Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC reaches proposed settlement with InMarket to prevent selling precise location data, (Jan 19, 2024)

By Seth Abrams, J.D., M.A.

Agreement covers consumer segments developed from consumer location data.

The FTC announced that it has reached a proposed settlement with InMarket Media, LLC (“InMarket”) prohibiting InMarket from selling precise consumer location data. This is the first time that the FTC has banned selling and licensing precise location data. InMarket will also be banned from engaging in transactions for any product or service that either categorizes or targets consumers based on sensitive location data (In the Matter of InMarket Media, LLC, FTC File No. 2023088).

InMarket is located in Austin, Texas, and is a data aggregator and digital marketing platform. It collects data from many different sources, including its own apps. These include its shopping rewards app CheckPoints, which offers rewards for completing tasks, and shopping list app ListEase, which aids in the creation of shopping lists. Since 2017, these apps have been downloaded to over 30 million devices. InMarket also collects information from its software development kit (SDK), which had been made part of more than 300 apps and downloaded to 390 million devices during the same period. InMarket uses consumer’s location histories gained from these sources to sort consumers into audience segments to display and sell targeted advertisements.

The FTC alleged that InMarket did not obtain informed consent for CheckPoints and ListEase, stating in its consent that the location data would only be used within the functionality of the app. Users were not informed that the location data would be combined with other information about the user and ultimately used for targeted advertising. In addition, the SDK transmitted precise consumer location back to InMarket, in which informed consent was not verified. InMarket did not inform third party apps that the location data gathered through the SDK would be combined to create consumer profiles. In all, InMarket had nearly 2,000 audience segment lists, which are based on the location data combined with other information. These included categories such as “parents of preschoolers,” “Christian church goers,” and “wealthy and not healthy.” Other segments included “low-income millennials,” “well-off suburban moms” and “high school students.” Location data was also retained for five years, which the FTC alleged was longer than necessary to accomplish its purpose.

FTC charges. The FTC brought four counts in its complaint for violation of Section 5(a) of the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.” These included (1) “Unfair Collection and Use of Consumer Location Data”; (2) “Unfair Collection and Use of Consumer Location Data from Third Party Apps”; (3) “Unfair Retention of Consumer Location Data”; and (4) “Deceptive Failure to Disclose InMarket’s Use of Consumer Location Data.”

Proposed order. As detailed in the FTC decision, the proposed agreement and consent order contains a ban on selling or licensing precise location data. This ban is limited to location data that identifies a consumer’s location in a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. The order also contains provisions for the establishment of a sensitive location data program within 90 days, which is designed to prevent InMarket from using or selling location data based on a consumer’s location in a sensitive area, such as a mental health provider, political rally, religious organization, or several other sensitive locations.

In addition, the order contains several other conditions that InMarket must meet to strengthen consumer protections. This includes deleting and destroying all data previously collected as well as products produced from the data unless it either (1) obtains consumer consent or (2) deidentifies or renders the data non-sensitive. InMarket must also provide a means for consumers to withdraw consent and request deletion of location data. It also must notify consumers of the FTC action. It must also ensure that companies that provide location data to InMarket through the SDK are obtaining informed consent for the collection of the location data. The proposed order will remain in effect for 20 years, with some exceptions.

FTC comments. FTC Chair Lina M. Khan commented that, “All too often, Americans are tracked by serial data hoarders that endlessly vacuum up and use personal information. Today’s FTC action makes clear that firms do not have free license to monetize data tracking people’s precise location.” She continued, “We’ll continue to use all our tools to protect Americans from unchecked corporate surveillance.”

FTC vote. The FTC voted 3-0 to issue the administrative complaint and to accept the consent agreement with InMarket. An analysis of the consent order to aid public comment was also issued by the FTC.

Companies: InMarket Media, LLC

News: ConsumerProtection Privacy CyberPrivacyFeed DataPrivacy FederalTradeCommissionNews