FTC Announces Settlement Banning Digital Marketer's Precise Consumer Location Data Sales and Licensing | Practical Law

FTC Announces Settlement Banning Digital Marketer's Precise Consumer Location Data Sales and Licensing | Practical Law

The FTC has announced a proposed consent order with InMarket Media, LLC, over allegations that the digital marketing platform and data aggregator's collection, use, and sale of consumers' location data, including its failure to obtain consumers' prior informed consent to use their location data for targeted advertising, violated the FTC Act's prohibition against unfair and deceptive practices. The proposed order prohibits the digital marketer from licensing or selling location data and from selling products or services targeting consumers based on their location data and provides important guidance for companies collecting location data.

FTC Announces Settlement Banning Digital Marketer's Precise Consumer Location Data Sales and Licensing

by Practical Law Data Privacy & Cybersecurity
Published on 22 Jan 2024USA (National/Federal)
The FTC has announced a proposed consent order with InMarket Media, LLC, over allegations that the digital marketing platform and data aggregator's collection, use, and sale of consumers' location data, including its failure to obtain consumers' prior informed consent to use their location data for targeted advertising, violated the FTC Act's prohibition against unfair and deceptive practices. The proposed order prohibits the digital marketer from licensing or selling location data and from selling products or services targeting consumers based on their location data and provides important guidance for companies collecting location data.
On January 18, 2024, the FTC issued a press release announcing a settlement with digital marketer and data aggregator InMarket Media, LLC regarding precise location data collection and use.
InMarket collects precise consumer location data through both its own mobile apps and third-party mobile apps using its software development kit (SDK) and combines that data with consumer data obtained from other sources to serve targeted advertising to consumers on behalf of InMarket's clients. InMarket also uses this aggregated consumer location data to create audience categories that it provides to its clients to target consumers more precisely on third-party advertising platforms.
The FTC's complaint alleges that InMarket engaged in several unfair and deceptive business practices that violated FTC Act Section 5(a), including:
  • Collecting consumers' location data through its own and third-party apps without consumers' informed consent, including failing to fully and clearly disclose how collected data would be used, shared, or sold. Specifically, InMarket neglected to disclose to consumers that their location data was used for targeted advertising and to create consumer profiles.
  • Failing to inform third-party apps that InMarket combines location data provided through InMarket's SDK with other data to create targeted advertising consumer profiles and categories.
  • Failing to verify that third-party apps using its SDK properly obtained consumers' informed consent to collect location data or use it for targeted advertising.
  • Retaining detailed location data for longer than necessary to accomplish InMarket's stated business purposes at collection.
Under the FTC's proposed consent order, effective for 20 years, InMarket must develop and maintain a written sensitive location data program to prevent it from using, selling, licensing, transferring, or sharing any products or services that target consumers based on identified sensitive locations, such as certain health care facilities and domestic violence shelters. InMarket must, at least every 12 months, evaluate the program and implement any modifications based on program results.
InMarket must also:
  • Refrain from selling or licensing precise location data.
  • Refrain from using, selling, licensing, transferring, or sharing any products or services that target consumers based on identified sensitive locations.
  • Obtain consumers' affirmative express consent before collecting, using, maintaining, or disclosing any precise location data, including making clear and conspicuous disclosures about its precise location data practices and use cases separate from its privacy notices and terms of service.
  • Follow strict record-keeping requirements for obtaining affirmative express consent to collect, use, maintain, or disclose a consumer's location data, and provide a simple way for consumers to withdraw their affirmative consent.
  • Provide consumers a clear and conspicuous reminder at least every six months that InMarket is collecting precise location data, along with instructions on how to turn off location data collection.
  • Provide a simple and readily accessible deletion request method for precise location data, which InMarket must fulfill within 30 days.
  • Delete or destroy all historic location data collected and any products produced from that data, unless the consumer provided affirmative express consent or the data is deidentified or non-sensitive.
  • Delete or destroy consumer audience categories created using historic location data.
  • Provide a prescribed notice about the FTC's action against InMarket to each consumer whose location data it collected through its apps without a record of the consumer's affirmative express consent and provide them a way to either opt out of location data collection or make a deletion request.
  • Implement and maintain a supplier assessment program for any third party providing location data to InMarket through its SDK that confirms consumers have provided affirmative express consent to location data collection and use.
  • Create and maintain a publicly available retention schedule for collected data, including location data.
  • Implement and maintain a comprehensive privacy and data security program similar to the FTC's other recent privacy settlements, including obligations to:
    • document the program and provide related materials, including evaluation results and updates, to the board of directors;
    • designate a qualified responsible employee;
    • perform periodic risk assessments and design, implement, and maintain safeguards to address identified risks;
    • provide employee and contractor privacy and data security training; and
    • periodically test and monitor program effectiveness.
  • Create and maintain specific records, including consumer consents, customer complaints, privacy notices and representations, accounting and personnel records, and other records documenting InMarket's compliance with the order.
The draft order is subject to public comment for 30 days after the FTC publishes the full settlement package in the Federal Register. The FTC will decide whether to finalize the proposed consent order after the public comment period closes.
This FTC case, particularly its consumer location data deletion requirement and prohibition against selling or licensing precise location data, will likely significantly impact businesses that routinely rely on location data or products or services based upon location data, such as targeted advertising audience profiles and categories. Businesses that collect, use, or share consumers' location data should carefully review the FTC's assessments of the unique harms consumers may face from location-based data uses in this and the FTC's January 9, 2024 proposed settlement with a data broker regarding sensitive location information collection and sales. For more on that case and recent FTC guidance for other sensitive data uses, see Legal Updates: