Online retailers have long gathered behavioral metrics about how customers shop, tracking their movements through e-shopping pages and using data to make targeted offers based on user profiles. Retailers in meat-space have had tried to replicate that with frequent shopper offers, store credit cards, and other ways to get shoppers to voluntarily give up data on their behavior, but these efforts have lacked the sort of data capacity provided by anonymous store browsers — at least until now. This holiday season, shopping malls in the U.S. have started collecting data about shoppers by tracking the closest thing to “cookies” human beings carry — their cell phones.

The technology, from Portsmouth, England-based Path Intelligence, is called Footpath. It uses monitoring units distributed throughout a mall or retail environment to sense the movement of customers by triangulation, using the strength of their cellphone signals. That data is collected and run through analytics by Path, and provided back to retailers through a secure website.

On March 31, Path CEO Sharon Biggar presented the tech at the ICSC Fusion conference in Los Angeles. She discussed how data collected by Footpath could be used by retailers to boost revenue. Options include tracking response to mailers and other advertising by providing the equivalent of web metrics like unique visitors, “page impressions” (measuring how many people walked past a display or advertisement), and “click-through” (determining how many people who passed an advertisement then visited the store associated with it). “Now we can produce heat maps of the mall and show advertisers where the premium locations are for their adverts,” she said, “and perhaps more importantly we can price the advertising differently at each location.”

In the United States, Footpath is being trailed in two malls by Forest City, a mall real estate company that owns malls and shopping centers nationwide. Promenade Temecula in Temecula, California, and Short Pump Town Center in Richmond, Virginia, are the sites of choice; the trial starts Cyber Monday, and will run through New Year’s Day. In a written statement, Forest City’s spokesperson Lindsey Cottone said that Forest City was being “totally transparent” about the trial, posting signage to “inform customers that the survey is taking place.”

Forest City’s senior vice president of marketing, Jane Lisey, emphasized that the company was not collecting personally identifiable information about shoppers from their phones, and that customers’ phone numbers and other information were protected by their wireless carriers. “Before agreeing to test this technology it was essential to determine and guarantee that the personal information of our shoppers would be completely anonymous to all parties,” she said.

While Footpath uses only the signal fingerprint of the phone, it does give a fairly accurate record of where the phone has traveled through a mall. According to the editor of trade site Storefront Backtalk, Evan Schuman, the data can be paired with other sources of data, including surveillance video and point-of-sale transaction information. If they went this route, retailers would get a very detailed profile of who’s carrying each phone.

“Some malls are even using facial recognition software,” Schuman told Ars Technica in a phone interview, with the primary purpose of “loss prevention” — identifying shoplifters. But that data, he said, could be tied to location data to be turned into customer relationship management data. Mall operators could then theoretically sell data to retailers, alerting them when big-ticket shoppers were approaching so that they could be given personalized service.

There’s just one problem with this type of detailed tracking: It’s technically illegal, according to Mark Rasch,the director of cybersecurity at CSC. Thanks to court interpretations of provisions in the Patriot Act, he said in a recent blog, devices that measure cellphones’ signal strength could be considered to be “pen registers” — monitoring devices that require a warrant.

“Although this mall technology might not identify specific individuals, it raises a bunch of privacy red flags,” he wrote. “First, the instant the consumer identifies himself or herself anywhere in the mall (say, by using a credit or debit card to buy something), it is a trivial task to cross reference the cellphone data with the payment data and realize that the person hanging around outside the Victoria’s Secret dressing room was your 70-year-old neighbor.”

That’s more information than many consumers are interested in divulging. So far, however, there’s been no sign that the legality of the service will be tested in court. And retailers could conceivably use the same justification for the technology that they use for facial recognition software: “loss prevention.” In many jurisdictions, real estate owners are given wide latitudes about what they monitor on their own premises.