FTC Order Will Ban InMarket from Selling Precise Consumer Location Data

Data aggregator InMarket Media will be prohibited from selling or licensing any precise location data to settle Federal Trade Commission charges that the company did not fully inform consumers and obtain their consent before collecting and using their location data for advertising and marketing.

Under the proposed order, InMarket will also be prohibited from selling, licensing, transferring, or sharing any product or service that categorizes or targets consumers based on sensitive location data.

“All too often, Americans are tracked by serial data hoarders that endlessly vacuum up and use personal information. Today’s FTC action makes clear that firms do not have free license to monetize data tracking people’s precise location,” said FTC Chair Lina M. Khan. “We’ll continue to use all our tools to protect Americans from unchecked corporate surveillance.”

Texas-based InMarket collects location information from a variety of sources, including its own apps and from third-party apps that incorporate its software development kit (SDK). InMarket cross-references consumers’ location histories with advertising-related points of interest to identify consumers who have visited those locations and then sorts consumers, based on their visits to these points of interest, into audience segments to which it can target advertising based on their past behavior.

InMarket has maintained nearly 2,000 such audience segment lists that have included such categories as “parents of preschoolers,” “Christian church goers,” and “wealthy and not healthy.” InMarket can display ads based on this information to users of apps that incorporate its SDK and also offers a product that sends ads to consumers based on their location.

In its complaint, the FTC says InMarket failed to obtain informed consent from users of its own apps, shopping rewards app CheckPoints and shopping list app ListEase. For example, when the company requests to use a consumer’s location data, it states that the data will be used for the app’s function, such as to provide shopping reward points or to remind consumers about items on their shopping list, and fails to inform users that the location data will also be combined with other data obtained about those users and used for targeted advertising.

The FTC says that InMarket also failed to ensure that third-party apps that incorporate the company’s SDK have obtained informed consent. In fact, the company failed to tell third party apps that the location data provided through InMarket’s SDK will be combined with other data to create profiles of consumers, according to the complaint.

The FTC also says that the company’s policy of retaining geolocation data for five years was unnecessary to carry out the purposes for which it was collected and increased the risk that this sensitive data could be disclosed, misused, and linked back to the consumer, thereby exposing sensitive information about the consumer.

This is the second case the FTC has brought in recent weeks involving the unfair collection of location data, which can reveal sensitive information about a person’s life. Earlier this month, the FTC announced a settlement with X-Mode Social and its successor Outlogic over allegations the company sold precise location data that could be used to track people’s visits to sensitive locations such as medical and reproductive health clinics, places of religious worship and domestic abuse shelters.

In addition to the ban on selling or licensing precise location data—a first for the FTC—the proposed order also requires InMarket to take several steps to strengthen protections for consumers. Under the proposed order, the company:

• Must delete or destroy all the location data it previously collected and any products produced from this data unless it obtains consumer consent or ensures the data has been deidentified or rendered non-sensitive;
• Must provide a simple and easy-to-find way for consumers to withdraw their consent for the collection and use of their location data for InMarket apps and a mechanism to request deletion of any location data that InMarket previously collected;
• Must notify consumers whose location data was collected through InMarket’s apps about the FTC’s action against the company and provide them with a way to opt out of data collection or request to delete their data;
• Will be limited from collecting or using location data from InMarket apps unless it obtains consumers’ informed consent to the collection of their location data;
• Will be required to create a sensitive location data program to prevent the company from using, selling, licensing, transferring, or otherwise sharing any products or services that categorize or target consumers based on sensitive location data;
• Must develop an SDK supplier assessment program to ensure that companies that provide location data to InMarket via its SDK are obtaining informed consent from consumers for the collection, use and sale of the data or must stop using such information; and
• Establish and implement a comprehensive privacy program that protects the privacy of consumers’ personal information and also create a data retention schedule.

The Commission voted 3-0 to issue the administrative complaint and to accept the proposed consent agreement with InMarket.

The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. 

The lead staff attorneys on this matter are Gorana Neskovic, David Walko and Elizabeth Averill from the FTC’s Bureau of Consumer Protection.