On June 22, 2016, the Federal Trade Commission announced a settlement with Singaporean-based mobile advertising network, InMobi, resolving charges that the company had deceptively tracked hundreds of millions of consumers’ locations, including children, without their knowledge or consent. Among other things, the settlement orders the company to pay $950,000 in civil penalties.
InMobi provides a platform for app developers to sell advertising space on their apps. The company offers geo-targeting products that allow advertisers to target consumers based on their physical location. According to the FTC’s complaint, InMobi represented that it tracks consumers’ locations in a manner consistent with device privacy settings, and only if the consumer provides opt-in consent. Nevertheless, the FTC alleged that the company tracked consumers locations and served geo-targeted ads, regardless of the users’ location settings. The complaint also states that even if a consumer had restricted an app’s access to location information, InMobi was able to track the consumer’s location by collecting information about the wifi networks that were connected to, or in-range of, the consumer’s device.
The FTC’s complaint includes charges that InMobi violated the Children’s Online Privacy Protection Act (“COPPA”) by knowingly collecting personal information from thousands of child-directed apps in order to track children’s locations and serve them with interest-based advertising. According to the complaint, this tracking was done despite InMobi’s promise not to do so without notifying parents or receiving their consent.
The FTC’s consent order imposes a $4 million civil penalty, to be suspended upon InMobi’s payment of $950,000 due to the company’s current financial situation. The settlement also requires InMobi to (1) comply with COPPA, (2) delete all personal information collected from children and all location information collected from other users, (3) obtain express affirmative consent prior to collecting location information that is not overridden by a consumer’s permissions or settings, and (4) implement a comprehensive privacy program and obtain independent assessments of the program biennially for the next 20 years.