeing this right now. And in fact, that some of the laws, like I mentioned, New Jersey and California, and there's other states in the US, they're trying to pass these types of laws banning surveillance pricing or severely limiting it because any grocery stores out of any type of shopping that you do, they encourage you to sign up for these loyalty cards in the spirit of discounts, right? Like, you're going to get these discounts if you give us, you know, use your loyalty card. And I don't think we often think about the power that the grocery store chains have. And now, especially with AI, like they can now take all of your data. And I mean, that's the the best thing about AI, right, is they can correlate large data sets together. And now if you imagine like the thousands and thousands of customers that a big grocery store chain has, the

12:33powerful data that they have about people shopping habits when they shop what they purchase, you know, and I think it's an opportunity and maybe this is some research that that we could do is what are the privacy policies around these loyalty cards, because I would be willing to bet that there is probably some disclosure about I would hope so that of how your data is being used and maybe what third parties that data is being sent to or correlated or or those things. And I'm not saying stop, you know, using loyalty cards, grocery stores. I just think that it's an area that this surveillance pricing is is kind of that's what we're seeing the examples, the laws that are being passed are kind of focused around that and the food industry. And I think it's because, well, it's an essential thing, right? People have to eat. And what a way to increase your capitalistic, you know, market share, I guess, is based on people's hunger.

13:43Yeah, you know, I think from a practical point of view, you know, like you said, we're not saying stop using loyalty cards or whatever. But in a practical sense, you probably if you do have a loyalty card, you know, maybe we'll do this in a study at some point and publish some interesting information about the policies of these things. But, you know, when you when you realize that you're using a program like that, there's probably a privacy policy or maybe some privacy options, you know, in your online account for that thing, you should go in and have a look at and maybe there are things in there that grant them the right to sell your data to other people and you don't want that. So that's probably the most practical bit of advice I can take out right now for you.

14:24Yeah, and this this goes way back. I remember, you know, Scott, we've we've probably talked about this on the podcast. And I remember giving a talk, I think it was way back in like 2012 2013 at Infosec World about just the surveillance cameras that were first coming out and how they could identify you and link you back to Facebook, right, to pull your Facebook profile. And then you would walk into these stores and you would all of a sudden get a message on Facebook that, hey, thanks for visiting. Here's 10% off your next purchase. And you don't see a lot of that anymore. Like everything is more like opt in. But I also it just makes me wonder, like, we've been talking about this stuff for years. Yeah. And I don't think it's gotten any better. Really, I think maybe we're just a little more used to it. We don't notice it as much. But there's still I still get stories, people telling me stories every month about being somewhere, having not done any searches, but just in the room where they talked about something or maybe they just drove down a street where there was a certain vendor and all of a

15:28sudden they're getting ads for that, you know, that organization. So clearly the ad networks are walking a fine line or maybe even in the gray area around using behavioral information and advertising. And I think that's kind of where this kind of you have to focus and say, are these things do we want them to be legal or not? Yeah, because there are extremes to all of these things. And I think none of these companies intentionally want to be creepy about it.

15:57And I think that was, you know, it kind of in the article that I think Bruce Schneier had linked about the Papa John situation, but it still comes across as creepy. I don't even know if I buy, I'm gonna take Kevin's thing. I don't know if I buy that they're not trying to be creepy. I think in a lot of cases, you know, the executive's compensation depends on how they do the next month, right? So that's right. We can scare a few people or entice a few people with a new with a pizza. You know, you can imagine ads, not only are they being sort of served dynamically to you and ad for a pizza, imagine a dynamic AI generated video that comes on as an ad for you, like the video is created for you dynamically, right, rather than just selected from a library of ads.

16:44And that's going to get really creepy. I don't know how we're going to deal with that. Well, I, I, yeah, I think you're right. I think it is coming. And I think it is depending on the services that you're using, that may already be here. We just may not be noticing it because it is on that borderline, not creepy factor. And, but with AI now, I could easily see a world, like you said, with Minority Report, the movie, right? Like where you're walking into a gap, I think, was that scene and they're scanning your eyes and they know all of your previous purchases. And, you know, I mean, that is kind of the, the capitalism utopia.

17:26The merchants, I guess it is. Yeah. Yeah. So we'll see where this goes. But I think our advice for our listeners is, you know, assume that these loyalty programs and shopping apps, I mean, they are data collection systems. Like at the end of the day, they are still collecting data about you and your shopping habits. And, and of course, you may be getting discounts and coupons for signing up for these things. But just be aware that your data could also be used from a surveillance pricing perspective. And you may not know it, right? But you may want to do your own kind of research of like, you know, compare prices, whether you're logged into your app with your loyalty program versus logged out to see what pricing that the general public might get.

18:12You might be surprised to see, right, that there may be a difference in that price. And you may be actually paying a higher price depending on your data and the program. It's something to just check out. And the other thing I'd say too is just, you know, continue to reduce your location sharing within your applications. You know, does your loyalty app need access to your location? Do you need to give it? How many people are in your family and all of this personal data, right? When you sign up for these things. Be very careful about that. I'm always a big fan of just putting in like fake information into those things. You know, so I'm not giving away where I really live or my real address or things like that. But that's one approach, right? Because we know we can't stop all of this. And there are places we legitimately want to shop at. And we want to purchase products from. And there's companies we want to support. But it's just something we need to be aware of that the price could be changing depending on who you are. It's a really interesting, I think it's a great time for this episode, just in terms

19:16of opening people's eyes to, you know, yeah, I remember the loyalty program. And I, you know, I know they're gathering my personal data, but wow, I didn't know they're doing this, right? So it's a really good eye opener. Yeah, so if you're listening this or watching this episode on YouTube, let us know. Like, have you encountered a situation where you've seen different pricing for stores or online shopping or grocery stores and use have suspected that surveillance pricing was something that was happening. We'd love to hear from you.

19:48Love to hear your stories. So you can either comment on YouTube or send us an email feedback at shared security dot net love to hear from you. And we can we can mention that in the next episode. Yeah. And if while we're talking about feedback, like to just put in a little bit of a plug for the book I am working on calls the digital legacy tree. And as you can imagine, if you're familiar with the concept of digital legacy, it's you know, what happens when you die and your all your accounts, you know, go into limbo, who has access to them, et cetera. But it's more than just your passwords and two factor authentication. And as I do research on this, it becomes really intriguing that the number of people I talked to who say, you know, it's not just the password, like I wish I knew how this person lived their life, you know, what's the context that this was used in.

20:37And so that's the kind of stuff that I'll be talking about. So I'm interested in hearing anybody's stories if they want to share an anecdote anonymously or however about situations where people have passed away and it was hard to either get in their accounts or figure out what what to do with them, you know, I have personally actually last time I pruned my bit warden, it was over a thousand accounts I have. Yeah, things right. And they're not all going to be stuff that you want your authorized decision maker after you die to have to go through. So I think it's another area where we need to focus. So love to hear people's feedback. Again, feedback at shared security.net. Yeah, yeah. Thank you for mentioning that, Scott.

21:21And do you still have that page up? I think we had a link to yes, I do. Yeah, we'll link that in the show notes for for our audience. But if you want to see the great important project that Scott is working on with the book, you can find out more information about that through that link. All right. Well, thanks everyone for listening. And until next time, stay safe, stay secure and stay private. Thank you for listening or watching. If you like this episode, hit subscribe, share it with your friends and colleagues or jump into our community at shared security net slash supporter to keep the conversation going. Thanks again and we'll see you next week for another episode of shared security.