Federal Trade Commission (FTC) has banned data aggregator InMarket Media from selling, licensing, transferring, or otherwise sharing any product or services that categorize or target consumers based on Sensitive Location Data.
It has come to the notice of FTC that data aggregator InMarket Media has been collecting and using the location data of the consumers without consent for marketing and advertising purposes.
“All too often, Americans are tracked by serial data hoarders that endlessly vacuum up and use personal information. Today’s FTC action makes clear that firms do not have free license to monetize data tracking people’s precise location,” said FTC Chair Lina M. Khan.”
“We’ll continue to use all our tools to protect Americans from unchecked corporate surveillance,” she added.
Texas-based InMarket Media is a digital marketing platform and data aggregator that collects vast amounts of consumers’ location data by tracking their movements over time through their mobile devices and then matching that information with other specific details – for example, their purchasing histories, their demographics, and their socioeconomic backgrounds.
As this case and others make clear, a particular FTC concern is the extent to which collecting location data can reveal where people live and work, where they worship, where their kids go to school, where they seek medical treatment and other sensitive information collected without consumers understanding what’s going on behind their backs.
Vicious Cycle of Data Theft
InMarket offers advertisers a product that sends push notifications based on a consumer’s location and “geofencing” – that person’s real-time proximity to a particular location.
For example, a consumer who was within 200 meters of a pharmacy might have seen an ad for toothpaste, cold medicine, or similar products. In addition, InMarket makes its advertising audience segments available on real-time bidding platforms.
That way advertisers could select a particular audience and bid on what they were willing to pay each time their ad appeared on the mobile device of a person who fit the selected category. InMarket made money each time an advertiser used that process.
The complaint alleges that InMarket unfairly collected and used consumer location data derived from its apps and third-party apps that included its location-grabbing SDK.
The FTC also says the company deceptively failed to disclose its use of consumer location data and unfairly retained it for longer than was reasonably necessary to effectuate its business purpose.
FTC as Data Guard
In 2014, the FTC issued a report recommending that Congress require data brokers to increase transparency and give Americans more control of their data.
FTC provided that unfair and deceptive trade practices are unlawful and empowered the Commission to prevent and protect consumers from such practices. For over two decades, the FTC has tried to remedy the situation through case-by-case enforcement and the encouragement of industry self-regulation.
Among other things, the settlement would require InMarket to implement an effective program to prevent it from using or sharing any products or services that categorize or target consumers based on sensitive location data.
In addition, it must destroy all location data it previously collected and any products produced from that data unless it gets consumer consent or ensures the data has been de-identified or rendered non-sensitive.
For consumers whose location data was collected through InMarket’s apps, the company must notify them about the FTC’s action in this case and give them a way to request that their location data be deleted.
What’s more, InMarket must provide an easy way for consumers to withdraw their consent for the collection and use of their location data. Once the proposed settlement is published in the Federal Register, the FTC will receive public comments for 30 days.
The proposed settlement sends important messages to others in the industry.
Data collection procedure and consequences
InMarket has maintained nearly 2,000 such audience segment lists that have included such categories as “parents of preschoolers,” “Christian church goers,” and “wealthy and not healthy.”
The FTC also says that the company’s policy of retaining geolocation data for five years was unnecessary to carry out the purposes for which it was collected and increased the risk that this sensitive data could be disclosed, misused, and linked back to the consumer, thereby exposing sensitive information about the consumer.
The app is free to download and includes in-app advertising. Although InMarket discloses in its privacy policy that it uses consumer data for targeted advertising, its consent screen does not link to the privacy policy language, and the misleading prompts do not inform consumers of the apps’ data collection and use practices.
Recently, FTC has also charged and prohibited X-Mode Social and Outlogic from sharing or selling any sensitive location data obtained from the users.
The precise location data that has been collected by X-Mode and Outlogic has the potential to track people’s visits to sensitive locations such as medical and reproductive health clinics, places of religious worship, and domestic abuse shelters.
InMarket Media failed to notify users of its apps that their location data would be used for targeted advertising.
In another similar case, last year in May, FTC held and fined BetterHelp $7.8 million for abusing user’s data for their commercial benefit. It failed to protect user’s health information after promising to keep sensitive mental health data private.
BetterHelp provided people’s email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest to use for advertising purposes despite promising consumers that it would not disclose or use their data except for limited purposes.
According to letters shared with CNBC in 2023, Lawmakers have asked as many as 20 broker companies including Equifax, Oracle, and Whitepages to reveal the types of information they collect on US consumers and how they distribute it.
Along with the details of types of sensitive information they gather such as health, location, and phone data, the companies were asked to disclose the information they collect on minors.
Need for data privacy and security
The ability to monitor, profile, and target consumers at a mass scale has created a persistent power imbalance that robs individuals of their autonomy and privacy, stifles competition, and undermines democratic systems.
It is far past time to disrupt this data abuse, set rules of the road for the online ecosystem, and ensure companies cannot extract private value from personal data in ways that undermine the public good.
When it comes to children and teens, their personal data protection needs to be heightened, because minors are uniquely vulnerable to profiling and the outputs of commercial surveillance systems. FTC is equipped to ban businesses that fail to implement reasonable security measures and engage in deceptive trade practices.
Consumers around the world are facing an epidemic of data breaches and resulting in identity theft due to lack of investment in and commitment to data security.
Americans do not have control over whether and where their personal data is sold and shared; they have no guarantee to access, delete, or correct their data; and they do not have the ability to stop the unchecked collection of their sensitive personal information.
According to the Electronic Privacy Information Center, the over-collection and secondary uses of personal data, including the sale to and use by data brokers, are inconsistent with the reasonable expectations of online consumers and may lead to discriminatory targeting that violates the privacy and autonomy of consumers.
