PANOPTICON therecord ftc location brokers
page 2 / 3
“Surreptitious surveillance by data brokers undermines our civil liberties and puts servicemembers, union workers, religious minorities, and others at risk,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement.
Gravy allegedly also sold data products obtained through geofencing — defined as establishing a virtual geographic boundary. From there the company identified and sold lists of consumers who “attended certain events related to medical conditions and places of worship and sold additional lists that associate individual consumers to other sensitive characteristics,” the FTC said.
In addition to setting up a location data program to define and organize parameters for its data sales and no longer selling, licensing or sharing sensitive location data other than under the national security and law enforcement exceptions the order allows, Gravy and Venntel also must create a “supplier assessment program” to guarantee consumers have given consent for the collection and use of data that could show their exact location.
Finally, the companies are barred from deceiving consumers about how they review data suppliers’ compliance and consent mechanisms, disclosure language and opt-in measures as well as from misrepresenting how they gather, share or delete sensitive location data. They also will be required to be honest with consumers about whether the data they share is de-identified.
The FTC has previously taken action against three other data brokers trading in consumer location data. Those orders were meted out against Kochava for peddling data allowing people to be tracked to reproductive health clinics and other sensitive locations as well as against X-Mode, now known as Outlogic, for selling raw location data and InMarket Media for peddling precise location data.
Mobilewalla’s alleged data abuses
The proposed settlement order against Mobilewalla sets a precedent by prohibiting the company from collecting consumer data from online advertising auctions “for purposes other than participating in those auctions.”
“Mobilewalla exploited vulnerabilities in digital ad markets to harvest this data at a stunning scale,” FTC Chair Lina Khan said in a statement. “The FTC is cracking down on firms that unlawfully exploit people’s sensitive location data and ensuring that we protect Americans from unchecked surveillance.”
The FTC alleges that the company collected data from real-time bidding exchanges and third-party aggregators with consumers typically having no idea that the Georgia-based data broker had seized their data.
The complaint alleges that after Mobilewalla sought to place ads for clients on real-time advertising exchanges it stored the information gathered from the customer’s order.
As a result, from 2018 to 2020, Mobilewalla collected in excess of 500 million unique consumer advertising identifiers matched to their precise location data, the FTC alleged.
“The raw location data Mobilewalla collected was not anonymized and the company doesn’t have policies to remove sensitive locations from the data set, meaning that such data could be used to identify individual consumers’ mobile devices and the sensitive locations they visited,” the FTC said in a press release.
The agency noted that Mobilewalla sold the raw data to a variety of third parties.
The company also allegedly used sensitive location data to build audience segments its customers used for targeted advertising.
One of those audience segments allegedly analyzed protestors reacting to the death of George Floyd, a Black man killed by police, so that clients could track the protesters’ racial backgrounds and where they lived. Mobilewalla also allegedly tracked women to health clinics to sell audience segments of pregnant women.
A spokesperson for Mobilewalla said in a statement that the company “respects consumer privacy and has been evolving our privacy protections throughout our history as a company.”
“While we disagree with many of the FTC’s allegations and implications that Mobilewalla tracks and targets individuals based on sensitive categories, we are satisfied that the resolution will allow us to continue providing valuable insights to businesses in a manner that respects and protects consumer privacy.”
Under the proposed order, Mobilewalla will be barred from misrepresenting how it collects and handles consumer data and how much it does to deidentify the data. The company also can no longer use or sell sensitive location data obtained from health clinics, religious organizations and other sensitive locations.
The company also is barred from keeping consumer data it captures from online advertising auctions. It must build a program listing sensitive locations in order to prevent future abuses and separately set up a privacy program subject to annual audits and to train employees.
Finally, the company is required to develop an easy way for consumers to request that their location data be deleted and to erase historic location data.