We go to Red Robin about once a month; it's close by and has reasonable kid food, and the burgers aren't bad, if a little greasy. At least at the one by our house (Bridgepointe, in San Mateo, CA), the waitstaff are generally very nice and do their best, which is more than I can say for a lot of other places, let alone chain restaurants (which I generally loathe). So while pre-kids we had only been to RR a few times (mostly as "work" outings), it's now someplace we frequent.
So last time we were there, we were given a 'rewards' card, and asked to sign up online. I'm not actually much for rewards programs in general unless there's an obvious tangible benefit to me (frequent flyer miles for example). But since we are there often enough, I thought I'd at least check it out.
The enrollment website
The
website for the "Red Royalty Bottomless Rewards" enrollment is well-intentioned but has some flaws right off the bat -- not conforming to ARIA accessibility, and requiring use of the mouse for early prompts. Ok, not a huge deal but something they should remedy. But then the enrollment form, which is fairly long, has
way too much information for my comfort level. Specifically:
- Name
- Address
- Birthdate (enter twice! more on this later)
- Email address
- Phone number (more on this later)
- T&C agreement (more on this later)
- Gender
- Household size and "type"
- 7 more RR-specific "habits" questions
Birthdate
It's stated that birthdate is asked because "members must be 18 or older to participate". I much prefer if instead of this, they have a checkbox for "I certify that I am 18 years or older", as birthdate is an often important piece of information for identity theft. If the only real reason is to verify you're over 18, this is unnecessary. If they want to know when your birthday is for promotions, just as what month, or what month and day (at most!), but have the checkbox for the "over 18" to avoid having the full information. Yes I realize this makes it more difficult to get full demographics for your marketing, but there are other questions you can ask (and indeed, they do), that would be sufficient for segmentation.
One of the perks is, indeed that you get a free burger on your birthday. But there's no reason to use the information provided on the site for this; the "over 18" checkbox is sufficient, along with checking driver's license or other ID (remember, you have to be 18 or over) at time of redemption by the customer. Besides, it sounds like (from the FAQ) that you can redeem the burger promo any time during the month of your birthday (which is much more beneficial if true; I would prefer to spend my birthday eating at nicer joints than RR, sorry!)
Interestingly, the lawyers at RR may have known this all along. The Terms and Conditions for enrollment state (see bold, underlined text):
ENROLLING
Pick up a Red Royalty™ Card (“RR Card”) at a participating Red Robin® restaurant. That RR Card identifies you as a member of the RR Program. You can start earning Rewards the moment you receive your RR Card, but you must register your RR Card on-line at www.redrobin.com/RedRoyalty (“Website”) before you can receive any Rewards. Enrolling is simple: Step 1: Enter your RR Card number; Step 2: Re-enter your RR Card number to verify, Step 3: Enter your local zip code, Step 4: Select your local Red Robin restaurant, Step 4: Enter your name, postal address, email address, and telephone number, etc., and answer several questions; Step 5: Confirm that you are at least 18 years of age by checking the appropriate box, Step 6: Agree to the Terms and Conditions. That’s it!
Phone number as password?!
Probably one of the most surprising aspects of the program is that your phone number is used as your password. Now, I haven't had a chance to actually try all of this out, so it's possible at the current moment, this is OK (i.e., knowing my password is only used for crediting my account, and never as a way to divulge my information, even to myself), but I doubt this is the case now, nor can be guaranteed for the future. Sure, phone number is easy for people to remember, but it's just about the worst possible data to use as a password. If you want to do this, don't call it a password, just say 'phone number'. It's not secret, far from it; many people know a person's phone number, and it's trivially easy to find out for most people, as well. Casting it as a "password" is ridiculous.
This is from the T&Cs, btw:
You will need your password (phone number) to access your Red Royalty™ account ("RR Account"). If someone does learn your password, then you accept full responsibility for any actions that person takes using your password.
So what it honestly reads is, "if someone does learn your phone number, then you accept full responsibility for any actions that person takes using your phone number". Hmm, really. Not good; this is bad planning at best, and lawsuits waiting to happen at worst. Come on RR, you can do better than this.
