CSG Law Alert: The Federal Trade Commission Cracks Down on Digital Marketing Platform for the Collection and Sale of Location Data

A digital marketing platform and the Federal Trade Commission (the “FTC”) have reached a tentative settlement agreement to resolve allegations of purportedly unfair and deceptive acts and practices in connection with consumer location data collected and retained for what the FTC consider an excessive period of time.

The digital marketing platform collected location data through its own proprietary applications and its software development kit, which had been made available to third party application developers and incorporated into more than 300 third-party applications.

The FTC has alleged that one of main functions of the software development kit was to transmit the precise time and location (i.e., latitude and longitude) of a consumer via their device, thereby revealing sensitive information about a consumer (e.g., where they live, shop, commute, work, worship, obtain childcare, receive medical treatment, etc.).

According to the FTC, such data was used to provide targeted advertising to individual consumers. The digital marketing platform would not only display advertising itself on a consumer’s mobile device, but also categorize consumers in manner that would allow the digital marketing platform’s clients to target consumers more precisely on third-party advertising platforms. The digital marketing platform did not (i) fully disclose such collection practices to consumers; (ii) obtain informed consent from consumers; or (iii) verify that third-party applications that incorporated the software development kit obtained informed consent from consumers.

The FTC highlighted that the digital marketing platform retained such information for a period of five years following collection, which the FTC deemed as unreasonable and excessive.

To resolve these allegations, the digital marketing platform has agreed to (i) not misrepresent the extent to which it collects, uses, maintains and discloses any location data; (ii) not collect consumer data without the express consent of the applicable consumers; and (iii) not to use, sell, license, transfer, or otherwise share any products or services that categorize, or target consumers based on sensitive location data.