Shady Baby

finding shade for your little sunshine

GPS Dies at the Supermarket Door

A stroller walk does not end at the supermarket door. The route planner gets you to the entrance, congratulates itself, and stops. The parent still has to find milk, diapers, a checkout lane wide enough for a stroller, and an exit that does not require reversing through a pyramid of seasonal snacks.

So I built the smallest indoor audit rig I could: an Android phone in my pocket, recording Bluetooth, WiFi, GPS, magnetometer, accelerometer, audio level, ultrasonic spectrum, and step cadence every 2-3 seconds. I walked three Danish supermarkets. Four walks total, two in pocket, two in hand.

I wanted to see if the stroller route could continue indoors. I accidentally built a retail media audit tool.

417BLE devices (worst case)
90+WiFi networks
19ultrasonic events
52 µTmagnetic field range
Walking path through a supermarket with people heatmap overlay

The Phone Immediately Lied

The raw Bluetooth count said there were 417 phone-like devices nearby.

I could see maybe 15 humans.

Bluetooth does not know whether a signal came from the shopper next to the milk, the apartment upstairs, the person walking past the front door, or the car in the parking lot. Signal strength is not distance. It is distorted by shelves, bodies, walls, refrigerators, and whatever the phone happened to be doing in my pocket.

Filtering by signal strength helped. Keep only strong nearby signals and the count drops to something like 11-19. That matched the room. But it was not a headcount.

WalkModePointsBLE devicesWiFi SSIDsUltra events
Store Apocket10526250+19
Store Bpocket11726480+16
Store Chand6828650+5
Store Bhand9841790+9

The Store Was More Interesting Than The Shoppers

Once I stopped pretending I had a people counter, the data got much more interesting.

The phone produced something closer to a site survey than a census.

Grundfosrefrigeration pumps
Zebracheckout printers
Goveetemperature sensors
SES-imagotagelectronic shelf labels

The phone saw Grundfos refrigeration equipment, Zebra printer advertisements, Govee cold-chain sensors, SES-imagotag electronic shelf labels, Nilfisk cleaning robots, and smart taps. Store B and Store C turned out to share the same parent company, which the phone proved by finding identical corporate WiFi SSIDs in both stores. Twenty-six access points, same names, same network. A competitor could learn this from the entrance.

Every little system was casually announcing enough about itself to be useful. The operating model of the building was leaking into the air.

Store infrastructure detected by phone

Ultrasonic Beacons Nobody Mentioned

The phone records a 9-bin ultrasonic spectrum in the 18-22 kHz band, frequencies most humans cannot hear. At each scan point, it classifies ultrasonic events as tones, bursts, or sweeps.

Store A had 10 tones and 8 sweeps. Store B had 6 tones and 9 sweeps. Both stores have active ultrasonic infrastructure in the near-ultrasonic band. Nobody mentioned it. No sign on the door. Nothing in the store's privacy policy.

This could be pest deterrent systems. It could be positioning beacons. It could be ad-tech audio beacons from companies like Silverpush or Signal360 that use inaudible tones for cross-device tracking. The phone cannot tell which. But it can prove the signals exist, measure their frequency, and map where they are strongest.

Ultrasonic spectrogram showing store beacon activity

For the retail media measurement people: if you are deploying ultrasonic beacons in stores, every phone with microphone access can detect them. The infrastructure is not invisible, just inaudible.

The Fridge Section Is Magnetic

Refrigerator compressors and large metal structures distort the local magnetic field. The phone's magnetometer picks this up.

Store A's magnetic field ranged from 31 to 84 µT, a 52 µT swing across a single store. The spikes correspond to the cold chain section. Store B had a 39 µT range. You can map the fridge aisles without looking at them.

Acoustic hardness told a similar story. It is a ratio of peak to average ultrasonic energy. Hard surfaces like metal shelving and glass refrigerator doors reflect sound differently than produce and textiles. The phone measured Q-factors from 1.6 to 7.7. The highest readings clustered near hard, reflective surfaces.

Between the magnetometer and the acoustic hardness, the phone is building a rough material map of the store. Not precise enough for a floorplan, but enough to segment the store into zones.

Your Body Is A Wall

Walking Store B with the phone in my hand: 417 unique BLE devices. Same store, phone in my pocket: 264. A 58% increase from simply holding the phone at chest height instead of hip pocket.

The pitch sensor confirmed it. 70° average in hand, 8° in pocket. The human body attenuates Bluetooth signals enough to change the device count by over a third.

Any retail measurement system based on BLE device counting that does not account for phone orientation is measuring the carrier's body as much as the crowd. This is the kind of thing that becomes a slide in a retail media deck and nobody mentions that the number depends on which pocket the phone was in.

