>> From WXXI News.

This is Connections.

I'm Evan Dawson.

Our connection this hour is made on your next flight.

Let's say you're searching online for plane tickets.

You check one site, then you check another.

Then you go back to the original site.

But something distracts you.

The next day you search again and now the prices are changing.

They're going up.

You wonder why this could be.

After all, it's only been 24 hours since you last checked on the prices, but they are watching you.

They know that you've been searching multiple times.

You must really be interested and they can move the price accordingly.

That is just one example of surveillance pricing.

The idea that information about you can be used to dictate the price that you pay for a flight, or for shoes, or for groceries, or for really any number of things.

But who is the they when they are watching you?

Mostly it's A.I.

Today's tech knows a lot about you, and it can help companies decide how much they can try to get out of you.

Now there are multiple efforts to try to ban surveillance pricing.

Several states are exploring it.

There's a federal effort underway in the Senate.

Democrats, including Kirsten Gillibrand and Ruben Gallego, have supported the One Fair Price Act, designed to prohibit using personal data to set individualized prices in the house.

The stop A.I.

Price Gouging and Wage Fixing Act has a similar purpose.

Recently, Wegmans was involved in some controversy locally when the grocery chain admitted to using facial recognition technology in some of its stores.

But Wegmans says their purpose is simply to identify individuals who have previously been flagged for theft or other misconduct.

So Wegmans says it's about store security for all shoppers.

Not, as Wegmans might say, an example of surveillance pricing, just surveillance.

The New York Times notes that surveillance pricing has hit a nerve with the American public in the last year or two.

Laura Kelly writes, quote, new parents might be shown baby thermometers at the top of their search results that are more expensive than those shown to the couple seated next to them.

Someone who's just gotten paid might not be offered coupons.

Surveillance pricing sits at the intersection of two things that most people hate feeling watched and feeling ripped off.

End quote.

Let's talk about all of that with our guests this hour.

Rachel Barnhart is a Monroe County legislator serving district number 17.

Welcome back to the program.

Thank you.

Next to Rachel is Jonathan S Weissman.

Jonathan is a principal lecturer in the Department of Cybersecurity at RIT.

Welcome back to the program.

>> Thank you very much.

>> And welcome to Pat Garofalo, who is Director of State and Local policy at the American Economic Liberties Project.

Hello, Pat.

Thanks for being with us.

>> Hey, thanks so much for having me, Pat.

>> Tell us about what the project is, the Economic Liberties Project.

>> We are a research and advocacy organization based in Washington, D.C.

that focuses on issues of corporate power and corporate consolidation.

We believe that most of our economic and in fact, social problems are downstream of the corporate consolidation that we've allowed to occur in this country over the last 40, 50 years.

>> So, Pat, let me just start with you for a definition.

In many ways, this is kind of a surveillance pricing 101.

Our because this is still pretty new to me.

It's new to a lot of people understanding the concept.

And I did my best to kind of sum it up a little bit, but can you give us a quick primer on how you see surveillance pricing right now?

>> Your summary was great.

It is the practice of using individual surveillance data.

So data that was gleaned from your online activities to set individualized prices for you.

So a retailer knows something about you that makes them charge you a different price than they charge the person sitting next to you who's literally buying the exact same product from the exact same retailer at the exact same time.

>> The quick question a lot of people have is, is that legal?

>> It depends.

I think you could make a pretty strong case right now that it is illegal price discrimination.

It's an unfair or deceptive practice.

No one has tried to make that argument in court yet, but there's been a lot of challenges in courts in other areas around algorithmic pricing, in convincing the judiciary that these tools and practices and new technologies should fall under older laws governing pricing practices, governing unfair and deceptive trade practices governing competition.

So a lot of the legislative efforts that are underway, as you laid out at the federal and state level, are aimed at making it abundantly clear that this practice should be outlawed.

>> Yeah.

So there's a question of whether it should be outlawed in general, or at the very least, if people should know that you're paying a higher price than the general public or other people, and what transparency might look like.

So those are all issues that we're going to discuss.

I want to invite the audience if you've got questions, comments on this.

The email address, as always, is Connections at wxxi.org.

If you're watching on YouTube, you can join the chat there and submit a comment or a question.

You can call the program toll free 844295 Talk 8442958255263.

WXXI.

If you call from Rochester 2639994 now sometimes it takes sort of an individual story that that takes off.

That gets a lot of attention for things to kind of snowball.

And that kind of seemed like what would happen with Wegmans.

in, in the months past here.

But Wegmans says legislator Barnhart that this isn't surveillance pricing, what they were doing.

They were just doing surveillance and they're doing it for security.

And I want you to kind of take us back to what happened there and what you saw happen in the public consciousness there.

>> Sure.

The first weekend of the year, Gothamist in New York City, that's an arm of their public media outlet there did a story about how Wegmans in New York had a sign on their store saying, we're collecting biometric data from you.

And that caused a huge flurry of comments online.

So I saw the Gothamist story online and I immediately thought, well, Wegmans is based in Rochester, number one.

Number two, New York City has a law requiring Wegmans to make that disclosure.

So maybe we should have a law here also requiring that.

And I thought, well, before we go down that road of legislation, we should probably try to engage Wegmans to find out more about what they're using this data for and where they're collecting this data, what stores they're doing this at.

So I wrote a letter to Wegmans on January 4th.

