Subscribe
Share
Share
Embed
Surveillance pricing turns personal data, shopping history, location signals, loyalty programs, and AI-driven profiling into different prices or discounts for different people — often without consumers realizing their data has become the price tag.
Shared Security is the the longest-running cybersecurity and privacy podcast where industry veterans Tom Eston, Scott Wright, and Kevin Tackett break down the week’s security WTF moments, privacy fails, human mistakes, and “why is this still a problem?” stories — with humor, honesty, and hard-earned real-world experience. Whether you’re a security pro, a privacy advocate, or just here to hear Kevin yell about vendor nonsense, this podcast delivers insights you’ll actually use — and laughs you probably need. Real security talk from people who’ve lived it.
Welcome to the Shared Security Podcast, the longest running cybersecurity and privacy
show for actual humans.
No jargon, no hype, just honest analysis from industry veterans who've seen everything
and survived it.
Each week we break down the stories that matter, expose the nonsense that doesn't, and give
you the tools to stay safe in a world where everything is connected and nothing
is guaranteed.
This is Shared Security.
What if the price you see at the grocery store, on a delivery app, or an online ad is not
really the price, but it's your price?
So this week we're talking about surveillance pricing, the use of personal data, behavioral
profiles, location shopping history, income signals, household assumptions, and AI-driven
targeting to decide what price or discount different people see for the same product.
Now New Jersey just passed a bill aimed at banning grocery surveillance pricing.
Consumer Reports is warning about loopholes, and we've seen a Papa John's campaign that
used Instacart and streaming ad data to target people when they were likely running
low on groceries.
So this isn't just dynamic pricing in the airline ticket sense, it's pricing based on what companies
think they know about your life, when you're hungry, what your household needs, and maybe
how desperate you are for a pizza.
And joining me for this conversation is my co-host, Mr. Scott Wright.
Hey, I'm always desperate for a pizza, man.
You know, that is the one weakness I think most people have.
If you see a good pizza ad show up on your streaming service, right, and you happen to
be hungry and in the mood for pizza, what's the most likely thing you're going to do?
Yeah.
Could be streaming ads all day for pizza for me.
Yes.
So how are you doing, Scott?
Not bad, Tom.
How are you?
I'm great.
I'm great.
Too bad Kevin couldn't make it today, but this is now my second week at Secure Ideas.
Yes, you are a member of the Borg.
Well, I'll be sure to tell Kevin that we are the Borg, but yes, this is my second week
of being professionally evil.
You don't look any different.
I know.
I looked exactly the same.
I know.
Yeah.
Well, it's been great.
I've really enjoyed meeting the team and already digging into a lot of things in
the company, so I believe I'm leading the consulting team.
Awesome.
That's great.
Exciting.
I'm really happy to be working at Secure Ideas.
It's been great so far.
And yeah, so maybe next time.
I'll have to resist.
I know Kevin's been asking me over and over again, but I've been resisting.
Yes.
Yes.
Yes.
So maybe one day we'll start a Canadian office in Ottawa, right?
Well, sure.
Yeah.
Why not?
Yes.
Why not in the city that Fun forgot?
Anyway.
Oh, man.
Yeah.
I had to bring that up.
I thought it was something that you maybe just think of, but I can't remember this.
I thought this would be a good story for telling Tom about the city that Fun forgot.
Yes.
Yes.
Maybe next time.
But yeah, we're talking about surveillance pricing on this episode.
And first I wanted to start by, and I mentioned this in the intro, was this is different
than dynamic pricing that we hear about like with airlines, right?
They're obviously adjusting their price based on supply and demand and the season and all
of these things.
Or you go to Walmart, and I don't know if you've noticed, Scott, that they all have
these digital tags now.
These old price tags, yeah.
Yeah.
And that is essentially dynamic pricing where they can just change the price as they
see fit based on demand or based on other factors.
But that's not actually targeting you specifically.
No.
And that's where...
Interesting.
Just a quick little interesting side note about those little dynamic price tags.
I was actually commissioned like 10 years ago to do a risk assessment on those tags
because you can imagine people trying to hack them, right?
Yeah.
Anyone.
Side story.
Yeah.
I always think about hacking those things would be a little more difficult because
in the back end, they actually have rights because that's what you're scanning
the UPC code at checkouts, and so that has to match what's in the system.
