The Federal Trade
Commission" (FTC) recently entered into
a settlement (subject to final
approval) that will have a significant impact on the entire geospatial
community. The settlement, in connection with
In re Goldenshores Technologies, LLC , involved the collection of
"geolocation information" from a mobile device app. Geolocation
information is defined in the settlement documents as "precise geolocation data of an individual or mobile
device, including but not limited to GPS-based, WiFi-based, or
cell-based location information."
[emphasis added]
Goldenshores
Technologies, LLC ("Goldenshores") developed “Brightest Flashlight Free, a free, ad-supported
app that enables the device to act as a flashlight. According to the FTC, the
app transmits when running, or could transmit, the device’s “precise
geolocation along with persistent device identifiers that can be used to track
a user’s location over time” to third parties, including advertisers. The FTC
alleged that the app collected (and shared) the device's location prior to
obtaining the individual's permission and did not adequately disclose with whom
the information was shared. According to the FTC, such practices are prohibited under Section 5(a) of the FTC Act as "deceptive and
unfair acts or practices in or affecting commerce".
The
settlement states that Goldenshores' apps must . . . " not
collect, transmit, or allow the transmission of such
[geolocation] information unless such application:
A. Clearly and prominently, immediately prior to the initial collection of
or
transmission of such information, and on a separate screen . . . " states
1. That such application collects, transmits, or allows the transmission
of,
geolocation information;
2. How geolocation information may be used;
3. Why such application is accessing geolocation information; and
4. The identity or specific
categories of third parties that receive geolocation
information directly or indirectly from such application; and
B. Obtains affirmative express
consent from the consumer to
the transmission of
such information". [emphasis added]
The settlement only applies to mobile apps, however its impact will be felt throughout the geopatial community.
First, the FTC's definition of geolocation information to be protected is broad and imprecise. For example, it includes location information collected from GPS, WiFi or cell towers. Those familiar
with geospatial technology will recognize that these technologies collect
location in a number of applications and with varying degrees of precision. Also, it applies to location
information collected on an individual or a mobile device. Moreover, the
definition states that it includes, but
is not limited to location information collected from those technologies. This
suggests that other location-enabling technologies may also be subject to
privacy scrutiny, which is important because the FTC has very broad enforcement powers. As a result of this broad definition, it will become increasingly
difficult for a broad range of geospatial technology companies to determine if they need to include a
privacy statement when collecting location information.
Second,
the settlement states that before an app can transfer geolocation information collected from a mobile device to a third party, it must obtain "affirmative express consent" from an individual after providing proper notice. Such notice must include "[t]he identity or specific
categories of third parties that receive geolocation information directly
or indirectly from such application."
Anyone following the geospatial community over the past few years knows that new
markets and opportunities for location data are continuously developing. Many of these new opportunities rely on location data from mobile devices. In this environment, it will be very challenging to provide consumers proper notice as which third parties will receive the location
data or how it will be used. As a result of the In re
Goldenshores Technologies, LLC settlement, companies will need
to go back and get consumer authorization each time they wish to change with whom they will share location information. Alternatively, they may decide that this is cost prohibitive and decide not to enter into that market.
The settlement should also result in both
geospatial data providers and data users updating their terms of use and/or
license agreements. In light of the settlement, users of geospatial data may consider obtaining
a representation from a data provider that the data has been collected in a
manner that adequately protects a consumer’ privacy and that the consumer has
agreed to have it distributed for this particular purpose. Data providers may seek a
covenant from customers that their geospatial data will not be aggregated with
third party data in ways that will infringe upon consumer privacy.
