Skip to content
Naked Security Naked Security

Students swap data for coffee at cashless cafe

In this US-based cashless cafe, university students hand over personal data in exchange for a dose of caffeine and sponsorship propaganda.

How much is the personal data of young people worth?
Stop. We know what you’re thinking. You’re thinking it’s worth about as much as a large pizza.
Sorry, but no – that’s circa 2016 thinking, when 42% of 13- to 17-year-olds said they’d rather give away their personal data than work at a job to earn $20.
But since February, personal data has been worth a cup of coffee. News of the devaluation comes with the opening of Shiru Cafe, which now has a branch in Providence, RI, near Brown University.
The University’s staff and faculty have to shell out $1 for their beverage, but students caffeinate in exchange for nothing more than a college ID… and their names, phone numbers, email addresses, majors, dates of birth, professional interests, “IT skills,” “previous internships,” and the size of “company the student is interested in”. As the BBC reports, the students fill that personal data into an online form.
By doing so, they agree to receive information – via logos, apps, digital ads displayed in stores and on mobile devices, signs, surveys and well-briefed baristas – from the corporate sponsors who pay for those roasting beans.
At any rate, all that will theoretically come to pass as soon as Shiru Providence actually has corporate sponsors. Keith Maher, the manager of Shiru’s Providence locations, told NY Magazine that for now, the cafe’s screens are just showing ads for internship positions at Shiru, until the company manages to recruit actual, paying sponsors.
The college ID can be from any college. But without that ID, unaffiliated patrons are gently being told to hit the highway – being a completely cashless cafe, the general public or privacy-conscious students don’t even have the option to buy a coffee at the normal price.
The Providence location is Shiru’s first US store, but it’s also planning to open cafes near Harvard University, Yale University, Princeton University, and Amherst College. It’s already running more than 20 locations across Japan and India’s most prestigious universities, including Tokyo University and the Indian Institutes of Technology.
Students’ reactions have been mixed. A few months before the Providence Shiru opened, two Brown students wrote a letter calling for a boycott, not on privacy grounds, but on the ethics of sponsoring companies:

Brown should send a clear message rejecting the cafe’s stated desire to draw smart and talented people to work for large corporations, whose principles are frequently at odds with those of our community.

On the other hand, some students shrug.
The data’s already out there, the thinking goes, given things like the Cambridge Analytica/Facebook data-sharing scandal, the 50 million Facebook accounts recently breached, the fact that we’ve given our phone numbers to Facebook for security purposes only to have them used to advertise at us, and all the other, non-Facebook-related breaches in recent years. Plus other social media. Plus LinkedIn. You get the idea.

The cafe asks that students drink their coffees in the shop – all the better to drizzle sponsorship all over them and encourage them to connect to the cafe’s wifi.
But hey, the coffee comes in disposable cups. Students who don’t savor the taste of sponsorship propaganda, or who dislike the possible privacy risks of signing up and ordering via smartphone, or who don’t like ads on their phones, are picking up the coffee and walking out.
Maher, the manager of the Shiru in Providence, told NY Mag that the store is collecting only the data it asks for on the intake forms, and that it’s only going to share it in anonymized form with sponsor companies.


The “it’s anonymized” line is a familiar one, and it’s one that Big Data researchers love to skewer by doing things like pinpointing people after looking at a bunch of supposedly anonymized credit card transactions.
Sarah Ferris, assistant manager at the Providence Shiru, told the BBC that the company is “good about keeping everyone’s information close. They don’t sell it, they don’t do anything of that sort.”
Indeed, Shiru’s privacy policy states that it may “disclose aggregate information about our users and information that does not identify any individual without restriction.”
Unfortunately, once a company has a wealth of valuable data, good intentions don’t always stop it from selling that hot commodity.
Free coffee: it would be an irresistible idea, if not for the fact that nothing’s really free, particularly when you’re talking personal data.


Unless that data has been backed by proof (photocopies of documents etc), its accuracy will be doubtful to say the least. Just like with Facebook data, many people will give out false, incorrect information that has not actual value at all.


And for good reason. So if they only share anonymised data why do they need identifiable data in the first place!! No thought about data minimisation then?


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!