There may be a privacy cost if you park at this Trader Joe's

People stand in line while waiting to enter a store.

Nov. 9, 2021 6 AM PT

Parking and privacy aren’t typically things that go hand in hand. That’s changing.

Colin Shanahan discovered this during a recent visit to the Trader Joe’s grocery store in Hollywood.

After parking his car in the garage — seldom an easy task, as any SoCal TJ’s customer will attest — he was instructed by an attendant to download an app to his phone, register for service and use that for payment.

“Not wanting to give some random app a ton of personal information, I declined,” the Hollywood resident told me.

The parking-lot attendant, he said, “let me off with a warning that I wouldn’t be so lucky next time.”

Shanahan, 35, a lawyer, feels like he shares enough of himself already with the tech world. “I don’t need a parking garage also knowing about me,” he said. “It just feels wrong.”

He added that because of this experience, he “probably won’t be going back to that Trader Joe’s.”

There are a bunch of moving parts here, not least the incredibly invasive practices of the Los Angeles digital-parking company that are revealed only through a close reading of its privacy policy.

But let’s clear up something right away: Trader Joe’s says it has nothing to do with this.

“This isn’t a TJ’s thing,” said Tara Miller, a Trader Joe’s spokesperson. “It’s being implemented by the landlord. We are a tenant in the building and are bound by the same parking validation system as other tenants.”

She added that, contrary to what Shanahan was told by the garage attendant, customers “also have the option of entering their license plate number into one of four kiosks as a means of validating their parking.”

Keep that in mind if you shop at the TJ’s at Hollywood and Vine. But if you do decide to give this newfangled parking tech a try, here are a few more things to consider.

It’s the brainchild of Venice-based Metropolis Technologies. The company was launched in 2017 and says it now has more than 150 employees.

“Metropolis re-engineered the legacy parking experience from the ground-up,” the company’s website declares. “No more tickets, pay machines or gates: At Metropolis, just drive in and drive out.”

If only it was that simple.

First of all, if you use the Metropolis app, you may not be paying just for parking. You may also be charged a “convenience fee” for your re-engineered legacy parking experience.

The company’s terms of service don’t specify how much this fee will run, stating only that the cost is “calculated as a small percentage of the total visit charge.”

But that’s the least of your worries. Metropolis’ more than 4,000-word privacy policy is a minefield of digital pitfalls, revealing parking to be almost an afterthought for a service that’s aggressively focused on learning who you are and how you behave.

Registering for the Metropolis app means submitting your name, cellphone number, email address, license plate number and credit card information, as well as the make, model and year of your vehicle.

Metropolis says it may also collect your internet protocol address, which identifies your specific device on information networks, as well as your wireless service provider, browser, operating system and type of phone.

It reserves the right to monitor “pages that you visit before, during and after” using the company’s online parking validation, as well as “information about the links you click” and “information about the services you use.”

Hold on, it’s just getting warmed up.

Metropolis reveals deep in its privacy policy that the company engages in “cross-device tracking.” That’s exactly what it sounds like — it’s going to watch what you do online regardless of which device you use.

“Your browsing activity may be tracked across different websites and different devices or apps,” the policy says. “For example, we may attempt to match your browsing activity on your mobile device with your browsing activity on your laptop.

“To do this our technology partners may share data, such as your browsing patterns, geo-location and device identifiers, and will match the information of the browser and devices that appear to be used by the same person.”

A 2017 study by researchers at Carnegie Mellon University and Columbia University found that cross-device tracking is used “in most cases for purposes of advertising.”

The practice “can principally reveal a complete picture of a person and, thus, become more privacy-invasive” than monitoring online behavior on a single device, the researchers concluded.

It’s hard not to suspect that streamlined parking validation is just the bait on the hook for Metropolis to peer deep into your digital life and leverage that data for other purposes.

What other purposes?

“Through our services, we may allow third-party advertising partners to set technologies and other tracking tools to collect information regarding your activities and your device,” the privacy policy says.

“These advertising partners may use this information (and similar information collected from other websites) for purposes of delivering targeted advertisements to you when you visit third-party websites within their networks.”

For a parking app, these are an awful lot of liberties to take with people’s info.

It took multiple calls and emails over nearly a week for me to get responses from Metropolis. Even then, I was told the emailed answers to my questions could be attributed only to an unnamed “Metropolis spokesperson.”

The spokesperson was decidedly reticent in explaining what I found in the company’s terms of service and privacy policy.

For example, the spokesperson at first didn’t specify the amount of Metropolis’ “convenience fee.” Only when I pressed did the spokesperson acknowledge that the “typical” fee runs about a dollar.

“At locations where a retailer validates parking for their customers,” including the Hollywood Trader Joe’s, “no convenience fee is charged,” the spokesperson said.

As for the privacy issues, the spokesperson said the company “collects essential information to facilitate a seamless parking experience.”

This includes people’s uniquely identifying internet-protocol address “so we can properly run analytics to improve users’ experiences.”

Indeed, almost all of Metropolis’ information gathering was justified by the spokesperson as being necessary for improving the company’s service.

Metropolis needs to monitor people’s unrelated web browsing and links they click because “we make note of where online traffic to our platform originates so we understand how customers are coming to Metropolis,” the spokesperson said.

Cross-device tracking is “important,” the spokesperson said, because the company wants to “be able to connect a user’s experience across our platform when they browse from different devices.”

The spokesperson was adamant that Metropolis “does not share user info with marketing partners.”

But this seems at odds with the privacy policy’s admission that it gathers user data for “advertising, analytics and marketing services.”

“We may share your information” with various business affiliates, including “advertising partners,” the policy states.

The policy also acknowledges use of software that permits “third parties including analytics and advertising partners to collect your personal information for various purposes.”

I pointed all this out to Metropolis. The spokesperson replied that the language in the privacy policy “clarifies to users the limits of possible uses of their data.”

The spokesperson emphasized that just because the company’s privacy policy says it may share user data with marketers and others, that doesn’t mean it does.

Which is to say, you have to trust it.

I’ll admit to being fuzzy about Metropolis’ business model after my interactions with the company. If data mining isn’t its primary revenue stream, as Metropolis seems to insist, what is? Those $1 convenience fees will go only so far.

The company says it’s raised more than $60 million from investors. Presumably they see something I don’t.

Alex Israel, Metropolis’ chief executive, was unavailable to speak with me. But he posted online in February that parking represents “the last bastion of non-institutionalized, underdeveloped, underutilized and under-monetized real estate in the U.S.”

“At Metropolis, we’ve developed an artificial intelligence platform, leveraging computer vision technology to connect all the pieces of the messy parking world so that you — the consumer — can finally have a seamless, checkout-free parking experience.”

That platform, as shown in the company’s privacy policy, may spread its tentacles well beyond parking, although Israel didn’t mention any of that in his post.

Apparently this is information he preferred not to share.

Column: There may be a steep privacy cost if you park at this Trader Joe’s

More to Read

More From the Los Angeles Times

Most Read in Business