FTC Challenges InMarket’s Unlawful Use and Sale of Precise Location Data
In a landmark settlement announced in January 2024, the Federal Trade Commission (“FTC”) has prohibited InMarket Media, a Texas-based digital marketing company, from selling or licensing precise consumer location data. This case highlights the growing concern over the misuse of location data, an issue that has drawn significant regulatory attention in recent months. The charges brought against InMarket underscore the risks businesses face when they fail to fully inform consumers about how their personal data is collected, used, and shared.
The FTC’s investigation into InMarket focused on its practice of collecting consumers’ location information from both its own apps and from third-party apps that incorporated InMarket’s software development kit (“SDK”). This SDK, used in over 300 apps downloaded by millions of consumers, enabled InMarket to track users’ movements and compile detailed profiles based on the places they visited. InMarket would then categorize these consumers into audience segments, such as “parents of preschoolers” or “Christian church goers,” which were subsequently used to target advertising.
The core of the FTC’s complaint was that InMarket did not properly inform consumers or obtain their consent to use their location data for advertising purposes. The company allegedly misled users of its shopping rewards app, CheckPoints, and shopping list app, ListEase, by stating that location data would be used only for basic app functions, like awarding points or providing reminders. In reality, the data was also being used to create detailed consumer profiles and target ads.
Moreover, the FTC found that InMarket failed to ensure third-party app developers using its SDK obtained informed consent from their users. This lack of transparency compounded the violations, as the users of these third-party apps were unaware that their location data was being aggregated and used for advertising without their explicit consent.
The timeline of events began with the FTC’s complaint in January 2024, followed by a proposed settlement that would impose significant restrictions on InMarket. The proposed settlement includes a ban on selling or licensing precise location data and mandates that InMarket delete all location data it previously collected unless it can obtain explicit consent from users or ensure that the data is anonymized. Additionally, the company must provide consumers with a clear and easy way to withdraw consent for the collection and use of their location data and must notify affected users of the FTC’s action, offering them the option to request data deletion.
InMarket will also be required to implement a sensitive location data program to prevent the future use or sharing of products that target consumers based on sensitive location information. The company must also develop a comprehensive privacy program to ensure compliance with these requirements and establish a data retention schedule to prevent the unnecessary storage of location data.
InMarket’s settlement also underscores the importance of accountability when working with third-party app developers. As seen in this case, businesses must verify that their partners are obtaining informed consent before sharing or using consumer data. Without proper safeguards, companies risk facing legal and reputational consequences.
The final settlement order, which will be published in May 2024, is expected to send a strong message to the industry about the importance of data privacy and compliance. Companies dealing with location data should take this opportunity to reassess their practices and ensure they are fully transparent with consumers, obtaining the necessary consent and protecting sensitive information.
The FTC said this settlement is part of a broader crackdown by the FTC on the unlawful collection and sale of location data. The FTC’s action against InMarket serves as a reminder to businesses that collecting and using consumer data, especially location data, requires transparency and explicit consent. Companies must ensure that consumers fully understand how their data will be used and have a clear option to withdraw consent at any time. Additionally, the use of sensitive data, such as geolocation information, must be handled with the utmost care to prevent misuse and potential harm to consumers.
If you would like to read more about this case and others, visit our Case Studies Library.
(Image Credit: iStock Photo)
This article is for information purposes only. It is not intended to be and should not be relied on as legal advice for any particular matter.