FTC Issues First-Ever Ban on Selling Sensitive Location Data, Targeting Major Data Brokers
In a landmark decision, the Federal Trade Commission (“FTC”) has taken action against data brokers X-Mode Social and its successor company, Outlogic, by imposing a prohibition on their ability to share or sell sensitive location data. This settlement marks the first time the FTC has intervened in the collection and sale of sensitive geolocation data, setting a new precedent for data privacy protections.
The case centers around X-Mode and Outlogic’s practice of collecting and selling precise location data linked to mobile advertising identifiers. This data, which is tied to specific devices, was being sold without sufficient safeguards or consumer consent. The precise geolocation data was particularly troubling because it included visits to sensitive locations such as medical and reproductive health clinics, religious institutions, and domestic violence shelters. This type of information, if misused, can have dire consequences for individuals, including discrimination, harassment, or emotional distress.
The FTC’s complaint emphasized that X-Mode and Outlogic were negligent in ensuring that their data collection practices did not harm consumers’ privacy. By selling raw, identifiable location data to hundreds of clients, from financial institutions to government contractors, the companies exposed individuals’ personal movements without adequate protection. The lack of clear privacy policies and consent mechanisms compounded the issue, as users of the company’s apps, as well as third-party apps using X-Mode’s SDK, were not fully informed about how their data would be used.
The FTC emphasized that this case underscores the growing concerns surrounding the practices of data brokers and their impact on consumer privacy. Geolocation data is particularly sensitive because it reveals more than just where someone is, it can show where they live, who they interact with, and even their medical and personal habits. The FTC has been vocal about the need for businesses to respect privacy and be transparent about data use. FTC Chair Lina M. Khan stated, “By securing a first-ever ban on the use and sale of sensitive location data, the FTC is continuing its critical work to protect Americans from intrusive data brokers and unchecked corporate surveillance.”
The FTC’s settlement also includes a series of strict actions designed to prevent future misuse of sensitive location data. X-Mode and Outlogic are now required to delete any location data previously collected unless they obtain consumer consent or ensure the data is anonymized. They must also establish comprehensive procedures for working with third-party data suppliers to ensure that consumer consent is obtained at every stage.
Additionally, the companies are required to set up a system for users to easily opt-out of data collection and ensure that no sensitive location data is sold or transferred without consumer permission. The settlement also mandates the creation of a data retention schedule to prevent unnecessary storage of sensitive personal information.
The settlement represents a significant step forward in regulating the use of location data. For businesses, particularly those in advertising, analytics, or any industry that relies on location-based data, this case serves as a warning: clear consent and strong privacy safeguards are not just best practices, they are a legal requirement. The FTC’s action is a clear indication that companies can no longer operate in the shadows when it comes to consumer privacy, especially regarding sensitive data.
For businesses that deal with location data, this case highlights the importance of transparency and consumer consent in the data collection process. Companies must ensure that they are fully compliant with privacy regulations and are actively safeguarding consumers’ rights to privacy. The growing concern over data brokers and the way they collect and use information is likely to drive further regulatory scrutiny, making it critical for businesses to adopt more rigorous privacy policies to avoid future legal challenges.
As the digital landscape continues to evolve, staying ahead of regulatory changes and consumer expectations will be key to maintaining trust and ensuring long-term business success.
(Image Credit: iStock Photo)
This article is for information purposes only. It is not intended to be and should not be relied on as legal advice for any particular matter.