Geolocation Now Under Scrutiny by FTC

By: Linda L. Goodman

The Federal Trade Commission (“FTC”) testified before Congress on the Commission’s efforts to address the privacy concerns raised by the tracking of information about consumers’ location, as well as proposed legislation to protect consumer privacy involving geolocation data on June 4, 2014.

In that testimony, Director of the FTC, Jessica Rich, outlined the FTC’s ongoing efforts to protect the privacy of consumers’ geolocation information through enforcement, policymaking, and consumer and business education.

The FTC has now taken the positions that precise geolocation data is sensitive personal information increasingly collected for use in the marketing of consumer products and services. Although the FTC admitted that the collection and use of such data make consumers’ lives easier and more efficient, at the same time, it raises concerns because it can reveal a consumer’s movements in real time and provide a detailed record of a consumer’s movements over time. “Geolocation information can divulge intimately personal details about an individual. Did you visit an AIDS clinic last Tuesday? What place of worship do you attend? Were you at a psychiatrist’s office last week? Did you meet with a prospective business customer?” are the examples cited by the Director.

The lack of knowledge and consent was also addressed by the director who testified that Geolocation information may be sold to companies to help build profiles about consumers without their knowledge or consent, or it could be accessed by cybercriminals, hackers or through surreptitious means such as “stalking apps.”

Last month, the FTC used its enforcement authority under Section 5 of the FTC Act to take action against companies engaged in unfair or deceptive practices involving geolocation information. The most notable of those actions was the Commission’s settlement with the mobile messaging app Snapchat. Resolving FTC allegations that Snapchat made multiple misrepresentations to consumers about the disappearing nature of messages sent through its service, as well its transmission of users’ geolocation information. The FTC has raised similar allegations involving undisclosed collection and transmission of location data as part of privacy complaints against a popular flashlight app, as well as a national rent-to-own retailer and one of its software vendors.

In addition to its enforcement activities involving geolocation information, the Commission has conducted studies, held workshops, and issued reports on mobile privacy disclosures, mobile apps directed to kids, and other topics that elucidate best practices for companies collecting, using, and sharing geolocation information.

The testimony also provides the Commission’s initial views on the Location Privacy Protection Act of 2014 (“LPPA”). This proposed legislation seeks to improve the transparency of geolocation services and give consumers greater control over the collection of their geolocation information. The Director testified that the FTC supports the goals of the LPPA, and believes it is an important step forward in protecting consumers’ sensitive geolocation information.

In particular, the testimony highlighted three important LPPA provisions that are consistent with the Commission’s views:

The bill defines “geolocation information” as information that is “sufficient to identify the street name and name of the city or town” in which a device is located. This definition is consistent in many respects with the definition of “geolocation information” in the Commission’s COPPA Rule.
The LPPA requires that an entity collecting consumer geolocation information disclose its collection of such information. The Commission has recommended that companies make their data collection practices more transparent to consumers.
The LPPA requires affirmative express consent from consumers before a company may knowingly collect or disclose geolocation information.

In addition, the LPPA gives the Department of Justice sole enforcement authority and rulemaking authority, in consultation with the FTC. The Director recommended that the FTC Commission have rulemaking and enforcement authority with regard to the civil provisions of the LPPA, and that DOJ have enforcement authority for the criminal provisions. This would vastly expand the authority of the FTC.

Compliance Recommendation:

The enforcement cases mentioned in this article set out the following compliance standards for companies collecting, using, and sharing consumer geolocation data:

Prior to collecting geolocation and other personal information, the company or application must inform the consumer of what information is being collected, how it is going to be used, and whether the consumer has control of the collection process (can the consumer stop it). This may be accomplished through an end user’s license agreement.
The consumer must affirmatively express consent for the company or applicant to collect, use, or share such information. The consumer must press an acceptance link. No information should be collected until such time as the consumer accepts the end user license agreement.

______________________________________________________________________

This article is a publication of The Goodman Law Firm and is intended to provide information on recent legal developments. This article does not create an attorney-client relationship, nor should it be construed as legal advice or an opinion on specific situations. This may constitute “Attorney Advertising” under the Rules of Professional Conduct and under the law of other jurisdictions.

Linda L. Goodman is the founder of The Goodman Law Firm, concentrating its practice in internet business and law. Her firm’s clients include Advertisers, Affiliates, Affiliate Networks, and ISP’s.