Right.
But if a customer takes a picture of the price showing $3.99 for a car battery, right, $3.99,
and then you take that picture and you say, well, this is what it said on the tag, and
we have a lot of stores will honor what's shown on the tag.
That's a good point.
Yeah.
Going to a competitor, right?
And saying, hey, it was cheaper at Walmart, give me the price, and yeah, some people
try to do that.
All kinds of shenanigans.
Oh, yeah.
But what we're talking here is the surveillance pricing, which means a company or a third party
has information about you, and it is influencing the price that you pay, and it's getting
down to either you being in a certain demographic of people.
So I think there's been some examples, and we'll link some of these in the show
notes of past things like Tinder, the dating app.
They offered higher prices for older people than younger people.
Like, that's just a simple example of based on your demographics, they're going to have
some type of custom pricing for you.
But where it gets interesting is, and I like the Papa John's example, which was about
Instacart and the partnership they had with Instacart, and they would be getting
shopping data from Instacart of what people were purchasing, when they were
purchasing it, location information, and those types of things, and they had some
algorithms that could determine you might be hungry for a pizza during this time
based on your shopping history and through, I think it was like NBC Universal, the
streaming app, it would know you are watching based on your data and who
you are matching that data up and then serve you ads for pizza based on that data.
Yeah, I mean, it makes sense, especially in the streaming media world, because
they're constantly recommending stuff for you, so they have the algorithms to
decide how to present stuff to you based on your habits, right, from just
viewing, and it makes sense they could take different data about you and say,
well, instead of recommending certain content or shows to watch, let's put up
different ads for them. And that's, it almost, to me, starts to sound like the
minority report. Yeah, the movie is Tom Cruise going through the stores and
seeing all these ads flashing up. That's going to get annoying real fast,
right? Yeah, yeah, it is. And I think it just opens up a conversation
about you don't know what companies or who is doing this, right? So the
transactions you're making on a daily basis when you purchase products, I
mean, even just think about Amazon, right, like they could easily, I mean, 100%
are probably using doing some type of surveillance pricing. I mean, just
looking at the price of things and it's more than just, oh, hey, we see
that you've bought this thing five times in a row. Now, Amazon, when they're
right now, will tell you, hey, you should sign up for a subscription and we'll
give you a small discount, you know, because this is something you
reorder all the time. But there's nothing stopping them from taking that
further, you know? And I think there are certain, I guess, challenges or
obstacles to them doing this, you know, to the nth degree, because in a lot of
markets, you kind of have to publish a list price. But in cases where you've got
a loyalty program, for example, and you've signed up for things and you
might get extra points or what amounts to a discount, I think it's
probably much more workable that even for fixed price items, based on your
behavior, they could offer you a different amount of points and turn that
into a certain value. And all it comes down to is a value exchange, right? It's
your giving up your personal data about, you know, your habits and things
you like in exchange for reduced value or reduced costs on things you're
buying. So in a loyalty card sense, I don't think it's a real problem. I
think it's like you said earlier, it's a real capitalist model. There's no real
issue that where I think there becomes a huge issue is when it's done without
your knowledge or consent and you're tracking people's location data or, you
know, any other things that they might be doing inadvertently and not
knowing that they're being tracked in some way. And I can imagine, for
example, take a grocery store that buys data about their customers, you
know, if they know your address or your phone number, they can probably buy a
whole bunch of other data about you that will help them in some ways target you
or whatever. But what if they start gathering additional information
about you and then augment the two or combine the two together? Maybe
that's worth something for them to sell without your knowledge, right? So it
gets into a gray area for sure when you look at what they could be doing
with that data or collecting information about you without your knowledge.
Mobile apps are just part of everyday life now. Banking, healthcare,
shopping, entertainment, you name it. And with that comes a lot of trust
because users are putting their personal data directly into your app. But
here's the reality. Mobile apps are a growing target. A recent survey
found that 72% of organizations experienced a mobile app security
incident last year. And 92% say threats are only increasing. And
the way attackers are going after apps is pretty sophisticated.
They're reverse engineering them, modifying them and redistributing
fake versions through phishing campaigns, side loading and even
third party app stores. So from a user's perspective, everything
can look completely legitimate. That's why taking a proactive
approach to mobile app security really matters. You want to stay
ahead of these threats not react after the damage is done. This
is where Guard Square comes in. They provide advanced protection
for both Android and iOS apps, along with automated security
testing to catch vulnerabilities early and real time threat
monitoring. So you can actually see what's happening out there.
