This is after forcing login to a store account:
At least they don’t hide in their ToS that:
“l agree to let Walmart monitor my use of Walmart WiFi, including to:
- Determine my presence in Walmart stores
- Associate information about me with my Walmart account
- Improve products and services
- Gather market insights about my in-store purchases and activities”
But that’s not enough, they need to monitor your internet activity further too.
For further reading, some greatest hits (the section headers on Wiki’s Criticism of Walmart):
- Local communities
- Allegations of predatory pricing and supplier issues
- Labor relations
- Poorly run and understaffed stores
- No AEDs in stores (automated external defibrillators)
- Imports and globalization
- Product selection
- Taxes
- Animal welfare
- Midtown Walmart
- Opioids settlement
They aren’t invading the privacy here. They are preventing a malicious actor from running an attack via VPN and ssh tunneling in addition to IP address, device, etc. At worst they are associating IP with browsing at competing stores. Preventing the VPN was likely required by a lawyer and auditor and a risky attack vector for a billion dollar company.
If Walmart was breaking https and inserting man in the middle games it would be in their policy. Other commentators went off into fantasy land edge cases where traffic is being decrypted. And it still doesn’t change my expectation of privacy on a public hotspot.