How a Marketing Firm You’ve Never Heard of Knows Exactly Where You Shop and When

Tracking you with or without your consent?

InMarket knows when millions of people shop because it's integrated in 800 apps, including Epicurious and List Ease. InMarket
Headshot of Lisa Lacy

“Snap into a Slim Jim,” Macho Man Randy Savage bellowed from TV sets during the 1990s as a pitch-perfect character for the meat stick brand. In an era when jerky was perceived by the American public as junk food, Slim Jim was a mainstay for adolescent boys and convenient stores.

But artisanal jerky brand Krave, which emerged from the heart of California’s wine country in 2009, ushered in what it calls a “jerky renaissance” with its all-natural, gluten-free snacks in flavors like pink peppercorn, basil citrus and black cherry barbecue.

The Hershey Company acquired the premium jerky brand in 2015 and sought to appeal to an audience looking for healthy snack options—and to boost its 9.2 percent brand awareness. And so it enlisted location-tracking company InMarket to better understand when these shoppers were due for their next trip to the store and to deploy messaging about Krave when they would be most receptive to it.

“It’s sort of the holy grail for advertisers if you can … whisper in the ear of your shopper as they’re holding the product,” said Cameron Peebles, chief marketing officer of InMarket.

The InMarket campaign increased brand awareness to 15.8 percent, so Hershey fulfilled at least one of its objectives. But InMarket’s ability to determine shoppers’ schedules and preferences—even if this is fully in line with industry best practices—begs the question: Can consumers really consent to location tracking when they have no idea who is tracking them and why?

‘We’re in her phone’

InMarket knows where to find receptive ears because it is integrated via a software development kit into about 800 apps, including Epicurious, List Ease and CheckPoints. The company would not name others, but Peebles said they include couponing and lifestyle apps. Screenshots InMarket shared about the Krave execution indicate it is also working with Verywell and The Wall Street Journal. While it is not clear these properties are used in a similar capacity,, Buzzfeed, CNN and the Food Network are also featured on the InMarket website.

(Update: In an email, Dotdash, formerly, said its properties, including Verywell, do not use InMarket for any purpose.)

But ComScore said entities that fall under InMarket include ZipList, WebMD, Big Oven and Coupon Sherpa.

As a result, InMarket had more than 50 million unique mobile visitors in November 2017, according to ComScore, but that figure dropped to 43.7 million in February 2018.

“Those integrations enable us to see via an opt-in structure,” Peebles said. “We are directly integrated into the phone. … One out of every four or five [phones] in the U.S. we can track [with] always-on location data and build really powerful personas or audiences around these consumers. We know where they shop, what days of the week, whether it’s on the way home from work or in the morning, different things like that.”

In other words, dear reader, you’re being watched—digitally, speaking. And, per Peebles, this is not a bad thing for consumers, since the result of companies knowing where, when and why you shop is that you get more relevant offers.

“Because we’re in her phone, we can walk into the store and, at that point, we make the app she uses to shop wake up and push [a notification],” he added. “It changes what people generally don’t like about advertising—it’s not necessarily relevant to them, it’s not a recommendation from a trusted source.”

The right consumer on the right device at the right moment is a well-worn battle cry in digital marketing. But InMarket doesn’t just deliver messaging—it tracks millions of phones. That’s how it determined the Krave audience is educated, over 25, married with a family, earns above average income and owns homes in higher income areas. InMarket also found they shop at local grocery stores; frequent gyms like SoulCycle, 9Round and Equinox; and prefer retailers like L.L. Bean, Vineyard Vines and Nordstrom.

That’s pretty specific. And it raises a question about whether the consumers who helped InMarket establish this profile know they’ve shared so much about themselves with a company tracking their phones’ every move.

It’s not even clear whether this practice is legal—just that it’s widespread, platforms and advertisers say it’s within industry best practices and, historically, the onus has been on consumers to follow the breadcrumbs in disclosures to provide informed consent.

“The bad news is I don’t know either [whether this is legal],” said Trevor Hughes, president and chief executive of the International Association of Privacy Professionals (IAPP). “But … the good news is this is not unique, and it absolutely is a fact and a reality. And I think we’re having a moment of reckoning on this issue right now.”

The legal overview from the FTC is that a company can’t deceive consumers about the collection and sharing of geolocation. According to Maneesha Mithal, associate director of the FTC’s Division of Privacy and Identity Protection, the FTC has said in some cases it could be an unfair practice to not have a conspicuous disclosure to have opt-in consent. (But InMarket argues it has opt-in consent because consumers are opting in to share location with the apps they use.)

As a result, this may be more of an ethical issue for the digital marketing industry.

In an email, a Krave rep said InMarket enables it to build brand recognition and provide value to many kinds of shoppers, adding, “It is important to us as a company and as consumers that InMarket and any firm that handles consumer information take precautions to protect that data.”

