Canberrans using Westfield shopping centres are being tracked with the centre's free wi-fi, with the data able to log the visitor's time spent in the centre, where they spent it and what websites they visited.
Fairfax Media visited Westfield Belconnen and used their free wi-fi network, before contacting Westfield's privacy officer who provided the data of the visit.
The data showed what websites Fairfax Media had visited on iPhone as well as where it had been, able to note details of what section of the centre the device was in, for how long and on what floor.
For example, it noted about 32 minutes spent on the centre's west end on the second floor and 30 seconds in the food court on the third floor in the southern end.
A Westfield spokesperson said the centre keeps the data "as long as necessary" and while their privacy policy states the data may be handed to companies for marketing purposes, the spokesperson confirmed Westfield doesn't.
Director of the Centre for Internet Safety at the University of Canberra Nigel Phair said data collection was a common practice amongst many companies offering free wi-fi.
"Logically the shopping centres want to monetise customers every size, shape or form," Mr Phair said.
He said theoretically a shopping centre could track your movements in a section with a particular set of brands, then track your web history as you searched for similar, cheaper products online before providing tailored advertising.
"Our intention with any data is to be able to better understand our customers' needs, and connect them with retailers in a more meaningful way," the Westfield spokesperson said.
"It's something that is optional for shoppers, who must elect to join our network."
"No one reads the terms and conditions, no one. They're almost being a bit too cute," Mr Phair said.
"What concerns me firstly is the average punter out there doesn't understand the value of their personally identifying information."
He pointed to the finance industry being forced to change its agreements to a 'plain english' format because bank customers were unable to understand what they were agreeing too.
"People need to be able to make proper assessments about whether they want to proceed," Mr Phair said and suggested a similar approach where users are shown three dot points identifying what data was being logged, what they would do with it and how long for.