Do you know you're being tracked?

Do you own a smart phone? Do you always have WiFi enabled? If your answers to both these questions are yes, your movements were most probably tracked on your way into work today.

Under UK law, it is possible for WiFi providers to track users' movements without their consent as long as the WiFi provider ensures that users are not 'personally identifiable'. What may surprise you is that smart phone users don't even have to be connected to a WiFi connection for this tracking to occur.

When WiFi is enabled on your smart phone (meaning purely you have the option to connect to a WiFi connection; you don't actually have to be connected to a WiFi signal) your phone sends out your unique MAC address to the nearby routers that are available. This MAC address is picked up by these routers, along with your location. Your movements can therefore be tracked.

This location data is invaluable to businesses. For example, it can show retail stores what percentage of passers by enter their store. Going one step further, it's possible for this retail store, by comparing data from different days, to assess the effectiveness of its various shop window displays or signs. Geolocation data can also, for example, help local councils assess footfall across a particular area, meaning they can allocate council workers or police appropriately, or help stadium owners with exit routes and health and safety.

But how many people actually know that this occurs? Privacy campaigners argue that not many of us do. They also argue that, even if the geolocation data that is collected is anonymised, users can still be indirectly identifiable. For example, a period of sustained, repeated inactivity in a residential area during the night would most probably signify that person's home. Similarly, inactivity during weekdays would point towards that person's place of work.

Supporters of the collection of geolocation data cite the pseudonymity of the data as a strong reason for its use. Although how do we know that companies aren't flouting the law and going that one step further by combining geolocation data with other information they hold, meaning they can identify us without our knowledge?

The current proposals under the EU's General Data Protection Regulation suggest that this practice will continue to be permitted once the Regulation is adopted. The Regulation – which is still in draft – will harmonise data protection law across the EU. There have been significant delays during the legislative process and it is now looking as though we may not see ratification of the Regulation until 2016, with enforcement beginning in 2018.

When gathered legally and used correctly, geolocation data can greatly benefit businesses and consumers alike – especially if targeted advertising is consented to by the consumer. Personally, if my favourite coffee shop is doing a half price deal, I'd want to be alerted to this on my phone as I walk past and take full advantage!