Antitrust Law Daily Wrap Up, PRIVACY NEWS: Mobile App Developers, Platform Providers Advised to Make Disclosures, Obtain Consumer Consent Before Collecting Data, (Feb 1, 2013)

By Jeffrey May, J.D.

The FTC released a staff report today recommending ways that mobile device operating system providers—such as Amazon, Apple, BlackBerry, Google, and Microsoft—as well as mobile application (app) developers, can better inform consumers about their data practices. The report, entitled “Mobile Privacy Disclosures: Building Trust Through Transparency,” recommends best practices on mobile privacy disclosures.

The report follows a May 2012 FTC workshop, which brought together representatives from industry, trade associations, academia, and consumer privacy groups to explore privacy disclosures on mobile devices. The recommendations are based on more than a decade of work by the agency on mobile privacy issues and recent data obtained through panel discussions and comments.

The report details the benefits and privacy risks of mobile technologies. In addition, it discusses the FTC’s efforts to address mobile privacy, as well as its research on disclosure issues generally, and sets forth recommendations for best practices to key commercial players involved in the mobile arena.

Also discussed are three core principles for protecting consumers' privacy as set forth in the Commission's March 2012 privacy report: (1) building privacy into every stage of product development; (2) simplifying consumer choice; and (3) providing greater transparency.

Mobile Platform, Operating System Recommendations

The report makes the following recommendations for mobile platforms or operating system providers:

(1) Provide just-in-time disclosures to consumers and obtain their affirmative express consent before allowing apps to access sensitive content like geolocation;

(2) Consider providing just-in-time disclosures and obtaining affirmative express consent for other content that consumers would find sensitive in many contexts, such as contacts, photos, calendar entries, or the recording of audio or video content;

(3) Consider developing a one-stop “dashboard” approach to allow consumers to review the types of content accessed by the apps they have downloaded;

(4) Consider developing icons to depict the transmission of user data;

(5) Promote app developer best practices, such as requiring developers to make privacy disclosures;

(6) Consider providing consumers with clear disclosures about the extent to which platforms review apps prior to making them available for download in the app stores and conduct compliance checks after the apps have been placed in the app stores; and

(7) Consider offering a Do Not Track (DNT) mechanism for smartphone users to prevent tracking by ad networks or other third parties as users navigate among apps on their phones.

App Developer Recommendations

The report makes the following recommendations for app developers:

(1) Have a privacy policy and make sure it is easily accessible through the app stores;

(2) Provide just-in-time disclosures and obtain affirmative express consent before collecting and sharing sensitive information (to the extent the platforms have not already provided such disclosures and obtained such consent);

(3) Improve coordination and communication with ad networks and other third parties that provide services for apps, so the app developers can better understand the software they are using and provide accurate disclosures to consumers; and

(4) Consider participating in self-regulatory programs, trade associations, and industry organizations, which can provide guidance on how to make uniform, short-form privacy disclosures.

The report also suggests that advertising networks and other third parties communicate with app developers so that the developers can provide truthful disclosures to consumers and work with platforms to ensure effective implementation of DNT for mobile.

App developer trade associations, along with academics, usability experts and privacy researchers were encouraged to: develop short form disclosures for app developers; promote standardized app developer privacy policies that will enable consumers to compare data practices across apps; and educate app developers on privacy issues.

The FTC also announced Mobile App Developers: Start with Security, a new business guide on the FTC website that encourages developers to aim for reasonable data security, evaluate the app ecosystem before development, and includes tips such as making someone responsible for data security and taking stock of the data collected and maintained.

“The mobile world is expanding and innovating at breathtaking speed, allowing consumers to do things that would have been hard to imagine only a few years ago,” said FTC Chairman Jon Leibowitz. “These best practices will help to safeguard consumer privacy and build trust in the mobile marketplace, ensuring that the market can continue to thrive.”

News: Privacy ConsumerProtection FederalTradeCommissionNews