It was a Sunday night.

A lot of legislators have full time jobs.

So I'm thinking, I want to get this out of the way now.

I wrote a letter to Wegmans asking a number of questions.

those questions included what data are you collecting?

Where, what stores are you collecting this data at?

Will you commit to not using this data for individualized pricing or what we're calling surveillance pricing?

And how long are you keeping this data?

And I posted that my letter on social media.

I asked our staff to send it by mail to Wegmans, and I have to tell you, I was absolutely shocked by what happened over the next few days.

My letter went viral, so to speak, in Rochester, and also attracted attention in Buffalo and Syracuse, which are also big Wegmans markets as well as New York City.

So I heard not only from reporters but also from so many people who live in our area who were deeply concerned about their data, their biometric data being collected in this manner from a grocery store that they love and that they frequent all the time.

And so the most, the vast majority of comments, I would say 80 to 85% were people who were deeply concerned, wanted more information, and wanted, at least for the collection of biometric data to be disclosed by Wegmans.

The other 20% fell into two camps.

The one camp was, well, we need to collect this data for security reasons.

And then the other camp was, well, of course everyone's doing it.

Why are you picking on Wegmans?

And the deeper I got into this, the more I realized that this really isn't about public safety.

Because if you were to do any kind of internet search on biometric data and retailers, you're not going to see things about shoplifting.

You're going to see things about surveillance pricing.

You're going to see companies selling their systems to retailers for surveillance pricing in the future, such that Rachel Barnhart walks into Wegmans, they can immediately ping my phone with a text message coupon for something that they know that I frequently buy.

Those are the kinds of systems that are being sold actively to retailers right now.

And the only other thing I would say is Wegmans did not.

I gave them 30 days to respond.

>> Wegmans.

Did they respond.

>> At all?

They did not respond.

>> And they still haven't?

>> No.

But they did give the media a number of statements, a couple different statements, and they directed people to what's on their website.

And I guess what I would say is, even if you take what Wegmans says at face value, we're only collecting this for safety purposes.

We're not using your data in any kind of nefarious way.

Okay, that may be true today, but we have no way of knowing if it's true tomorrow, because Wegmans can essentially do whatever it wants and we won't know.

And I'll also say Wegmans did not tell us which stores they're collecting biometric data.

They they would not disclose it.

>> As in we don't know if they're doing it locally.

>> We don't know.

We don't we have no idea.

They're only telling people in New York City because New York City has a law from 2021 making them do that.

>> So your colleagues in the legislature, what do they think about passing.

>> A.

>> Law similar to New York City's?

>> Sure.

So I wrote a bill and gave it to our legal department.

Discovered that I had other colleagues who were extremely interested in this issue as well.

We had a workshop as a as a Democratic caucus to workshop the bill.

So now there's a different, slightly different bill.

in legal.

And what it would do is the bill would essentially tell all retailers, not just Wegmans, if you are collecting biometric data, then you need to post prominently outside your store.

We got a little hung up on how to enforce it.

So did Onondaga County.

How do you enforce this?

and I think it should be a, that consumers have the right to sue, you know, you have a cure, period.

You, you let them know, hey, Wegmans, I think you're doing this and you need to let, you need to put a sign up.

You give them 30 days to comply and then you can you have the right to sue.

My understanding is that retail trade associations are deeply opposed to this kind of legislation, for reasons that they they're attributing to safety and also they don't want people to sue them.

They think it could be very litigious.

>> But you are essentially alleging that Wegmans is hiding the real reason they're doing this.

>> I'm not what I what I am saying, and I know that Professor Weissman could talk more about this too.

What I'm saying is this is the future, okay?

Whatever they're doing now.

Oh, whatever they're doing now, even if you take what they're saying at face value and believe them, the future of this, they've installed all these systems.

They have spent a lot of money installing these very expensive systems to collect our biometric data.

It's to to say that it's just going to stop at safety.

These systems are not designed to stop at safety.

>> So in a moment, I'm going to ask Jonathan to describe how some of this stuff actually works.

Before I do that, let me just ask Pat a few questions regarding not just the Wegmans story, but some of the broader themes here.

So first of all, what do you make of the Wegmans story and what do you make of Wegmans statement?

I mean, they haven't answered the legislator, but they have put out public statements and they've said this is just about security in our stores.

Does that make sense to you, Pat?

>> No, I think Rachel's concerns are spot on.

What you're worried about in the brick and mortar space is the migration of the tactics that they're using online today.

Right.

There was an FTC report that came out under the Biden administration where they asked a bunch of different industries about their use of surveillance, pricing technology.

And it turns out there is a very, very robust industry selling these tools to retailers across, you know, hospitality, retail, tourism, there's, there's tons of technology out there enabling the sort of pricing tactics that we're talking about.

And the concern is that today it's being used online, it's very clear that people are being shown different prices for different goods online.

for black box, you know, opaque A.I.

reasons.

And that could migrate into a brick and mortar space through the use of some of the tools that Rachel was talking about.

And things like electronic shelf labels, things that can change prices in real time.

So even if they're not doing things today, the, the making policy as if those tactics will migrate, I think is really wise because something I've learned by working on corporate consolidation and anti-monopoly issues for the last bunch of years, is that the time to act is before the toothpaste is all out of the tube.