If your mobile app is critical to your business, and it
probably is, this is something worth paying attention to. You
can learn more at guard square.com. That's guard square.com.
Yeah, I 100% agree. And I think you mentioned just like
grocery stores and grocery pricing, I think is the, the big
area that we are seeing this right now. And in fact, that
some of the laws, like I mentioned, New Jersey and
California, and there's other states in the US, they're
trying to pass these types of laws banning surveillance
pricing or severely limiting it because any grocery stores out
of any type of shopping that you do, they encourage you to
sign up for these loyalty cards in the spirit of discounts,
right? Like, you're going to get these discounts if you give
us, you know, use your loyalty card. And I don't think we
often think about the power that the grocery store chains
have. And now, especially with AI, like they can now take all
of your data. And I mean, that's the the best thing
about AI, right, is they can correlate large data sets
together. And now if you imagine like the thousands and
thousands of customers that a big grocery store chain has, the
powerful data that they have about people shopping habits
when they shop what they purchase, you know, and I think
it's an opportunity and maybe this is some research that that
we could do is what are the privacy policies around these
loyalty cards, because I would be willing to bet that
there is probably some disclosure about I would hope so
that of how your data is being used and maybe what third
parties that data is being sent to or correlated or or
those things. And I'm not saying stop, you know, using
loyalty cards, grocery stores. I just think that it's an
area that this surveillance pricing is is kind of that's
what we're seeing the examples, the laws that are being
passed are kind of focused around that and the food
industry. And I think it's because, well, it's an
essential thing, right? People have to eat. And what a way
to increase your capitalistic, you know, market share, I
guess, is based on people's hunger.
Yeah, you know, I think from a practical point of view,
you know, like you said, we're not saying stop using
loyalty cards or whatever. But in a practical sense, you
probably if you do have a loyalty card, you know, maybe
we'll do this in a study at some point and publish some
interesting information about the policies of these
things. But, you know, when you when you realize that
you're using a program like that, there's probably a
privacy policy or maybe some privacy options, you know, in
your online account for that thing, you should go in and
have a look at and maybe there are things in there
that grant them the right to sell your data to other
people and you don't want that. So that's probably the
most practical bit of advice I can take out right now for you.
Yeah, and this this goes way back. I remember, you know,
Scott, we've we've probably talked about this on the
podcast. And I remember giving a talk, I think it was
way back in like 2012 2013 at Infosec World about just
the surveillance cameras that were first coming out and
how they could identify you and link you back to
Facebook, right, to pull your Facebook profile. And then
you would walk into these stores and you would all
of a sudden get a message on Facebook that, hey, thanks
for visiting. Here's 10% off your next purchase. And
you don't see a lot of that anymore. Like everything is
more like opt in. But I also it just makes me
wonder, like, we've been talking about this stuff
for years. Yeah. And I don't think it's gotten
any better. Really, I think maybe we're just a
little more used to it. We don't notice it as much. But
there's still I still get stories, people telling me
stories every month about being somewhere, having not
done any searches, but just in the room where they talked
about something or maybe they just drove down a street
where there was a certain vendor and all of a
sudden they're getting ads for that, you know, that
organization. So clearly the ad networks are walking a
fine line or maybe even in the gray area around
using behavioral information and advertising. And I
think that's kind of where this kind of you have to
focus and say, are these things do we want them to
be legal or not? Yeah, because there are extremes to
all of these things. And I think none of these
companies intentionally want to be creepy about it.
And I think that was, you know, it kind of in the
article that I think Bruce Schneier had linked
about the Papa John situation, but it still
comes across as creepy.
I don't even know if I buy, I'm gonna take
Kevin's thing. I don't know if I buy that
they're not trying to be creepy. I think in a lot
of cases, you know, the executive's compensation
depends on how they do the next month, right? So
that's right. We can scare a few people or
entice a few people with a new with a pizza. You
know, you can imagine ads, not only are they
being sort of served dynamically to you and
ad for a pizza, imagine a dynamic AI generated
video that comes on as an ad for you, like the
video is created for you dynamically, right,
rather than just selected from a library of ads.
