Digital signs in Brookline are collecting data from your phone as you walk by
Digital advertising signs in Brookline, Massachusetts are passively logging data from nearby phones via Wi-Fi and Bluetooth signals, raising questions about whether this amounts to invasive surveillance or merely modernized foot-traffic counting. Commenters debate how effective MAC address randomization on iOS and Android is at preserving privacy, and whether “encrypted” identifiers can still be used to track individuals or infer demographics. Others focus on transparency and governance, calling for FOIA requests, public access to any collected data, and clearer contracts and oversight when municipalities partner with private adtech vendors.
Technical details: MAC/BLE and tracking
- Discussion centers on what is actually collected: Wi‑Fi/Bluetooth MAC addresses, possibly hashed/encrypted, and the claim about “IP addresses,” which several say is technically wrong since phones don’t associate as clients.
- BLE uses “resolvable private addresses” derived from a device secret; random observers can’t map them back to identity, but paired devices can.
- Modern iOS/Android do MAC randomization: per‑SSID persistent random MAC when joined, and frequently changing random MACs when just scanning.
Effectiveness and privacy risk
- Many argue randomized MACs turn this into coarse footfall counting, not long‑term individual tracking.
- Others counter that even pseudonymous MACs are personally identifiable if stable over a short period or combined with other signals (e.g., SSID probes, other static devices).
- One point: the real threat surface is often elsewhere (apps, big platforms, carrier data) rather than a streetside sign.
Legal, policy, and transparency
- Some see this as mild “data exhaust”; others as government‑adjacent surveillance that should be FOIA‑able and publicly auditable.
- One commenter has already filed a FOIA request for all collected data and contracts and plans to publish it.
- There’s debate over whether such data should even be collected if the municipality doesn’t actively use it.
Utility vs “privacy theater”
- Supporters liken it to an automated people counter that helps with urban planning and ad impression estimates, arguably less intrusive than cameras or facial recognition.
- Skeptics say city officials apparently don’t find the data useful, suggesting the main value is to the vendor and advertisers.
Circumvention and countermeasures
- Some advocate simple avoidance: turn off Wi‑Fi/Bluetooth, use airplane mode, or rely on MAC randomization.
- Others propose “data poisoning” by flooding kiosks with fake MACs using laptops, Pis, or replayed captures, to degrade dataset quality.
Device behavior and usability tensions
- iOS behavior around turning Wi‑Fi/Bluetooth truly off is contentious; some report it silently re‑enables, others don’t.
- Workarounds via automation/Shortcuts are suggested, but criticized as user‑hostile when “off” doesn’t stay off.
- Broader theme: accumulated distrust in tech companies leads some users to prefer extreme measures (airplane mode, Faraday bags) over partial mitigations.