In so many of these places, we are trying to shove the toothpaste back in and trying to break up some of the big dominant corporations that are taking over our economy.

So the moment to fix this stuff is not after it all happens and we're living in a price dystopia down the road, the time to do it is today.

>> Okay, but Pat, let me try to steel man the argument against your point there.

And I'm going to read an email I just got from Wendy in Rochester.

Wendy says, when I look up something and then I don't buy it, I then get ads for discounts.

The longer I don't buy, the deeper the discount offer.

I would say that their formula is she's interested, but the price is still higher than she is willing to pay.

So surveillance pricing seems to go the other way.

Is that right?

And I want you to answer Wendy's question tied to this idea, what Wendy is describing and what the defenders of surveillance pricing might say is you are still in control as the consumer, as the consumer, if you don't like that price for the flight, don't pay for it.

If you don't like the price for the baby formula, don't pay for it.

No one is making you buy those things.

And these companies are simply working within the market to maximize what they can get out of you.

But you still control the purchase.

So what do you make of that pet?

>> Well, towards the second point, if we're talking about things like baby formula, I would argue that's you're not really in control.

You do need to buy baby formula.

You need to buy food.

>> Maybe not a.

>> Great right?

Yeah, you need to buy all of these things.

And yes, the surveillance data can certainly be used to lower a price for a specific individual.

but we don't know the extent to which that's being done versus the extent to which it's being used to increase prices.

And even if you one person are getting a discount, that doesn't mean they're not raising the price for someone else.

a lot of this, the concerns in this space are tethered to the notion that these systems allow retailers to completely obliterate the idea of a commonly understood price for a good right.

The idea that there is some baseline price that we all understand, and that we can all decide whether to pay or not to pay, that these systems allow that idea to be completely obliterated so that you can't truly comparison shop.

You can't truly, over time make a budget because the concept of like static concrete price doesn't exist anymore.

>> Okay, well, let's talk about how they actually do this.

And Professor Weissman, principal lecturer in the Department of Cybersecurity at RIT, first of all, in general, let's talk about brick and mortar stores.

So you walk in there and they're tracking data from you how and it would be used.

How.

>> So when they take your biometric data, they're putting it in a database and storing it as a template.

>> What is biometric mean?

>> Biometric means something that you are your iris, your retina, your facial geometry, your hand prints your characteristics that make you, you sort of like a digital form of DNA.

>> Okay.

>> And they are storing that template in a database, which is now going to be consulted when people come into the store.

Is this matching face?

Is this matching template stored in our database?

If it is, what type of person are we looking at right over here.

from a theft loss prevention perspective, do we have something to be concerned about?

>> Okay, now this is where it gets a little weird for me.

Just a little.

I think it's Minority Report.

I'm trying to think of the movie.

So let's just talk about the security part.

And then I want to talk about surveillance pricing with you on the security side.

So you walk into a store and eight years ago you were arrested for shoplifting, but that's eight years ago, and you haven't done it since.

But they've got this on your record.

They can't preemptively kick you out of a store, can they, because you've been legally buying goods for the last eight years.

You had one incident of shoplifting.

That's correct.

They can't arrest you for a crime you haven't yet committed.

They can't predictably arrest you.

>> People change.

People get reformed.

>> Yeah.

And the idea of these dystopian movies that try to get us thinking about this stuff is at some point, technology is going to be able to tell authorities, law enforcement, the state, whatever, that this person needs to be arrested because they're going to commit a crime.

And I don't think that's what Wegmans is saying, but I don't know how they're going to use it.

So what what is your understanding of how a company like Wegmans can use that and say, okay, well, this person, shopper X is in the store, but we've got a history on this person.

And so we're going to do some, I guess they're going to follow that person.

They're going to tell them.

>> Could be security is going to be heightened.

They could be watching them absolutely through a through a video cam, through a closed circuit TV.

They could be monitoring, monitoring that person as they're going through the aisles.

>> Okay.

But they can't.

Nobody is saying they can kick them out of the store.

No, I legislator Barnhart.

>> Oh no, I, I, I believe that they can and they do tell go up to people that they, that they have flagged as not being allowed in a store based upon however they've identified them and asked them to leave.

We've heard stories about people falsely being being accused.

In fact, the FTC banned Rite Aid from using biometric data because they were falsely accused of having false positives, falsely accusing people of being past shoplifters and asking them to leave the store.

>> Oh, I agree with that.

Actually, I was under the impression that the question was an unrelated crime.

>> Yeah, yeah.

Okay.

But but okay, so maybe so it's not so black and white here.

I mean, there are and there have been disputed cases already.

Okay.

That's the notion of biometric data usage.

Now, how do they use this stuff?

And I don't say they again, we're not just talking about Wegmans this hour.

And Wegmans is welcome to come on any time they like on this program.

One on one part of a panel they can call on right now.

We would love to have Wegmans talk about this.

I would love it.

I appreciate them if they will do that.

But when it comes to in general, companies, retailers, whoever, if they're going to surveillance price, how do they do that?

>> The most effective way that it's done today is through apps.

So think about you going to a particular party and you talk to the host of the party and you're telling the host of the party everything about you and all your likes and dislikes and where you've been and what you're going to be doing.

And that host of the party selectively tells the other guests at the party, not necessarily everything about you, but things you're likely to do, prices you're likely to pay for.

So the way it works with apps on our phones is that every phone has a unique advertising I.D.

