On January 18, 2024, the Federal Trade Commission announced a proposed order against geolocation data broker InMarket Media (“InMarket”), barring the company from selling or licensing precise location data. According to the FTC’s charges, InMarket failed to obtain informed consent from users of applications developed by the company and its third-party partners.
InMarket is a data aggregator company that developed a software tool for use in mobile applications developed by InMarket or third-party developers. The software tool allowed the company to track users’ geolocation and analyze points of interest visited by such users. InMarket then used data from this analysis to sort consumers into audience segments for targeted advertising.
In its complaint, the FTC alleged that InMarket engaged in unfair or deceptive acts or practices in violation of Section 5 of the FTC Act by failing to obtain informed consent from the users of applications developed by the company. Although InMarket’s applications asked users for consent to geolocation tracking, the FTC alleges that the applications failed to disclose that location history would be combined with other data collected about the user and used for targeted advertising purposes. In addition, the complaint asserted that InMarket failed to ensure that the third-party applications using the company’s geolocation tracking tool obtained informed user consent, and failed to inform third-party developers that InMarket’s software would combine location data with other data to create profiles of consumers. Finally, the FTC alleged that the company’s policy of retaining geolocation data for five years was unnecessarily long to carry out the purposes for which the data was collected.
The proposed order will prohibit InMarket media from selling or licensing precise geolocation data, and from sharing, licensing, transferring, or sharing any product or service that categorizes or targets consumers based on sensitive location data.
Update: On May 1, 2024, the FTC finalized the proposed order in a 3-0-2 Commission vote. Pursuant to the order, InMarket is prohibited from selling, sharing or licensing any precise location data and any product or service that categorizes or targets consumers based on sensitive location data. In addition, InMarket must delete or destroy all location data it previously collected and any products produced from this data unless it obtains specific consent from consumers within 30 days or deidentifies the data; implement location data consent withdrawal and deletion mechanisms; publish a detailed retention schedule; and develop a sensitive location data program and privacy program.