FTC Poised to Ban Data Broker From Selling and Licensing Precise Geolocation Data

The FTC recently issued a proposed Decision and Order that, if finalized, will serve to settle the agency’s claim that data broker InMarket Media LLC engaged in unfair and deceptive conduct by collecting consumers’ location data and using it for advertising purposes. The Order comes just one week after the FTC entered a separate settlement with data broker Outlogic, also based on charges of unfair and deceptive practices involving location data. Notably, the proposed settlement includes the FTC’s first-ever prohibition on selling or licensing precise location data. In addition, among other things, the Order requires InMarket to destroy all location data it previously collected without express consumer consent unless it obtains such consent or ensures the data has been deidentified or rendered non-sensitive.

According to the FTC’s complaint, InMarket collects location data from millions of consumers via its software development kit (SDK) to target mobile ads for clients, including brands and advertising agencies. The SDK is integrated into InMarket’s proprietary apps as well as apps made by third-party developers. This location data allegedly enables the company to infer sensitive characteristics about consumers, including where they work, attend religious services, obtain medical treatment, go to political rallies, and bring their children to school. The FTC claimed that InMarket, by cross-referencing consumers’ location histories with “advertising-related points of interest,” created nearly 2,000 audience categories, such as consumers likely to be “well-off suburban moms,” “parents of preschoolers,” and “wealthy and not healthy.” The FTC alleged that the company generates these categories in part by combining location data with consumer attributes (e.g., age, income, and education level) purchased from other sources to make predictions about app users. For example, the complaint explains that InMarket could predict what type of vehicle a consumer who has visited a car dealership may be in the market for.

InMarket also allegedly offers advertisers a product that sends push notifications for an ad based on a consumer’s location within a virtual “geofence.” For example, a consumer in the vicinity of a pharmacy might receive an ad for toothpaste. Moreover, InMarket allegedly maintains real-time bidding platforms that enable advertisers to identify the amount they are willing to pay each time its ad appears on a mobile device used by part of a particular customer audience segment. The FTC explained that the advertiser’s ad will appear on specific devices if it has the highest bid.

The complaint alleged that InMarket misled users of its own apps — CheckPoints (for shopping rewards) and ListEase (for electronic shopping lists) — by failing to disclose that location data would be used for targeted advertising. The FTC acknowledged that InMarket’s online privacy policy stated consumer data is used for targeted advertising but found the in-app consent prompt displayed to consumers prior to location-data collection did not link to the policy. According to the FTC, neither app disclosed that InMarket was “collecting users’ precise location, often multiple times per hour, along with data collected from multiple other sources — including through other apps using the InMarket SDK — to build extensive profiles on users to be used to precisely target them with advertising.”

The FTC further alleged that InMarket did not contractually require third-party apps to obtain informed consent from users for location-data collection and use, and did not provide app developers with enough information for them to provide adequate disclosures about InMarket’s use of location data. According to the complaint, InMarket’s contracts with developers only state that the company will serve ads on the developer’s apps in exchange for developers transmitting user information, including precise location and advertising identifiers.

The complaint also states that InMarket retained consumers’ location data for five years, which in the FTC’s view is “far longer” than reasonably necessary to accomplish the purpose for which the data was collected. The FTC stated that this excessive retention period “significantly increases the risk that this sensitive data could be disclosed, misused, and linked back to the consumer, thereby exposing sensitive information about that consumer’s life.”

Based on these allegations, the FTC asserted four causes of action against InMarket under Section 5(a) of the FTC Act: unfair collection and use of consumer location data, unfair collection and use of consumer location data from third-party apps, unfair retention of consumer location data, and deceptive failure to disclose InMarket’s use of consumer location data. For each unfairness claim, the FTC asserted that InMarket’s location data practices resulted “in substantial injury in the form of a loss of privacy about the day-to-day movements of millions of consumers and an increased risk of disclosure of such sensitive information.” Regarding its deception claim, the FTC stated that the company violated direct and indirect representations made to consumers that CheckPoints and ListEase would only use location data to award extra points for walking into stores or to send list reminders.

Before Lina Khan became chair, the FTC focused its privacy violation investigations primarily on whether a company had engaged in deceptive acts or practices, such as failing to adhere to representations made in privacy notices. The InMarket case highlights the FTC’s willingness to claim unfairness in addition to deception, regarding allegedly abusive data collection, use, and disclosure practices. In the FTC’s announcement of the Order, Khan put companies that broadly track consumers’ locations on notice: “[a]ll too often, Americans are tracked by serial data hoarders that endlessly vacuum up and use personal information. Today’s FTC action makes clear that firms do not have free license to monetize data tracking people’s precise location.”

We are watching these developments closely at Arnold & Porter and will keep you updated here on Enforcement Edge

*Adrian Chochorek contributed to this Advisory. Mr. Chochorek is a graduate of the New York University School of Law and is employed at Arnold & Porter's New York office. He is not admitted to the practice of law.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.