It's a randomized identifier.

It uniquely identifies the phone.

And in essence, the person who owns the phone.

And every time you use an app that I.D.

uniquely identifies your Wi-Fi networks, your locations, your IP address based on where you are, your in-app actions, clicks, how many, how much time you spend on a certain screen, and all of this information.

Previous previous purchases and all of this information is reported back to an ad sponsored network through something known as an SDK, a software development kit, which basically means the advertising I.D.

uniquely identifies you.

But each app has multiple SDKs, software development kits that report to the ad network.

What you've done, where you've been, what you've bought, and as a result, the ad sponsored networks send back to other apps that are in the same network prices.

What what you're likely to spend on certain items based on your previous history.

>> Okay, so one, if people don't like what they're hearing, one antidote that they might think is, well, I'm going to go back to buying brick and mortar, but let me tell you about an experience I had a couple of weeks ago.

I bought something at the gap.

That's a store that still exists in 2026 in some places, and I was in person one shirt and they asked me for an email address.

They asked me for all this other information, and I said, and I, I felt like Mitch Hedberg when Mitch, the late comedian Mitch Hedberg had a joke about buying donuts and they gave him a receipt and he's like, why do I need a receipt for the donut?

How about I give you the money and you give me the donut?

End of transaction.

And I'm thinking of Mitch Hedberg when I thought, can I just give you the money?

You give me the shirt.

End of transaction.

Why do I need to be in your system?

Why do you need my email address?

Why do you need other data about me?

And I declined and they seemed annoyed with me, to be honest with you.

But it was okay.

I still got the shirt.

Is that a I mean, is that something we should think about too?

And when we're in person.

>> Well, they call it shopper rewards and the.

>> Oh, it's rewards.

is that.

>> You buy enough.

We'll save you some money.

But yeah, they are collecting data on you that can be used at some point in the future.

>> So you're saying I might be missing some rewards in the future.

>> But.

>> Well, but.

>> So to speak.

Absolutely.

>> But they may be missing certain data.

Okay.

So everywhere they're trying to collect data, but a lot of us are doing more purchasing online.

And is there a way people may be wondering, is there a way to mitigate what they can sort of mine off of you online?

>> Let me tell you something how crazy this is with Apple apps on iPhones, you have to explicitly grant permission for your advertiser I.D.

to be transmitted with this SDK to other apps.

You can turn that off on Android devices.

It's on by default.

Now, if you turn it off and you tell your iPhone, I'm not transmitting Inter app advertising I.D.

information so they can figure out what I'm doing with 95% accuracy.

Your new profile, your so to speak, anonymized profile can be tied to your old advertising I.D.

based on things like your battery percentage at different times of the day.

Know your IP address, the Wi-Fi networks that you you frequent.

They could build a profile on you after you you opted out based on what you do with your phone, where you take your phone and what you look at on your phone.

>> So related to that, Connie writes in to say, can you use a different computer entirely, a different phone, a different router to get a lower price?

Once you've made the initial inquiry and then the price went up, I believe it would be connected to other things like memberships or accounts such as frequent flier and points.

But is it connected to IP addresses or other identifiers too?

>> And that's the thing.

It's a unique.

It's called an advertising I.D.

Apple calls it id f a identifier for advertisers.

Google calls it a g id, Google advertising I.D., and these are randomized, but they uniquely identify you and your device.

And even if you reset that I.D.

and you have a new I.D.

that uniquely identifies the device with 95% accuracy, your new I.D.

can be linked to your old I.D.

>> And one more thing on this before I get the other guest to weigh in.

And then we've got some feedback and comments and questions from listeners on this.

I think it was Pat who mentioned you walk into a store or maybe legislator Barnhart mentioned this.

You walk into a store and you get pinged with a discount offer, right?

And they know somehow that you're in the store.

I, I don't know that I want them to know where I am at all times.

I don't know that I like that idea.

Now, I want to recognize that somebody might think, that's cool.

Somebody listening might be like, oh, cool, send me your discounts.

Like, I don't care.

You know, there are certain people and I'm sure legislator Barnhart heard this from the public.

Some people say like, well, if you've got nothing to hide, what do you care about?

Like, what's the big deal?

And if they want to tell you they've got a discount offer, they can give you a discount offer.

is there a way to disable them knowing where you are and whether they're in the store.

>> Ski mask.

>> Oh, yeah.

Yeah.

And you know, one thing, one thing.

>> That I meant to mention earlier is that KBW did a story where they interviewed, they called Wegmans and asked, are you doing biometric?

They called other stores.

They also called taps, which of course is a big Wegmans competitor in upstate New York.

And taps said they do not use biometric technology, and it is not standard for shoplifting prevention.

And I thought that was really interesting.

>> Oh, okay.

Interesting.

And Pat, from what you've heard from Professor Weissman here, can you just weigh in on whether you think the average consumer is aware that all of this is going on?

I think by now people understand the Facebook's and Meta's of the world want your data, people want your data.

But do you think the average person is aware of just how extensive this is and how it is used?

>> I don't think so.

I think recognition is growing.

I think conversations like this one are helpful.

There was actually a fairly viral video on social media the other day from a Senate candidate up in Michigan talking about surveillance pricing.

I think what is pretty pervasive, and you set this up in the intro, is the sense that something is not quite right in, particularly online retail.

