“If you’re not paying for it, you’re the product.” The phrase was coined in the 1970s to talk about television advertising, but has since become the internet’s whole business model: we get nice services, for free or for very little, and in return, our attention is sold to advertisers.

But what if that logic dominated everyday life? With the rise of the smart city, it’s becoming a reality. And local authorities should be both upfront and cautious about the risks.

Sous les pavés, la pub

In a time of disappearing budgets, it is understandable that councils will jump at any opportunity to improve their cities without spending a penny. Companies like JCDecaux and Clear Channel provide cities with street furniture such as bus stops and bicycles, in return for advertising space.

Occasionally, though, the public service aspect is all but forgotten. In 2015, JCDecaux replaced Paris’s 2,000 bus shelters with a new model. With their sleek design, the new shelters had USB ports for charging your phone, and large, digital advertising screens. The only problem? They didn’t actually provide shelter from the rain and had to be changed.

Other times, public utility is just an excuse for brand promotion, as with the “trackable water refill stations” recently installed in London by Canary Wharf Group – narcissistic water fountains with a screen that tracks the number of plastic bottles saved.

With cities desperate for innovation yet strapped for cash, advertisers have been emboldened to set their own rules. A recent report from the Outdoor Advertising Association of America talks about how the knowledge that a bus passenger is taking a specific route towards a specific destination could be used for hyper-targeted messages: “The information might include: an upcoming destination; reminders about previous purchases; points-of-interest along the way.”

This mixing of public and private usages is one way advertisers are cementing their urban domination. As one advertising CEO puts it, “The serendipitous confluence of municipal poverty and secular change in marketing practices presents a unique opportunity for a new breed of public-private partnerships.”

In reality, “public-private partnerships” often means public data being used for private ends. The best example of this took place via Intersection’s digital kiosks in New York, the LinkNYC. These kiosks were designed to replace the city’s payphones, and they feature HD screens for accessing maps, services and video calls, a phone, and USB charging ports. The “Links” are owned and operated by the CityBridge consortium, and are funded by advertising on the large screens. Last year, “InLinks” launched in the UK.

Intersection turned public data into private ad dollars last year, when it helped the beer brewing company MillerCoors run an advertising campaign in partnership with the Metropolitan Transit Authority (MTA). MillerCoors used MTA data to detect when there were delays on certain train lines, and subsequently relayed this information alongside the slogan, “Your commute can wait” and an invitation to stop off for a beer.

Protecting data in smart cities

So where is our personal data in all of that? The future of outdoor advertising lies in the combination of two inherent features of the internet – free, advertiser-subsidised services, and targeted ads. And the latter means large-scale data collection. As Le Monde reports, the screens that companies like JCDecaux are fitting on public infrastructure “use cameras and detection systems to identify with remarkable precision the sex, age, height, weight, and geographical origins of passers-by”. In some cases, cameras even use “emotion detection”, to check if people are responding positively to the message.

The marketing possibilities are so enticing that Philippe Baudillon, president of the French branch of Clear Channel Outdoor, just published a book about smart cities, Réinventer la Street Experience. In his reimagined city, we are all connected, all the time; the street becomes a “real-life hyperlink”, sending people towards websites and social media campaigns.

The book explains that Clear Channel has also developed a tool called Consumer Audience Smart Tracking, which uses “more than 2,000 socio-behavioural criteria taken from anonymised data” to analyse consumers passing in front of a screen, “making it possible to identify not only the number of people who walk by, but also their lifestyle and consumption habits”.

Baudillon stresses that the data is used to identify and target large groups, not individuals: we don’t have to worry about the bus shelter revealing our internet history just yet. Still, with smart street furniture linked to your smartphone’s Wi-Fi, and bourgeoning facial recognition technology, hyper-targeted outdoor advertising is increasingly plausible.

Public authorities have, however, shown that they are willing to uphold privacy laws. In 2013, the company Renew London trialled recycling bins which featured LCD advertising screens, and which tracked Wi-Fi signals from pedestrians’ phones. Renew said it collected data from media access control (MAC) addresses simply to measure footfall. But after campaigners raised privacy concerns, the City of London Corporation asked Renew to halt its trial.

The French Data Protection Authority (CNIL) denied JCDecaux authorisation to collect similar data. The device would have gathered data from any smartphone users within a 25 radius of their advertising screens, meaning not everybody was likely to have seen the A4 sign notifying them of their rights, according to Osborne Clarke’s marketing law blog.

The European Union’s General Data Protection Regulation (GDPR), which came into effect in May, should give citizens even more power in such cases. Businesses are now required to share what kind of information they collect, and individuals must be able to withdraw their consent.

But this is much more complicated in a physical, public space than it is online, as the CNIL’s decision recognises. That is why the public should be consulted before projects are finalised. While free technology is always enticing, cities mustn’t forget whom they are supposed to serve, before the next big data scandal hits the streets.