FTC Issues First Order Prohibiting Sale of Sensitive Location Data

By Eric F. Vicente Flores and Whitney E. McCollum

On 9 January, 2024, the Federal Trade Commission (FTC) issued its first settlement prohibiting a data broker from sharing or selling sensitive location data, and required deletion of all location data collected deceptively. The FTC alleged that X-Mode Social (“X-Mode”), and Outlogic, LLC (“Outlogic”), X-Mode’s successor firm, failed to implement reasonable and appropriate safeguards on the use of such information by third parties. X-Mode/Outlogic collected personal information, including location data via its mobile applications, which it would then sell to third parties. 

X-Mode and Outlogic sold non-anonymized raw location data, which the FTC notes can be associated with mobile advertising IDs and allows businesses to match an individual consumer’s mobile device with the locations they visited. The information shared with third parties included “sensitive data location,” which is characterized as information that reveals visits to houses of worship or doctors’ offices. The FTC alleged that the sale of such data poses an unwarranted intrusion into the most provide areas of a consumers’ lives.

The FTC alleged that X-Mode/Outlogic violated the FTC Act by engaging in unfair and deceptive practices when it: (1) failed to inform consumers which third parties would receive their location data; (2) failed to receive informed consent prior to sharing the information; (3) created custom audience segments based on which medical facilities consumers had visited; and (4) failed to employ the necessary technical safeguards to ensure opt-out requests from Android users were honored.

The FTC ordered the X-Mode/Outlogic to destroy all location data previously collected, to limit its sharing of sensitive location data, to develop a program to ensure informed consent is collected from consumers, and to provide a simple way for consumers to withdraw their consent, among other requirements. The full consent agreement package will be published in the Federal Register. 

In the meantime, the FTC noted in a press release that businesses do not have “free license to market and sell Americans’ sensitive location data” and that the FTC will continue to protect intrusive data brokers and unchecked corporate surveillance.