FTC Enforcements Against Location Data in 2024

The Federal Trade Commission (FTC) has recently intensified its focus on the protection of sensitive location data, marking a significant shift in its regulatory approach. This heightened scrutiny is evident through a series of enforcement actions against data brokers and companies involved in the collection, processing, and sale of location data. These actions underscore the FTC's commitment to safeguarding consumer privacy and ensuring that companies adhere to transparent and ethical data practices.

X-Mode Social and Outlogic

On January 9, 2024, the FTC issued its first-ever prohibition on the use, sale, and disclosure of sensitive location data against X-Mode Social and Outlogic (collectively referred to as "X-Mode"). This landmark action was driven by allegations that X-Mode engaged in unfair and deceptive practices by misrepresenting the use of location data and failing to obtain proper consumer consent. The FTC's complaint highlighted several critical issues:

1. Inadequate Disclosure of Use and Purpose: X-Mode's privacy disclosures were found to be insufficient, failing to inform consumers about the full extent of data usage, including the sale of location data to government entities. This lack of transparency prevented consumers from making informed decisions about their data.
2. Inadequate Protections for Sensitive Data: Until May 2023, X-Mode did not restrict the collection of location data from sensitive locations such as healthcare facilities, churches, and schools. The company lacked policies to remove sensitive locations from raw data before selling it, raising significant privacy concerns.
3. Failure to Honor Consumer Privacy Choices: X-Mode was criticized for not respecting consumer privacy preferences, particularly in cases where users had opted out of data collection.

The FTC's order against X-Mode mandated the implementation of an SDK Supplier Assessment Program to ensure that third-party apps using X-Mode's software development kits (SDKs) obtained proper consumer consent and adhered to privacy standards.

InMarket Media

Shortly after the action against X-Mode, the FTC announced a similar enforcement action against InMarket Media on January 18, 2024. The case against InMarket emphasized the need for transparency, proper notice, and consumer consent regarding the processing of sensitive location data. Key issues identified in the complaint included:

1. Lack of Consumer Notification: InMarket failed to notify consumers that their location data was being used for targeted advertising. The consent screens within apps only mentioned that location data would be used for app functionality, omitting details about precise location tracking and its commercial use.
2. Excessive Data Retention: InMarket's five-year retention period for location data was deemed excessively long, increasing the risk of data misuse or re-identification.

The FTC's order against InMarket prohibited the company from sharing, selling, or transferring sensitive location data without explicit consumer consent.

Broader Implications and Industry Impact

The FTC's recent actions against X-Mode and InMarket are part of a broader effort to address the growing concerns over the use of personal data in advertising and other commercial activities. These cases highlight several critical themes that are likely to shape future regulatory actions:

• Transparency and Consumer Consent. One of the central issues in both the X-Mode and InMarket cases was the lack of transparency and inadequate consumer consent. The FTC has made it clear that companies must provide clear and conspicuous privacy disclosures that accurately describe how consumer data will be used. Vaguely worded consent forms or disclosures that omit critical information are insufficient and can lead to enforcement actions.‍
• Protection of Sensitive Data. The FTC has emphasized that certain types of data, such as location data, are inherently sensitive and require robust protections. This sensitivity is due to the potential for such data to reveal intimate details about a person's life, such as visits to medical facilities, places of worship, or other sensitive locations. The FTC's actions signal that the sale or misuse of such data without proper safeguards is unacceptable.‍
• Data Minimization and Retention Policies. The FTC has also focused on the principles of data minimization and appropriate data retention periods. Companies are encouraged to collect only the data necessary for their operations and to retain it for the shortest time possible. Long retention periods increase the risk of data breaches and misuse, and the FTC is likely to scrutinize such practices closely.‍
• Future Directions and Regulatory Trends. The FTC's recent enforcement actions are indicative of a broader regulatory trend towards stricter oversight of data practices. Several key themes and potential future directions can be identified:
• Increased Enforcement and Penalties. The FTC has signaled its intention to continue aggressive enforcement actions against companies that violate consumer privacy. This includes not only fines and penalties but also more stringent measures such as outright bans on certain data practices, as seen in the cases against X-Mode and InMarket.
• Focus on Upstream Liability. FTC Chair Lina Khan has emphasized the importance of addressing upstream liability, targeting not just the consumer-facing applications but also the backend infrastructure that facilitates data collection and processing. This approach aims to hold all actors in the data ecosystem accountable for their roles in enabling unlawful conduct.
• Algorithmic Disgorgement. The FTC has increasingly used the tool of algorithmic disgorgement, requiring companies to delete not only unlawfully obtained data but also the data products created from such data. This measure aims to address the incentives that drive harmful data practices and ensure that companies do not benefit from their unlawful actions.
• Comprehensive Privacy Legislation. There is growing support within the FTC for comprehensive privacy legislation that would provide baseline protections for all consumers. Such legislation could help address the challenges posed by new technologies and business models that rely on extensive data collection.

Summing up

The FTC's recent enforcement actions against X-Mode Social, Outlogic, and InMarket Media represent a significant step towards stronger protection of sensitive location data. These actions highlight the importance of transparency, consumer consent, and robust data protection measures.

As the data economy continues to evolve, the FTC's regulatory approach is likely to become increasingly critical in ensuring that consumer privacy is respected and protected. Companies operating in this space must heed the lessons from these enforcement actions and adopt best practices to avoid similar scrutiny in the future.