T&C agreement: Privacy
Specifically, the section on "Privacy", which is honestly typically the only useful/interesting bit of these things, and the part you should actually read when agreeing to these things (well, yes, you should read the whole thing, but let's be realistic here). But it's usually worth a minute or two to see how these folks expect to use your information. RR's privacy section (the first, relevant bit) is relatively straightforward and typical, except for something odd. Check this out:
PRIVACY
We will use the information you provide us in the manner described in our Privacy Policy, which you may read by clicking on the Privacy Policy button where it appears on this Website. If we revise our Privacy Policy, then these Rules will automatically refer to the revised Privacy Policy
Yes, this is what I want to find out... how will you use the information I provide? Let me click that 'Privacy Policy' link that's underlined right there... oh wait, that's just underlining, it is NOT a link. Oh but I guess you knew that would be the case, since the next sentence is "you may read by clicking on the ... button where it appears". So where does this "button" appear? It's a link in the footer, which is fine. And the actual Policy is long, but better-than-industry average in terms of the controls and language used. But basically, like many, says we're going to give your info to any business partner, which essentially means anyone, in the future. The sticking point is that the policy clearly states that at the time of PII (personally-identifiable-information) collection, they will inform you of the use of the information, except when it's prohibitive (such as the space on a comment card) to do so. Obviously on the web this isn't an issue, and yet at the time of the Rewards program enrollment, there is no indication of the use of this information, so I believe the enrollment form technically is NOT in compliance with their own stated Privacy Policy.
Wait, who cares?
The biggest concern is that Red Robin will lose your information, either via direct electronic attack or via social engineering. For example, if I know a phone number, I can say that I left my card at home and still receive credits. What if I call RR's customer service with "my phone number" and try to extract other information such as birthdate from the call center? This happens every day to businesses, and it's a lot easier many times, than you might think. I'm not saying RR doesn't have strong privacy controls in place (such as customer service not being able to even access PII), but I'd be surprised if it was bulletproof. Remember that they are a restaurant, not an IT firm. And much bigger companies than this, get their customer records stolen by outsiders, disgruntled employees, etc. With name, address, phone number, and birthdate, I'm only one piece of information away from getting credit cards (social security number). Now, I can probably get a CC without the correct SSN some percentage of the time anyhow (more on this in another article one day) but let's assume I do want that piece of information as well. How much social engineering will it take, with a stolen customer DB, to extract that from the customers themselves? I bet the same database will have information about visits. I can call up customers posing as Red Robin, saying they've won the special prize of the day (say, $500, that's a good tipping point) for visiting last Tuesday (when they actually did visit), and all I need is to verify your information (name, address) oh and by the way I need your SSN. This will work on a nontrivial percentage of consumers.
Just don't register?
Well, obviously if you don't care about the program, no. And if you want to actually redeem the rewards, then yes, you do. But you don't need to do so just to collect 'credits' (i.e., buy 9 items, get the 10th free). So I think for now, I'll just be collecting credits. If I feel compelled to later (and the enrollment form gets a bit less involved), I might actually register to redeem them.
Reducing risk
To reduce the risk of exposure due to data leakage, one certainly could provide fake information, such as an alterative birthday (perhaps of your favorite musician or President), and a fake phone number. The phone number's tricky, though, since of course someone probably has that number, and since that's sufficient for at least granting credits to the account (not harmful in and of itself but not ideal, either), you probably don't want to do that. Probably even a fake address would be fine, as the points are earned, and 'rewards' paid out, at the restaurant proper.
Another tactic would be to use nonstandard phone numbers, for example, if you were the first person to register an account with the Red Robin corporate headquarters' number (it's probably too late already :) ) or local restaurant's number, you might accumulate a huge number of credits; I bet at bunch of employees will sign up with that number, too and forget their cards, and provide their "password" one day...
It appears their registration form supports the "+" style email aliases provided by Gmail (for example, yourname+redrobin@gmail.com), which is good because (a) it's a perfectly valid email address and sites that don't like plus signs in emails are broken and (b) allows you to track marketing contacts, or other contact, if and when your email address is sold/traded/shared/stolen out of their database.
Finally
Red Robin is entitled to conjure up and sort of loyalty program they wish, and as with most, it'll provide some value to some customers, and certainly, to Red Robin. But for the sake of those of us who care, it'd be nice if they could use a little more care with the actual enrollment/implementation of the program, to protect customer privacy as much as possible; they should work hard to acquire, and store, only the bare minimum data required to fulfill their needs. This really doesn't mean birth year, and certainly doesn't mean using phone numbers as passwords. I like Red Robin, but probably won't participate fully in this program (and will miss out on some discounts). If you choose to participate, know what you're getting into, weigh the risks, and try to minimize them if possible. And of course, if you do sign up, make sure you get your rewards, that's the whole point for you, right?!