Peebles said InMarket is “opt in and transparent” and “everyone via anonymous data has fully opted in”—and an InMarket rep noted in an email, “InMarket is a standard-bearer for ad-tech accountability, transparency and consumer privacy. Facebook should take a lesson from us.”

But this does not mean 44 million consumers have explicitly said they are willing to be tracked by InMarket.

Instead, consumers download an app and grant permission for location tracking to that app. In the case of Epicurious, for example, users are asked to allow Epicurious access to their location “to find seasonal ingredients and available offers nearby.” When they do so, however, they are also granting permission to InMarket. And therein lies the rub.

Are best practices enough?

In a statement, Epicurious said, “Epicurious adheres to all industry best practices, including Apple’s policies governing location services and Condé Nast’s privacy policy. The Epicurious app sends relevant content and marketing offers based on location only to users who opt in.”

In Part 4 of Section VI of its 12,000-word User Agreement and Privacy Policy, Condé Nast does indeed note third parties will at times use tracking to serve advertisements.

Similarly, the Terms of Use from InMarket’s List Ease app weighs in at 9,600 words. It suggests users read the agreement and notes its applications may locate users if they enable location-based services. CheckPoints, which also hails from InMarket, makes an identical statement in its Terms of Use, also 9,600 words.

But even though consumers have access to these disclosures, it doesn’t mean they understand the implications—or even bother to read them. A study from Deloitte found that 91 percent of U.S. consumers—and 97 percent of 18- to 34-year-olds—agree to terms of service agreements without reading them.

And while it may be tempting to point fingers at consumer laziness, it’s not that simple. Researchers at Carnegie Mellon, for example, estimated reading privacy policies would take each U.S. internet user approximately 201 hours a year, or more than five 40-hour work weeks.

“Our digital lives are incredibly complex, and the number of digital participants in any one transaction or activity that we undertake in the digital economy is probably surprising to most people,” Hughes said.

In fact, one of the immediate outcomes of the Facebook-Cambridge Analytica brouhaha was that Facebook revamped its settings, writing in a blog post: “It’s also our responsibility to tell you how we collect and use your data in language that’s detailed, but also easy to understand. In the coming weeks, we’ll be proposing updates to Facebook’s terms of service that include our commitments to people. We’ll also update our data policy to better spell out what data we collect and how we use it. These updates are about transparency—not about gaining new rights to collect, use or share data.”

‘We’re using an analog tool … to solve a digital problem’

What’s more, Condé Nast does not mention InMarket specifically, so even if app users read the policy and understood that their data might be shared with third parties, they still wouldn’t know InMarket is tracking everywhere their phones go and, by extension, virtually everything they do. InMarket’s disclosure that its apps “may” use location when they clearly do arguably refutes its own claims of transparency.

“Even if [Epicurious] perfectly dotted every I and crossed every T, they may still find themselves [with] an angry customer base because they did something that surprised, shocked or felt creepy to the people they’re hoping to serve, which is not a good situation for any organization,” Hughes said. “We’re using an analog tool, which is a notice, to try to solve a digital problem, which is digital privacy.”

Even if consumers aren’t reading privacy policies, Mithal said, the FTC certainly is, although the FTC has also said privacy policies are perhaps not the best tool for consumer communication.

“We encourage where there’s collection, sharing and use of personal information for unexpected purposes, those disclosures should be outside the policy—if they’re filling in something it should be in the user interface or the FAQs,” she said.

Generally speaking, Mithal said, a company can’t deceive consumers about the collection and sharing of geolocation, and the FTC has said it could be an unfair practice to not ask for opt-in consent in a conspicuous disclosure.

“We don’t have a law that says you have to list all third parties,” Mithal said.

It’s not entirely fair to lay this at the feet of InMarket, Krave and Epicurious alone. Companies like Freckle IoT also rely on apps to get consumer consent to track location. And then there’s GroundTruth, formerly known as XAd, which says it “sees two out of every three smartphone users in the U.S.,” but no one was available to explain how exactly.

Plus, InMarket works with hundreds of other apps and plenty of additional clients who have also been able to identify location and send ads to consumers entering stores.

Epicurious declined to comment further on the record. However, in a case study on InMarket’s website, Craig Kostelic, head of digital for Bon Appetit and Epicurious, said, “With InMarket, we’re harnessing location and ambient intelligence to deliver native content at the perfect time in the shopper’s journey. The results are clear: Shoppers love it and so do our partner brands.”

It remains to be seen how much those shoppers love being tracked by InMarket.  

Update: In an email, an InMarket rep said the InMarket SDK is not integrated into VeryWell, WSJ,, Buzzfeed, CNN or the Food Network, adding, “These are examples of sites where our campaign placements run.”

The Fans. The Brands. Social Good. The Future of Sports. Don't miss the upcoming Brandweek Sports Marketing Summit and Upfronts, a live virtual experience on Nov. 16-19. Early-bird passes available until Oct. 26. Register now

@lisalacy Lisa Lacy is a senior writer at Adweek, where she focuses on retail and the growing reach of Amazon.