>> Your data is being used and prices are shifting in real time for reasons that you don't quite understand.

And it's one of those areas where we kind of joke all the time at economic liberty is that all the conspiracies are true, which isn't quite accurate.

But I think the general sense that there's something up that people have actually is headed in the right direction.

>> Okay, so after we take our only break, if you're on the phone, we're going to take your phone calls.

If you've emailed, we're going to take your emails.

There's basically two flavors of response so far, and they're both under the category of like, what can we do?

But some of them is what can we do?

You know about the actual tech side?

You know, so, so Willow writes in to say, what if I buy a brand new phone?

Do I get a total clean slate of my buying habits?

We'll talk about that.

But then there's the idea of what can we do as citizens about this?

So there are questions about this.

If you've got more questions.

Comments as we talk surveillance pricing, you can call the program toll free 844295 Talk ( 844)295-8255.

We do not collect data on people who call the program.

I don't know if we even could.

I mean I'm not that good at tech, but you can call in, you can email us Connections at wxxi.org.

We've got in studio legislator Rachel Barnhart from the Monroe County Legislature in district number 17.

Jonathan Weissman, principal lecturer in the Department of Cybersecurity at RIT Pat Garofalo is with us, director of state and local policy at the American Economic Liberties Project.

Your feedback next.

Coming up in our second hour, we're talking about the Survivors Art Project.

We're going to be talking about some themes that might be difficult for some listeners to hear.

We're going to be talking about sexual abuse and talk to talk about survivors of sexual abuse and how they are trying to heal.

And in this case, the the survivors Art has a lot to share.

They're going to be talking about not only the work they're doing, but how they hope the Epstein case leads to more public awareness.

That's next.

Our.

>> Support for your public radio station comes from our members and from Excellus Blue Cross Blue Shield, providing members with options for in-person and virtual care, creating ways to connect to care when and where it's needed.

Learn more at excellus.

Bcbs and Bob Johnson Auto Group.

Believing an informed public makes for a stronger community.

Proud supporter of Connections with Evan Dawson focused on the news, issues and trends that shape the lives of listeners in the Rochester and Finger Lakes regions.

Bobjohnsonautogroup.com.

>> All right, let's get to your feedback.

And there is plenty of it regarding surveillance, pricing and the habits of retailers when it comes to using technology to track us and to maybe change what they charge for prices for what we are paying.

Willow wanted to know, if I buy a brand new phone, do I get a fully clean slate on my buying habits?

Jonathan.

>> Well, you'll have a brand new advertising I.D.

that's not linked to anything, but once you start to do things, they're tracking you.

>> Okay?

But they're tracking you from scratch.

Or they can start to link it to they figure out who you were.

>> Well, there are factors like the make and model of your phone.

If it's a high end device, they might be able to tie that and screen size and the Wi-Fi networks and the IP addresses that are associated with the phone, they could still tie that back to the original I.D.

>> So there's a chance that you can get a close to a clean slate, but there's also a chance that they're still going to figure you out.

>> It could revert back from the most minute random collective pieces of information that are all aggregated together.

>> Amazing, by the way, Jonathan was also saying there are certain things that that retailers will do to change.

The price you pay usually make you pay a higher price.

If there's a couple of factors they notice, like what.

>> Let's say your battery is really low and you're looking at buying something.

>> How do they know.

>> That that's transmitted?

That's part of the SDK.

That's the messenger that's reporting back to the ad sponsored networks.

Your battery percentage is one of those factors.

>> So you're on 3% and you're looking for flights online.

>> And it says this person needs a flight.

Their phone's about to die.

Jack up that price sky high.

>> That's amazing.

And what about times of the day.

>> Late at night?

If you're searching for something, you probably want to go back to sleep at some point.

The prices are also going to surge at that point.

But to what you said earlier, it can work in reverse because they there have been known cases where the phone has been linked to the physical competitor store based on Wi-Fi networks, based on IP address, and they actually lower the price because they want you to buy from them instead of the competitor.

>> Oh, gosh.

Okay.

all things that maybe the average person is not thinking about here, let me grab a few phone calls.

Ellie in Rochester next.

Hey, Ellie.

Go ahead.

>> Hey there.

So I have a question sort of having to do with sort of protecting ourselves and the networks that we hop on when we may be out in public.

Because I have a sort of strange story that is similar to this.

I went to visit a friend in another town.

I walked into my friend's house, my phone was in my pocket.

I noticed her slippers and I thought, oh, those are those look really comfortable.

Didn't say anything.

My phone was in my pocket the whole time.

eventually later that evening, because I was staying over, I joined their Wi-Fi and I got fed an ad in Chinese.

My friend is Chinese.

I got fed an ad in Chinese for those exact slippers.

this was not her surreptitiously trying to sell them to me.

We never even had a conversation about it.

Is that sort of, you know, is that sort of in the same vein of, you know, you jump on somebody's network, you're going to start getting ads or fed things that are that have been purchased recently or that they want you to purchase.

>> Well, there is a different concept known as the ad exchange network, which basically means there's going to be a broadcast from that SDK.

Hey, I've got an empty pixel on the screen for a user in Rochester, New York who wants it.

And dynamically, there are going to be ads that bid for that spot on your phone based on what you've done in the past.

But that's not surveillance pricing, that's targeted, targeting, targeted ads.

