low flash
February 15, 2024
The Federal Trade Commission (FTC) recently reached two settlements in cases against data brokers regarding the use of consumer location data and prohibitions on the collection, use, and sale of consumer location data without consent. This suggests that the FTC will continue to closely monitor companies that collect, use, or sell location data, especially for geolocation data that requires clear and explicit consent from consumers. Establishing robust processes may become increasingly important.
FTC Settlement and Proposed Order
The FTC has accused (1) X-Mode Social Inc. and its successor, Outlogic LLC, and (2) InMarket Media LLC, of ”unfair” or “deceptive” practices by these companies in violation of the following general provisions: He filed a lawsuit alleging that he had acted in a “target” manner. Section 5(a) of the FTC Act [1] By misrepresenting or failing to disclose material facts to customers. Specifically, the FTC alleged that X-Mode only told consumers that their geolocation data would be used for targeted advertising. But in reality, X-Mode sold consumer geolocation tracking data to clients including private government contractors.
As for InMarket, the FTC argued that the company does not directly sell location data. Rather, the FTC alleged that InMarket sold products created from geolocation data. In a more novel and tense application of FTC law, the FTC also requires InMarket to ensure that third-party developers using its software have consumers’ consent for their geolocation data to be sent back to InMarket. He claimed that there was no.
The cases against X-Mode, Outlogic, and InMarket are the first two FTC settlements involving the sale of geolocation data or products made from that data. The FTC also filed a lawsuit against Kochava Inc. in August 2022 for allegedly selling sensitive location data, but the matter is currently pending in federal court in Idaho. [2]
Consent required for collection, use, or sale of location data
In its consent order, the FTC makes clear that companies must obtain “affirmative explicit consent” from consumers before collecting or using “location data.” Location data is defined as “any data that may reveal the location of a mobile device or consumer.” exact locationincluding but not limited to Global Positioning System (GPS) coordinatesbase station information, or precise location information inferred from Basic Service Set Identifier (BSSID), WiFi Service Set Identifier (SSID) information, or Bluetooth receiver information, and unique persistent information combined with such data. “identifier” (emphasis added).
Both proposed orders incorporate the same requirement of “affirmative express consent” and what the FTC expects companies to display on their websites to avoid the risk of misleading consumers. This is a good indicator of whether or not they are present. Specifically, affirmative express consent is “a freely given, specific, informed, and unambiguous indication of an individual consumer’s wishes that indicates consent by the individual” by disclosing it. is.
- Categories of Information the Company Collects.
- The purpose of the company collecting, using, or selling that information.
- Identification of the entity collecting the information or to whom the information is disclosed.and
- A hyperlink that allows consumers to easily withdraw their consent to a company’s use of their information.
Under the proposed order, a company’s disclosures must be “clear and conspicuous.” That is, as the proposed order states, when a disclosure is online, it is more easily noticed, read, and understood than other accompanying text in size, contrast, position, or other distinct characteristics. You need to stand out. Disclosures must be understandable to ordinary consumers.
The FTC adds to companies’ use of “sensitive location data,” data that reveals where people live and work, where they worship, where their children go to school, and where they receive medical treatment. Established a limit. Others. In particular, X-Mode, Outlogic, and InMarket are strictly prohibited from selling, sharing, or disclosing such data.
Contouring precise geolocation data
It is important to note that these FTC actions include precise geolocation data. Specifically, these companies use GPS signals from consumers’ mobile devices, which can determine their location within a few feet. Many other technologies are far less accurate in determining location and may not be subject to the same level of scrutiny.
For example, your computer’s IP address may be tied to the physical address of your connection to the Internet. This is often available at the zip code, city, or state level. It’s often wrong.
Similarly, asking consumers to submit their postal code does not require the same level of precision. The FTC’s order also relies heavily on “tracking” capabilities, the fact that the technology includes real-time movement information, not just static location at a single point in time. Perhaps less scrutiny should be applied to a single location at a single point in time.
Obtaining future consumer consent
It is clear that the FTC intends to apply the FTC Act to misrepresentations or nondisclosures regarding the use, disclosure, or sale of precise geolocation data. By entering into these two settlements, the FTC provides guidance for the robust and clear consent regime it envisions. Going forward, companies that collect, use, or sell precise geolocation data should keep the following in mind:
First, companies that collect, use, or sell precise geolocation data must identify for consumers (1) what specific categories of information they are collecting, and (2) why and for what purpose they are collecting the data. , you should create a written policy that is clear and easily accessible. the purposes for which the data will be used; (3) the third parties (or types of third parties) that may collect or receive the data; and (4) the means by which consumers can opt out of such data collection. This applies not only to companies that collect geolocation data, but also to companies that provide geolocation data to third parties or implement it in their own products or targeted advertising. .
Second, companies must clearly and conspicuously disclose their written policies. When online, a disclosure or a link to a disclosure must be made more prominent than accompanying text by size, contrast, color, position, or other characteristics of the text. Disclosure must also be unavoidable. In other words, it is no longer enough to embed a disclosure at the bottom of a company’s webpage.
Third, businesses may need to ensure they have explicit consent from consumers. This can be done online through a clickwrap agreement, provided the aforementioned disclosure, or a link to the disclosure, is located near the consent button. Businesses must also keep user consent in writing, including the date and time the consent occurred and any withdrawal of consent.
Finally, companies that collect sensitive As mentioned above, location data may come under increased scrutiny from the FTC. In these situations, it’s important to have and follow clear internal policies and procedures on how such data is stored and used. These steps should make clear that consumers are not being categorized or targeted based on their presence in sensitive locations.
