The Federal Trade Commission (FTC) reached its first settlement with a data broker concerning the selling of accurate geolocation data of customers. As per the conditions of the settlement, X-Mode Social cannot sell or share sensitive location information to third parties except if it acquires permission from consumers or de-identifies the information.
X-Mode Social, now Outlogic LLC, based in Virginia works with app creators. It offers a software development kit (SDK) that could be built into smartphone applications that enable the collection of data through the apps, which includes accurate geolocation information. Precise geolocation data could determine where a person resides and works, the homes of friends and loved ones, and other places they go to. Some of those places may be very sensitive, for example, places of worship, centers of domestic violence, areas providing services to the LGBTQIA+ community, addiction treatment centers, and reproductive health establishments. When precise geolocation information is gathered that verifies consumers’ visits to sensitive places for instance reproductive health centers and places of worship, they can experience physical violence, discrimination, emotional stress, and other harms. Sen Ron Wyden decided that X-Mode had offered sensitive location information to U.S. military companies in 2020, and another client, a private clinical research firm, paid X-Mode to get access to client data that included visits to healthcare facilities, pharmacies, and specialty infusion centers across Columbus, Ohio, based on the FTC complaint.
FTC Claims X-Mode Social Involved in Illegal and Deceitful Practices
The FTC investigated whether the data broker committed unfair or deceitful works or practices. The FTC claimed that X-Mode marketed raw information to third parties without removing sensitive locations. X-Mode is additionally purported to have not implemented acceptable and proper safety measures against downstream usage of that information. Besides buying geolocation information from third-party applications, X-Mode likewise has its own applications – Walk Against Humanity and Drunk Mode. The FTC claims app users were not completely informed regarding the usage of the precise geolocation data.
As per FTC, X-Mode didn’t have guidelines and procedures to delete sensitive locations from its raw information prior to selling it, and its own app users weren’t advised regarding who would get their information, and safety measures were not set up to make sure that they could fulfill requests by users to choose not to be tracked and served personalized ads. The FTC claimed these failures were violations of the FTC Act section 5.
“With this activity, the commission rejects the idea so common in the data broker market that vaguely written disclosures can give a firm free license to utilize or peddle people’s sensitive location information,” stated FTC chair Lina M. Khan.
FTC Complaint Settled
As per the conditions of the settlement, Outlogic and X-Mode must carry out a program for keeping a complete list of sensitive locations, and that data can’t be disclosed, sold, or transmitted except if permission is acquired from consumers. Outlogic and X-Mode are likewise forbidden from utilizing location information when they do not know if a consumer has given permission.
Outlogic and X-Mode should create a supplier program to make sure that all organizations it buys data from are acquiring permission from customers for the collection, selling, and usage of information, and all precise geolocation data that signifies visits to sensitive areas that has been gathered without permission should be removed or destroyed, except if the information has been de-identified.
X-Mode and Outlogic must also carry out procedures to make sure that recipients of its location information don’t connect the information to locations that offer services to LGBTQ+ individuals, for example, bars or service companies, with areas of public gatherings of people at political or social demos or protests, or utilize location data to figure out the identity or location of a particular person.
Customers should also be given a basic and quick-to-find way of pulling out their permission to gather and utilize their location information and ask which data to be removed, and also give a clear and exact means for consumers to ask that any firms or people who were given personal information to delete location data from business databases.
Outlogic’s PR company stated to answer the FTC complaint and settlement. The company disagrees with the FTC press release. The FTC did not find any instance of data misuse and there was no such allegation. From its inception, X-Mode has enforced strict contractual conditions on all data clients forbidding them from connecting its data with sensitive places for example healthcare centers. Following the FTC’s newly released guidelines will be made certain by applying extra technical procedures and won’t demand any substantial changes to the company or products.
The settlement is going to be published in the Federal Register and feedback will be received for 30 days, then the FTC will decide whether to finalize the proposed consent order or not.