Breaking down the FTC’s latest actions against companies that sell location data

In 2022, the Federal Trade Commission (FTC) sued the data broker Kochava, alleging the company sold data that could tie an individual to sensitive locations and potentially cause them harm.

It was a warning shot to the advertising industry. And in 2024, the commission is continuing to focus on data brokers and the sale of location data. Already this year, the FTC has announced settlements with two data brokers that will prohibit them from selling sensitive location data: Outlogic, formerly known as X-Mode, and InMarket, both of which the commission found to have violated the FTC Act, the agency recently alleged in separate complaints against the companies.

“All too often, Americans are tracked by serial data hoarders that endlessly vacuum up and use personal information,” FTC Chair Lina Khan said in a press release announcing a settlement with InMarket last week. “Today’s FTC action makes clear that firms do not have free license to monetize data tracking people’s precise location.”

The FTC’s interest in the data broker industry follows a 2022 executive order that President Joe Biden signed shortly after the Supreme Court overturned Roe v. Wade; the order was designed to protect the privacy of those seeking reproductive healthcare.

“We share the FTC’s commitment to advancing consumer privacy, and while we fundamentally disagree with the FTC’s allegations, we are happy to reaffirm the steps InMarket is taking to further our policies around data disclosure and use,” InMarket spokesperson Nicole Lorusso wrote in a statement to Marketing Brew.

X-Mode/Outlogic didn’t respond to Marketing Brew’s request for comment by publication time.

Consent = details, details, details

Both InMarket and X-Mode/Outlogic asked consumers for consent to collect their data. According to the FTC complaint against InMarket:

• CheckPoints, an app owned by InMarket that rewards consumers for sharing shopping information like receipts, asked Android and iOS users to share location data in exchange for “extra points” or “nearby earning opportunities,” the FTC said.
• In another InMarket shopping app called ListEase, consumers were asked to share their location to “unlock reminders” when shopping.

The FTC alleges that “the consent screens used…tell consumers that their location will be used for the app’s functionality…which are misleading half-truths,” adding that “at no point during the consent process for either the CheckPoints or ListEase Apps did InMarket also disclose that it was collecting users’ precise location, often multiple times per hour…to be used to precisely target them with advertising.”

Meanwhile, X-Mode/Outlogic allegedly failed to “fully inform consumers how their data would be used and that their data would be provided to government contractors for national security purposes,” according to the FTC complaint.

• In some cases, X-Mode/Outlogic “used language suggesting that consumers’ location data would be used solely for ‘ad personalization and location-based analytics,’” the FTC said.

Perhaps most relevant to anyone who isn’t a data broker is that the FTC is alleging that both X-Mode/Outlogic and InMarket failed to verify whether the third parties they work with—in this case, other apps—notified consumers about how their location data might be used.

While these settlements are with data brokers, the rest of the industry should be paying attention, Odia Kagan, a privacy lawyer and partner at Fox Rothschild, explained.

“I don’t think we should assume that this is strictly associated to data brokers,” she said. “The focus is on the sensitivity of the data, mass surveillance, and monetization.”

Sensitive times

The commission recently clarified what exactly it considers to be a sensitive location.

When the FTC sued Kochava, the commission alleged that the company had sold data that could tie consumers to sensitive locations, including, “among others, locations associated with medical care, reproductive health, religious worship, mental health, temporary shelters, such as shelters for the homeless, domestic violence survivors, or other at-risk populations, and addiction recovery.”

At the time, Kochava CEO Charles Manning told Marketing Brew that the company had asked the FTC to clarify that definition. It didn’t, he said, and Kochava countersued.

A judge dismissed the FTC’s suit, but the commission filed an amended complaint, which was unsealed in November; litigation is still pending.

In the commission’s proposed order with InMarket, it included a much more detailed definition of what it considers a sensitive location to be. That definition includes, among other things, sexual and reproductive healthcare providers, labor union offices, and locations associated with “public gatherings of individuals during political or social demonstrations, marches, and protests.”

The FTC’s definition is strikingly similar to a list of sensitive locations included in guidelines created by industry trade group the Network Advertising Initiative (NAI) that were published in June 2022 and aim to “create restrictions on the use, sale, or transfer of location data correlated to sensitive points of interest.” In an email, David LeDuc, VP of public policy at the NAI, said the definition “is consistent with the NAI’s voluntary standards and our priorities for promoting necessary protections for sensitive location data going forward.”

In 2022, NAI member companies, including FourSquare, Precisely, and Cuebiq, announced that they had voluntarily adopted the NAI guidelines.

None of the NAI’s other members, which includes Google, location data company Gravy Analytics, and Oracle Advertising, have publicly endorsed the guidelines.