How does your privacy turn into a commodity, and how to deal with it?
The US Federal Trade Commission (FTC) has announced the settlement of a dispute with a location data broker. The FTC's decision is a signal that the agency is stepping up its oversight of a sector that often sells people's sensitive data without their knowledge or consent.
What is the reason for the trial?
InMarket Media, a Texas-based company, is accused of improperly collecting, using, and storing user location data, which was then offered to advertisers as specialized audience segments and stored for 5 years.
The FTC alleges that InMarket did not provide consumers with complete information and did not obtain their consent before collecting and selling location data to advertisers. The company's actions violate Section 5 of the FTC Act, which prohibits unfair and misleading practices.
Third-party apps as a data collection tool
The FTC points out that InMarket has created the InMarketSDK (Software Development Kit, SDK), which is embedded in mobile applications. The technology made it possible to track the exact movements of users by placing them in applications that request access to location data in the mobile device's operating system.
Since 2016, about 100 million unique devices have transmitted location data to InMarket annually, and since 2017, the technology has been downloaded on more than 390 million unique devices. The huge number of downloads was driven by InMarket's promise to provide a portion of the revenue to more than 300 app developers who have implemented InMarket technology in their products.
If there is a pharmacy nearby, then it's time to brush your teeth
The FTC said InMarket's location data is passed to a larger targeted advertising system that matches location histories to specific locations to determine if a user has visited the advertised locations. According to the FTC complaint, the company then sorted consumers into nearly 2,000 targeted ad segments, such as "Christian church members," "healthy and rich," or "not healthy and rich."
The complaint also alleges that InMarket sold advertisers the ability to send push notifications to consumers based on their location. For example, a consumer who is within 200 meters of a pharmacy might see an advertisement for toothpaste or medicines.
Lack of consent
Although InMarket has notified in its privacy policy that it uses data for targeted advertising, the FTC claims that this notification is insufficient because the consent screen does not contain a link to the privacy policy.
In addition, InMarket did not receive informed consent from users of third-party apps that use its SDK technology, and did not even inform the developers themselves that the location data collected will be used to segment consumers for marketing purposes.
Regulation result
Under the terms of the agreement, the company will not be allowed to sell or license accurate location data and products that classify consumers based on sensitive location data. InMarket is also required to delete all previously collected location data, simplify the procedure for revoking consumers ' consent to the collection and use of their location data, and create a mechanism for requesting deletion of previously collected data.
InMarket has stated that it is not interested in selling consumer location data and has confirmed that it will not do so. The company also announced that it is expanding the protection of sensitive consumer location data and working with partners to ensure transparency in their notification and consent processes.
The US Federal Trade Commission (FTC) has announced the settlement of a dispute with a location data broker. The FTC's decision is a signal that the agency is stepping up its oversight of a sector that often sells people's sensitive data without their knowledge or consent.
What is the reason for the trial?
InMarket Media, a Texas-based company, is accused of improperly collecting, using, and storing user location data, which was then offered to advertisers as specialized audience segments and stored for 5 years.
The FTC alleges that InMarket did not provide consumers with complete information and did not obtain their consent before collecting and selling location data to advertisers. The company's actions violate Section 5 of the FTC Act, which prohibits unfair and misleading practices.
Third-party apps as a data collection tool
The FTC points out that InMarket has created the InMarketSDK (Software Development Kit, SDK), which is embedded in mobile applications. The technology made it possible to track the exact movements of users by placing them in applications that request access to location data in the mobile device's operating system.
Since 2016, about 100 million unique devices have transmitted location data to InMarket annually, and since 2017, the technology has been downloaded on more than 390 million unique devices. The huge number of downloads was driven by InMarket's promise to provide a portion of the revenue to more than 300 app developers who have implemented InMarket technology in their products.
If there is a pharmacy nearby, then it's time to brush your teeth
The FTC said InMarket's location data is passed to a larger targeted advertising system that matches location histories to specific locations to determine if a user has visited the advertised locations. According to the FTC complaint, the company then sorted consumers into nearly 2,000 targeted ad segments, such as "Christian church members," "healthy and rich," or "not healthy and rich."
The complaint also alleges that InMarket sold advertisers the ability to send push notifications to consumers based on their location. For example, a consumer who is within 200 meters of a pharmacy might see an advertisement for toothpaste or medicines.
Lack of consent
Although InMarket has notified in its privacy policy that it uses data for targeted advertising, the FTC claims that this notification is insufficient because the consent screen does not contain a link to the privacy policy.
In addition, InMarket did not receive informed consent from users of third-party apps that use its SDK technology, and did not even inform the developers themselves that the location data collected will be used to segment consumers for marketing purposes.
Regulation result
Under the terms of the agreement, the company will not be allowed to sell or license accurate location data and products that classify consumers based on sensitive location data. InMarket is also required to delete all previously collected location data, simplify the procedure for revoking consumers ' consent to the collection and use of their location data, and create a mechanism for requesting deletion of previously collected data.
InMarket has stated that it is not interested in selling consumer location data and has confirmed that it will not do so. The company also announced that it is expanding the protection of sensitive consumer location data and working with partners to ensure transparency in their notification and consent processes.
