Privacy in retail media: what advertisers should expect

What happens to shopper data in an in-store campaign? For advertisers, that's a reasonable question to ask any network, and the answer shapes both the campaign and the brand's obligations. Retail media privacy covers what data is collected, how it's used, how it's protected and what advertisers can and can't do with it. In-store media built on aggregated data works quite differently from retail media built on individual shopper profiles.

Knowing which kind you're buying helps set expectations.

How does privacy differ across retail media?

Retail media built on loyalty programs, online accounts or apps often involves data tied to individual customers. That data can support targeting and measurement at the individual level, and it comes with significant privacy responsibilities.

In-store screens reach shoppers in a shared space. The screen shows the same ad to everyone nearby and doesn't identify who is looking. Measurement based on store-level sales compares what sold in advertised and unadvertised stores, without tracking individuals.

NRS data is aggregated at the store, UPC and transaction level. It describes what sold, where and when. It doesn't track individual shoppers or build profiles of them. That approach limits some kinds of analysis and avoids many privacy concerns.

For advertisers, the practical difference is in what they can expect to receive. Campaigns built on individual data may offer audience segments and matched reporting. Campaigns built on aggregated store data offer store and product comparisons, which answer different questions without individual matching.

What should advertisers ask a network?

What data is collected, and at what level of detail.

How targeting works, and whether it uses any individual-level data.

How measurement works, and what data it relies on.

Who can access the data, and whether any of it is shared with advertisers or third parties.

How long data is kept, and how it's protected.

Which privacy laws and industry standards the network follows.

Who is responsible for privacy within the organization, and how questions or complaints are handled.

A network should be able to answer these plainly. Vague answers are worth following up. For NRS Digital Media, ask the NRS Digital Media team.

What legal considerations apply?

Privacy law in the United States varies by state and by type of data. Some states have broad consumer privacy laws, and federal rules apply to certain categories. The FTC's privacy and security guidance offers a useful overview of general obligations for businesses.

This isn't legal advice. Rules vary by state, and advertisers should check their obligations with legal counsel, especially if a campaign involves any data about individuals, such as sign-ups from a QR code or a landing page.

Obligations can also attach to the advertiser's own activities around a campaign, such as collecting contact details through a promotion. Those sit with the advertiser, whatever the network's own practices.

What should advertisers expect in contracts?

Clear terms on data use. What data, if any, the advertiser will receive, in what form and for what purposes.

Limits on combining data. Many agreements restrict advertisers from combining network data with other data in ways that could identify individuals.

Security commitments. How data is stored and protected, and what happens in the event of a problem.

Aggregation rules. For reporting, minimum group sizes may apply so results can't be traced to individual stores or shoppers where that's restricted.

End-of-relationship terms. What happens to any shared data when the agreement ends, such as whether it must be deleted or returned.

Read these terms carefully and involve legal and privacy teams early. It's easier to align expectations before a campaign than after. For an overview of the network, see the NRS Digital Media site.