417BLE devices (hand)
264BLE devices (pocket)
70°pitch (hand)
pitch (pocket)

The Indoor Map That GPS Could Not Make

GPS accuracy indoors ranged from 8 to 53 meters. Useless for navigation. The phone detected this automatically and switched to dead reckoning: gyroscope heading fused with step detection, corrected by WiFi ranging and magnetic field fingerprints.

The result is a walking path that looks like a store layout. Not a floorplan, but a topology. You can see the aisles, the turns, the entrance, the checkout area. Turn detection snaps heading changes to 90° because grocery store aisles are on a grid. The path is the map.

For indoor location services, this is the interesting part. A phone in a pocket, with no beacons, no setup, no cooperation from the store, can trace a usable walking path through the building. The sensors are already there.

The Cursed Retail Media Audit

This is where the stroller app accidentally turns into ad tech.

If you can understand the indoor part of the errand, someone will eventually ask if you can understand the aisle. If you can understand the aisle, someone will ask how many parents walked past the diaper shelf. If you can answer that, congratulations, you have reinvented retail media measurement with a baby in the dependency graph.

The phone found the supporting infrastructure for in-store retail media: WiFi access points, BLE beacons, electronic shelf labels, digital displays, ultrasonic signals. It could estimate nearby device density. It could segment the walk into zones and attach evidence tags to each one. It could tell which zones had checkout hardware and which had refrigeration equipment.

What it could not do is the part that matters for retail media: prove that a person saw an ad, faced a screen, dwelled in front of a display, or bought something. Those require cameras, and cameras were the one layer that was almost invisible to the phone. The phone could see the plumbing but not the measurement layer.

The IAB retail media measurement guidelines have a chapter on in-store measurement. A phone walk like this is obviously not that. But the gap between "what a phone can passively detect" and "what retail media measurement claims to measure" is interesting. The infrastructure is visible. The measurement is not.

Claims grid showing what the phone can and cannot prove

What We Can Claim

Observed

  • 262-417 BLE identifiers per walk.
  • Named devices consistent with Grundfos, Zebra, SES-imagotag, Nilfisk, Govee.
  • Ultrasonic activity in 18-22 kHz in all stores tested.
  • Magnetic field variation of 33-52 µT mapping cold chain sections.
  • Corporate WiFi infrastructure shared across two "different" store brands.
  • 58% more BLE devices visible with phone in hand vs pocket.
  • Indoor walking path from dead reckoning when GPS failed.

Estimated

  • 11-19 people nearby (RSSI-filtered, not a headcount).
  • Store zones from magnetic, acoustic, and heading transitions.
  • Fridge locations from magnetic spikes.
  • Surface materials from acoustic hardness.
  • Retail media infrastructure readiness.
  • Browsing vs walking from accelerometer.

Not Proven

  • Exact headcount.
  • Individual tracking across visits.
  • Demographics or purchase intent.
  • Whether anyone saw an ad.
  • What camera analytics ran.
  • Shelf-level product placement.
  • Floor changes (Samsung barometer returned 0).

The Samsung Tax

On the Samsung A52, Bluetooth scanning works while the screen is awake. Then the screen turns off and the scanner quietly dies. WiFi keeps working. Motion sensors keep working. Audio keeps working. BLE just stops.

The workaround is ridiculous but effective: keep the screen on, make it black, dim the brightness, and eat all touch events so the phone can sit in a pocket without calling emergency services or buying bananas. The barometer also returned 0 for every reading, so no floor detection. The fix for both problems is a Pixel. But the dumb workaround worked well enough to collect the data.

The Abyss

I started with the usual paranoid sentence: the store is tracking me.

After walking around with the app, the stranger sentence is: I was passively tracking the store. And the store was describing itself to every phone that walked in. Printers. Pumps. Shelf labels. Access points. Beacons. Displays. Ultrasonic signals in frequencies humans cannot hear. The entire technology stack, leaking into the RF environment.

For indoor mapping: the phone can trace the walk without GPS. The route does not need to stop at the door.

For retail media: the infrastructure is visible but the measurement is not. The phone can audit the plumbing. It cannot audit the cameras.

For privacy: the phone counts nearby devices, classifies them by manufacturer, and estimates density. It does this passively, with permissions that any fitness app already has. The retail media measurement industry is built on weaker proxies than what a phone in a pocket can collect for free.

All of this started because a parent wanted to know if the walk could keep being useful after the stroller crossed the automatic doors.

Our board has asked us to stop discovering ad networks inside normal parenting tasks. We are considering their request.
← Back to blog