>> I mean, but part of what Ellie is saying to me sounds like have we already merged with machines?

Do they do they sense us looking at those slippers even if we don't say it out loud?

>> 100%?

>> What?

I was joking.

You're not supposed to scare me.

This.

>> You could search for running shoes on Google and open up an app, and all of a sudden you see an ad for running shoes.

100%.

That's a thing.

>> Oh, boy.

Anything else you want to add there, Ellie?

>> I did want to say you know, you were mentioning before about your trip to the gap.

I went to an unnamed shipping store recently.

I walked in to get a quote to see how much something was going to ship.

They wanted my driver's license before they could even give me an estimate.

I turned around and I walked right out.

>> I don't blame you.

I find that stuff.

Thank you, Ellie, for the phone call.

I mean, that kind of stuff did not happen that not that long ago, the amount of data that we're supposed to share just to interact at a counter with someone is pretty wild.

844295 talk.

It's toll free ( 844)295-8255.

Get back to your phone calls in just a second.

let's let's continue down the line here.

So yeah, Mark wants to know, you know, there's a lot of talk about what's going wrong, but not a lot of talk about what we're supposed to do about it.

I. So we are talking about what you're supposed to do about it, Mark.

But I think Mark might be saying legislatively or action wise.

>> Yeah.

>> Legislator Barnhart you want to.

>> Hit that?

Sure.

I mean.

>> It's distressing to me to hear people wonder if they need to get a new phone.

I mean, we can't I can't live like that.

I don't I can't live like, like this, where I'm constantly wondering what Wi-Fi networks I'm on, what apps I'm using.

Sure.

I take security precautions such as passkeys and using face I.D.

for my apps and those kinds of things, but I. This is where I think we need regulation, and ideally we'll have regulation at the federal and state level.

I suspect that our local legislation won't go anywhere until we know what Albany will do.

This session, which ends in June.

There are bills in Albany right now that would ban surveillance pricing.

And I think one of them would actually ban the collection of biometric data in places of public accommodation, which includes grocery stores.

So we may wait to see what happens with Albany.

But Albany is Albany, so we may have to do something locally where we at least say to retailers, if you are collecting this information, you must put a sign up on your door prominently posted, letting customers know because that is a form of informed consent, where if I see that sign and I choose to walk into the grocery store, I know what they are doing with my information.

>> Yeah, there's I really feel like that transparency is a baseline here.

And then there's the question of whether surveillance pricing should be allowed at all.

And it sounds to me, correct me if I'm wrong, that at the baseline you want transparency, that you think the law should demand the transparency to tell shoppers, to tell your customers, we're collecting data on you?

>> Sure.

Okay.

Well, as we know.

>> But do you also want to ban surveillance pricing in general?

>> I do, but I don't know that that is something that we can accomplish at the local level.

>> Do you think it can happen at the state.

>> Or even the flu?

>> Absolutely.

I do I think it's just really important to understand what retailers are doing and what kinds of information that they're collecting.

As we both know, as former, you are still a reporter, a journalist.

I am a former journalist.

But as we know, transparency tends to change behavior.

So if Wegmans feels that it is going to pay a price from consumer loyalty by disclosing what it is doing, it may change its behavior.

So transparency has a way of making people act in ways that are better.

Usually.

one thing that we really didn't touch on a lot in this show yet is the biometric piece because that is we've talked a lot about the technology on your phone and apps and how they're tracking you that way.

But one of the things that really sparked concern with the Wegmans sign in New York City was it said they're collecting biometric data.

And one of the things that I've learned throughout the last couple months is we can change our passwords when they're hacked, but we can't change our faces.

And that is something that Professor Weissman has talked a lot about.

And some of the interviews that he's done.

there are particular risks with the collection and storage of this data.

>> And to further that, thank you for the reference.

I used that line a lot.

Actually, the companies that are collecting our biometric data, they're not cybersecurity companies.

They don't specialize in data security.

And now that we know that they're doing this, they could become active targets of breaches.

People can take our biometric facial and otherwise templates and use them to authenticate the systems pretending to be us.

>> Okay, so again, now you know why they're there are legislative efforts.

So to answer Mark's question, there are efforts underway to address these things at different levels of government in different places.

It's a question of what gets traction and what forces there are.

>> And Pat, Pat may be able to tell us some things that are going on right now, too.

>> Yeah.

So, Pat, what's the landscape legislatively look like to you?

What do you what do you want us to know?

>> Absolutely.

there are about 20 states in the country right now that have bills to ban surveillance pricing and some of those also go along with something we haven't talked about, which is surveillance wage setting, which is the same exact idea, except to determine how much someone gets paid, they are using your personal profile to determine how much to pay you.

This is usually in like the gig platform kind of context.

so the Colorado House last week became the first legislative body to affirmatively pass a ban on surveillance price and wage setting.

TBD on the Senate and particularly the governor.

And then one thing we actually haven't talked about is that New York does have the nation's first statewide surveillance pricing law because of a bill that became law last session.

It is a disclosure law.

It just simply says that a company that is using surveillance pricing has to tell you sometime during the process when you're shopping online, that your personal data has been used to set the price.

It's been in force for a few months.

It got hung up in court for a little bit, but it is now in force.

so that's the first step that any state has taken.

>> I haven't noticed that.

>> As a New Yorker, by the way, Pat, I've never I mean, maybe I'm just not paying attention enough.