And that's going to get really creepy. I don't know
how we're going to deal with that.
Well, I, I, yeah, I think you're right. I think
it is coming. And I think it is depending on
the services that you're using, that may
already be here. We just may not be noticing
it because it is on that borderline, not
creepy factor. And, but with AI now, I
could easily see a world, like you said, with
Minority Report, the movie, right? Like where
you're walking into a gap, I think, was that
scene and they're scanning your eyes and they
know all of your previous purchases. And, you
know, I mean, that is kind of the, the
capitalism utopia.
The merchants, I guess it is. Yeah. Yeah. So
we'll see where this goes. But I think our
advice for our listeners is, you know,
assume that these loyalty programs and
shopping apps, I mean, they are data
collection systems. Like at the end of the
day, they are still collecting data about
you and your shopping habits. And, and of
course, you may be getting discounts and
coupons for signing up for these things.
But just be aware that your data could
also be used from a surveillance pricing
perspective. And you may not know it,
right? But you may want to do your
own kind of research of like, you know,
compare prices, whether you're logged
into your app with your loyalty
program versus logged out to see what
pricing that the general public might get.
You might be surprised to see, right,
that there may be a difference in that
price. And you may be actually paying a
higher price depending on your data and
the program. It's something to just
check out. And the other thing I'd say
too is just, you know, continue to
reduce your location sharing within
your applications. You know, does
your loyalty app need access to your
location? Do you need to give it? How
many people are in your family and all
of this personal data, right? When you
sign up for these things. Be very
careful about that. I'm always a big
fan of just putting in like fake
information into those things. You
know, so I'm not giving away where I
really live or my real address or
things like that. But that's one
approach, right? Because we know we
can't stop all of this. And there
are places we legitimately want to
shop at. And we want to purchase
products from. And there's companies
we want to support. But it's just
something we need to be aware of that
the price could be changing depending
on who you are. It's a really
interesting, I think it's a great
time for this episode, just in terms
of opening people's eyes to, you
know, yeah, I remember the loyalty
program. And I, you know, I know
they're gathering my personal data,
but wow, I didn't know they're
doing this, right? So it's a
really good eye opener. Yeah, so
if you're listening this or
watching this episode on YouTube,
let us know. Like, have you
encountered a situation where you've
seen different pricing for stores or
online shopping or grocery stores and
use have suspected that surveillance
pricing was something that was
happening. We'd love to hear from you.
Love to hear your stories. So you
can either comment on YouTube or send
us an email feedback at shared
security dot net love to hear from
you. And we can we can mention that
in the next episode. Yeah. And if
while we're talking about feedback,
like to just put in a little bit of a
plug for the book I am working on
calls the digital legacy tree. And
as you can imagine, if you're
familiar with the concept of
digital legacy, it's you know, what
happens when you die and your all
your accounts, you know, go into
limbo, who has access to them,
et cetera. But it's more than
just your passwords and two factor
authentication. And as I do research
on this, it becomes really
intriguing that the number of
people I talked to who say, you
know, it's not just the password,
like I wish I knew how this person
lived their life, you know, what's
the context that this was used in.
And so that's the kind of stuff
that I'll be talking about. So I'm
interested in hearing anybody's
stories if they want to share an
anecdote anonymously or however
about situations where people
have passed away and it was hard
to either get in their accounts or
figure out what what to do with
them, you know, I have
personally actually last time I
pruned my bit warden, it was over a
thousand accounts I have. Yeah,
things right. And they're not all
going to be stuff that you want your
authorized decision maker after you
die to have to go through. So I think
it's another area where we need to
focus. So love to hear people's
feedback. Again, feedback at shared
security.net. Yeah, yeah. Thank
you for mentioning that, Scott.
And do you still have that page up?
I think we had a link to yes, I
do. Yeah, we'll link that in the
show notes for for our audience.
But if you want to see the great
important project that Scott is
working on with the book, you can
find out more information about
that through that link.
All right. Well, thanks everyone
for listening. And until next
time, stay safe, stay secure and
stay private. Thank you for
listening or watching. If you like
this episode, hit subscribe, share
it with your friends and
colleagues or jump into our
community at shared security net
slash supporter to keep the
conversation going. Thanks again
and we'll see you next week for
another episode of shared
security.