Data broker X-Mode Social and its successor Outlogic will be banned from sharing or selling sensitive location data to resolve Federal Trade Commission allegations that the company sold precise location data that could be used to track visits people to sensitive places, such as medical and reproductive. health clinics, places of religious worship and shelters for victims of domestic violence.
In its first settlement with a data broker over the collection and sale of sensitive location information, the FTC also charged Virginia-based X-Mode Social and Outlogic, LLC, the successor company to which X-Mode transferred ownership. majority of its operations in 2021. , did not implement reasonable and appropriate safeguards regarding the use of such information by third parties. Today's action underscores the FTC's strong commitment to restricting the collection, sale, or disclosure of sensitive consumer location data.
โGeolocation data can reveal not only where a person lives and who they spend time with but also, for example, what medical treatments they seek and where they pray. The FTCโs action against X-Mode makes clear that companies do not have a free license to market and sell Americansโ sensitive location data,โ said FTC Chair Lina M. Khan. "By ensuring for the first time a ban on the use and sale of sensitive location data, the FTC continues its critical work to protect Americans from intrusive data brokers and unchecked corporate surveillance."
The raw location data that X-Mode/Outlogic has sold is associated with mobile advertising IDs, which are unique identifiers associated with each mobile device. This raw location data is not anonymous and is capable of matching an individual consumer's mobile device to the locations they visited. In fact, some companies offer services that help companies match such data to individual consumers.
X-Mode/Outlogic sells and licenses precise location data it collects from third-party applications that incorporate its software development kit (SDK) into their applications, from its own mobile applications, and by purchasing location data from others. data brokers and aggregators. The company sells consumer location data to hundreds of customers in industries ranging from real estate to finance, as well as to private government contractors for their own purposes, such as advertising or brand analysis.
According to the The FTC complaintAs of May 2023, the company had no policy to remove sensitive locations from the raw location data it sold. The FTC says X-Mode/Outlogic failed to implement reasonable or appropriate safeguards against the further use of the precise location data it sells, putting consumers' sensitive personal information at risk.
The information revealed through the location data sold by X-Mode/Outlogic not only violated consumers' privacy but also exposed them to possible discrimination, physical violence, emotional distress and other harms, according to the complaint.
The FTC also says the company failed to ensure that users of its own apps, Drunk Mode and Walk Against Humanity, as well as third-party apps that used the X-Mode/Outlogic SDK, were fully informed about how they would be used. your location data. For example, to grant X-Mode/Outlogic Access to your sensitive location data.
The company also failed to employ necessary technical safeguards and oversight to ensure it honored some Android users' requests to opt out of tracking and personalized ads, according to the complaint.
The company's business has also involved creating custom audience segments based on consumer characteristics. During at least one contract, Columbus, Ohio.
The FTC says these practices violate the FTC Act's prohibition against unfair and deceptive practices.
In addition to limits on sharing certain sensitive locations, the proposed order requires X-Mode/Outlogic to create a program to ensure that it develops and maintains a complete list of sensitive locations, and ensures that it does not share, sell or transfer location data about such locations. Other provisions of the proposed order require the company to:
- Delete or destroy all location data you previously collected and any products made from this data, unless you obtain consumer consent or ensure that the data has been de-identified or is not confidential;
- Develop a vendor screening program to ensure that companies that provide location data to X-Mode/Outlogic obtain informed consent from consumers for the collection, use and sale of the data or cease using such information;
- Implement procedures to ensure that recipients of your location data do not associate the data with places that provide services to LGBTQ+ people, such as bars or service organizations, with public gathering places of people in political or social demonstrations or protests, or use data location to determine the identity or location of a specific individual;
- Provide a simple, easy-to-find way for consumers to withdraw their consent to the collection and use of their location data and to delete any location data that was previously collected;
- Provide a clear and visible means for consumers to request the identity of people and companies to whom their personal data has been sold or shared or provide consumers with a way to remove their personal location data from commercial databases of all recipients of the data; and
- Establish and implement a comprehensive privacy program that protects the privacy of consumers' personal information and also create a data retention schedule.
The proposed order also limits the company from collecting or using location data when consumers have opted out of receiving targeted advertising or tracking or if the company cannot verify records showing that consumers have consented to the data collection. of location.
The Commission voted 3-0 to issue the proposed administrative complaint and accept the consent agreement. President Khan, accompanied by Commissioners Rebecca Kelly Slaughter and รlvaro Bedoya, issued a separate declaration.
The FTC will soon publish a description of the consent agreement package in the Federal Register. The agreement will be subject to public comment for 30 days after its publication in the Federal Register, after which the Commission will decide whether the proposed consent order is final. Instructions for submitting comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov.
NOTE: The Commission files an administrative complaint when it has โreason to believeโ that the law has been or is being violated, and it appears to it that a proceeding is in the public interest. When the Commission issues a final consent order, it has the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $50,120.
Lead attorneys in this matter are Bhavna Changrani and Brian Shull of the FTC's Bureau of Consumer Protection.
