Mall operator records millions of shoppers without consent