Maybe I'm just speeding right through checkout, but maybe I've been missing some signs, some disclosure there.

>> It's possible.

It's also possible that compliance is not great.

and that tends to be the case with laws like that.

I don't love the transparency law just because I think it's not particularly actionable for folks, for reasons that we talked about before, but it is something and actually the the assembly member who sponsored that disclosure law, Assembly member and Rita Torres does have a full ban in the legislature this year.

She is sponsored along with Senator Rachel May up in Albany.

and their bill is really great.

It's really strong.

we support it.

We think it would be a really important step for New York.

>> What about these federal pieces of legislation?

One in the Senate, one in the House?

>> I am not the federal guy, though.

I was I'm a recovering journalist myself.

And I did cover Congress for quite a while.

My view these days is always that there's far more hope at the state level than anything happening positively, federally.

>> Okay.

Now let me get back to we got we could probably do two hours of this emails and phone calls.

So Wendy writes back and again, kind of steel manning the other side of this.

Wendy's helping us do that this hour.

Thank you.

Wendy in the city, she said differential pricing isn't new.

Good examples of existing differential pricing are cars and real estate.

Your known desperation as a buyer matters in those negotiations.

So, Pat, if we have a ban on surveillance pricing, does that mean a house price is the house price?

There will be no more bidding wars.

Does that mean when you go to an auto lot, there isn't going to be any haggling?

The price is the price, or they can't.

Try to use your desperation against you for a car or a house, or are there going to be exemptions, carve outs?

>> Absolutely not.

this is the use of the retailer knowing some intimate detail about you in order to increase your price.

So if you walked into the auto dealership and they knew that you were about to leave on a road trip the next day, and therefore you really needed the car, they would jack your price up.

That's not something they're going to know if you just kind of walk onto the auto lot, right?

We're talking about really, really intimate details usually collected via online surveillance.

It doesn't prevent haggling.

It doesn't prevent you playing to auto dealers off against each other.

It doesn't prevent the interplay between consumers.

Right?

A bidding war between consumers on a house isn't going to get touched about touched by regulation around surveillance, pricing.

This is about the use of data that the seller has collected about you, and then is weaponizing against you.

>> But you don't think someone could sue under this law passes.

And then I buy a house and there's no bidding war, but I feel like my characteristics as a buyer were used to to bump that price up.

And I'm going to sue saying that, hey, this is an example of surveillance pricing.

You don't think that flies?

>> Is it impossible that the seller knew something about you and was using it?

>> Just that I'm desperate.

Just I'm there.

That I'm talking in a way that indicates I really want this house.

And I'm, I'm I don't have a lot of time to decide.

>> So something like you saying something aloud is not going to get captured by a surveillance pricing ban.

This is about information collected and put into a data file about you.

>> Okay.

All right.

a couple YouTube comments.

Then back to your your phone calls there isn't a way for us to go no digital anymore, is there?

Can we go back to just using regular phones?

Probably not as it's technically digital.

I go incognito a lot and Google hates it.

That's interesting.

Another YouTube commenter says something that really bothers me is somehow my algorithms present ads to me regarding family health issues, and it comes up based on factors I would not have imagined, like phone calls or conversations.

It leads me to think that maybe my phone, my TV, my digital radio messenger on Facebook, they are mining conversations for keywords.

Okay, Jonathan, are they listening to our conversations for keywords?

>> Well, that's been known to be a thing as well.

>> That's not impossible.

>> No, not at all.

And just I just wanted to talk about one of the earlier comments you were reading about normal solutions that people always talk about in the world of cybersecurity and incognito mode VPNs, but neither of those actually help surveillance pricing.

And I like to think of it as you put on a pair of sunglasses, they could still see who you are.

Or if you erase your footprints, but you're wearing the same shoes, they could still tell who you are.

So those normal go to cybersecurity fixes do not apply here.

And even furthermore, remember I was talking earlier about how you can say I opt out.

I don't want apps to share information about me.

You can do that right off the bat.

When you install an app on on iOS.

And you can do that on Android devices as well.

That stops the SDK, the software development kit, from telling that at sponsor network about you, it does not stop the in-app tracking that the app does itself.

So still form a profile on you and still do surveillance.

and pricing.

But that's just not going to be shared with the rest of the network.

So point is, there's from a technology standpoint, there's almost nothing you can do.

>> All right, let's move fast.

I could have so much.

We've just got to go fast as best we can here.

We'll get as many as we can in David in Rochester on the phone next.

Hi, David.

Go ahead.

>> Yes.

So VPNs, virtual private networks are of no help at all.

>> VPNs just hide where you're starting from.

But the other information that's being transmitted goes through the VPN as if it was going through a VPN connection.

Your device size, the resolution, the model of of your device, the the networks that you're going through, the aggregate data about what you've done in the past, that's still the SDK on the app's VPN or no VPN.

Your information is still being transmitted to the sponsor network.

>> Okay.

Okay.

Thanks.

>> Thank you.

David, appreciate that.

Next, let's go to Robert in Fairport.

>> Yeah.

Thanks for taking my call.

I think the, the Wegmans thing and the biometric data we got to, we got to remember how we got here.

supermarket business is very low.

It's very low margin.

These stores are experiencing shrink rates up to 3% or more, which means a lot of products that are on the shelf end up getting stolen.

