Recent Federal Trade Commission (FTC) Settlement Will Make It Harder to Collect and Share Geoinformation In US.

The Federal Trade Commission" (FTC) recently entered into a settlement (subject to final approval) that will have a significant impact on the entire geospatial community. The settlement, in connection with In re Goldenshores Technologies, LLC , involved the collection of "geolocation information" from a mobile device app.  Geolocation information is defined in the settlement documents as "precise geolocation data of an individual or mobile device, including but not limited to GPS-based, WiFi-based, or cell-based location information." [emphasis added]

Goldenshores Technologies, LLC  ("Goldenshores") developed “Brightest Flashlight Free,  a free, ad-supported app that enables the device to act as a flashlight. According to the FTC, the app transmits when running, or could transmit, the device’s “precise geolocation along with persistent device identifiers that can be used to track a user’s location over time” to third parties, including advertisers. The FTC alleged that the app collected (and shared) the device's location prior to obtaining the individual's permission and did not adequately disclose with whom the information was shared.  According to the FTC, such practices are prohibited under Section 5(a) of the FTC Act as "deceptive and unfair acts or practices in or affecting commerce".

The settlement states that  Goldenshores' apps must . . . " not collect, transmit, or allow the transmission of such [geolocation] information unless such application: 

A. Clearly and prominently, immediately prior to the initial collection of or
transmission of such information, and on a separate screen . . .  " states

1. That such application collects, transmits, or allows the transmission of,
geolocation information;

2. How geolocation information may be used;

3. Why such application is accessing geolocation information; and

4. The identity or specific categories of third parties that receive geolocation
information directly or indirectly from such application; and

B. Obtains affirmative express consent from the consumer to the transmission of
such information". [emphasis added]

The settlement only applies to mobile apps, however  its impact will be felt throughout the geopatial community. 

First, the FTC's definition of geolocation information to be protected is broad and imprecise.  For example, it includes location information collected from GPS, WiFi or cell towers.  Those familiar with geospatial technology will recognize that these technologies collect location in a number of applications and with varying degrees of precision. Also, it applies to location information collected on an individual or a mobile device. Moreover, the definition states that it includes, but is not limited to location information collected from those technologies. This suggests that other location-enabling technologies may also be subject to privacy scrutiny, which is important because the FTC has very broad enforcement powers. As a result of this broad definition, it will become increasingly difficult for a broad range of geospatial technology companies to determine if they need to include a privacy statement when collecting location information.

Second, the settlement states that before an app can transfer geolocation information collected from a mobile device to a third party, it must obtain "affirmative express consent" from an individual after providing proper notice. Such notice must include "[t]he identity or specific categories of third parties that receive geolocation information directly or indirectly from such application." 

Anyone following the geospatial community over the past few years knows that new markets and opportunities for location data are continuously developing. Many of these new opportunities rely on location data from mobile devices. In this environment, it will be very challenging to provide consumers proper notice as which third parties will receive the location data or how it will be used. As a result of the In re Goldenshores Technologies, LLC settlement, companies will need to go back and get consumer authorization each time they wish to change with whom they will share location information.  Alternatively, they may decide that this is cost prohibitive and decide not to enter into that market. 

The settlement should also result in both geospatial data providers and data users updating their terms of use and/or license agreements. In light of the settlement, users of geospatial data may consider obtaining a representation from a data provider that the data has been collected in a manner that adequately protects a consumer’ privacy and that the consumer has agreed to have it distributed for this particular purpose. Data providers may seek a covenant from customers that their geospatial data will not be aggregated with third party data in ways that will infringe upon consumer privacy.