And the store has a vested interest in trying to keep that down.

I know that I think that Miss Barnhart referenced tops.

I don't think tops is a place that I'd be referencing for anything.

They've been, you know, filing for bankruptcy multiple times.

They have not really, you know, come across the right formula to make, to make enough money to stay in operation.

So I think that as far as trying to control shoplifting, which is done by a relatively small number of people, that can make a huge difference.

I think that the biometric things.

Okay, Robert.

>> Thank you.

Go ahead.

Rachel.

>> Yeah, we can still allow Wegmans to collect biometric data, but what we can do is put up guardrails saying you're never allowed to use this data for surveillance pricing.

I mean, that is one option here.

If this truly is about safety and security.

So there are ways to preserve retailers, right?

To have safety and security with with the need to not have surveillance pricing in the future.

So there are, there are solutions.

>> And also they have to let us know how they're storing this information and how they're securing this information, right?

>> We need, we need, I think we, we are at the point where we need some guardrails.

>> Here's a quick email.

I'm sure this is for legislator Barnhart Barnhart Charles writes.

So in other words, surveillance pricing is the same thing the government does when they tax you.

>> Well, that is very transparent and it's the same for everyone in certain income brackets.

Yes.

Before we go, Evan, I did want to mention that the legislation we had legislation, my bill just passed the Public Safety Committee that would require the sheriff's department to disclose when it purchases surveillance technology.

you might ask why the legislature doesn't vote on those purchases.

It's a long story, but we don't vote on a lot of those purchases, which are now in the form of contracts with companies such as Axon Technology.

>> So law enforcement purchases what they want you don't vote on?

>> Not necessarily.

Not unless it's part of our capital budget.

The thing is, these these are now considered soft because because we're not talking about physical hardware, a lot of we are in some cases, but a lot of it is software.

And those are long term contracts.

The state controller doesn't consider these software contracts to be professional service contracts.

I totally disagree and have asked the state controller to reverse that to update that decision.

But in the meantime, we're going to get some quarterly disclosure from the sheriff.

When those kinds of things are purchased.

So I'm excited.

I do believe it's going to pass the legislature.

>> All right.

Susan wants to know, does using Ecosia help e c o s I a are you familiar with that, Jonathan?

>> Yeah.

No.

Again, the major thing is every app has a spy, a messenger that's reporting back.

It's the app itself.

And from a browser, if you want to talk about a browser which is not as effective as from the app perspective, we have the traditional cookies that are being used to identify us to third party, ad sponsored networks.

The problem is specifically with phones.

This advertising I.D.

is anonymous, it's randomized, but through what you do, where you go, how long you spend on certain apps and certain pages, it uniquely identifies who you are.

VPNs don't help.

Incognito mode does not help.

You've got to you've got that bug, you've got that SDK that's reporting back to the sponsor site, who's who's telling all the other apps about you and what you're likely to pay.

>> Another listener wants to know about Surfshark.

>> Know that's a form of VPN.

No?

>> Okay, so these are not the solutions here.

These are not the solutions you're looking for.

Pat Garofalo one listener asks, should we ask every store we go into physically if they're using surveillance pricing?

So maybe a good chance for you to answer that for that listener and then give us some final thoughts on what you want to see happen next year.

Pat, go ahead.

>> I think the main concern for surveillance pricing today, right now occurring is mostly online.

Again, the technology hasn't quite gotten to the point where retailers are changing prices in real time in the store.

Maybe they're paying you for a coupon.

Maybe they're working some hijinks through their loyalty program.

And that's actually a really important thing that we haven't talked about at all.

A lot of these systems operate through loyalty programs, which are actually increasingly becoming a way for companies to increase prices, to actually keep prices higher.

There's a great report that came out a few months ago.

It was called the loyalty the loyalty Program scam or trap or something like that.

talking about how the, the data collected through loyalty programs is increasingly being weaponized against people who think that they are getting lower prices, but they are actually not because of the fees and other things associated with the loyalty program.

So I think that can happen in the physical location.

But right now, what I am far more concerned about is when you are shopping online, you are searching for something on a big box store.

And because you cannot see a price and see what your neighbor is paying, they're using some bit of data against you.

So I would be far more concerned.

Shopping on online today, again next week, next year, ten years from now, I think we should be preparing for that.

But right now, the best thing you can do is try and get your legislators to work on bills.

banning these practices, better regulating them.

today.

>> Pat Garofalo Director of state and local policy at the American Economic Liberties Project.

Pat, thanks for making time for us today.

Thank you.

In studio legislator Rachel Barnhart from district number 17.

Keep us updated on this.

Thank you very much.

>> Thanks for highlighting the.

>> Issue.

And Jonathan Weissman, Principal lecturer in the Department of Cybersecurity at RIT.

Thanks for scaring us today.

>> That's what.

>> I do.

I know you educated us.

>> I know I appreciate that.

>> We appreciate that, sir.

Thank you for being here.

More Connections coming up in a moment.

>> This program is a production of WXXI Public Radio.

The views expressed do not necessarily represent those of this station.

Its staff, management or underwriters.

The broadcast is meant for the private use of our audience.

Any rebroadcast or use in another medium without expressed written consent of WXXI is strictly prohibited.

Connections with Evan Dawson is available as a podcast.

Just click on the Connections link at wxxinews.org.