In its May 2023 complaint, the FTC alleged that data broker Outlogic (formerly known as X-Mode Social) (hereafter Outlogic) had engaged in activities that violated Section 5(a) of the FTC Act (15 U.S.C. § 45(a)), which prohibits “unfair or deceptive acts or practices in or affecting commerce.” On January 9, 2023 the FTC issued a proposed order that would prohibit Outlogic from sharing or selling “sensitive location data,” which includes, but is not limited to, data associated with medical facilities, religious organizations, correctional facilities, and temporary shelter locations. In the press release issued alongside the proposed order, FTC Chair Lina M. Khan is quoted as saying, “[t]he FTC’s action […] makes clear that businesses do not have free license to market and sell Americans’ sensitive location data.’” The proposed order represents the first time the FTC has reached a settlement with a data broker in connection with the collection and sale of sensitive information and comes on the heels of the CFPB’s recent publication of proposals to address data brokers under the Fair Credit Reporting Act. Taken in this context, it is clear there is a growing trend of regulatory scrutiny towards data brokers, with the FTC focusing in on issues related to the utilization of consumer data.
FTC complaint
In the complaint, the FTC alleged that location data collected by Outlogic, in connection with personal identifiers, could be used to track consumers to sensitive locations such as medical facilities, places of worship, places used to infer an LGBTQ+ identification, domestic abuse shelters, and homeless shelters. Additionally, the FTC alleged that Outlogic failed to honor consumers’ privacy choices, did not notify consumers of the purposes for which location data would be used, provided application publishers with deceptive consumer disclosures, did not verify that third parties properly notified and obtained consent from consumers, and targeted consumers based on characteristics related to sensitive medical information. The complaint determined that the sale of sensitive location data along with these other activities would violate the FTC Act’s prohibition against unfair and deceptive acts or practices.
FTC proposed order
In addition to the prohibition on the use or sale of sensitive location data, the proposed order requires Outlogic to create and maintain a “Sensitive Location Data Program” and develop a comprehensive list of “Sensitive Locations.” Moreover, the proposed order outlines a number of additional requirements to which Outlogic must adhere, including:
- Delete or destroy previously collected location data and derivative products, unless Outlogic obtains consumer consent or makes certain the data has been deidentified or rendered non-sensitive;
- Create a supplier assessment program to certify that vendors supplying location data have consumers’ informed consent for their data’s collection, use, and sale (in instances where suppliers cannot verify such consent, Outlogic is required to discontinue the use of any data from these suppliers immediately);
- Implement procedures to ensure that users of Outlogic’s location data do not connect it to venues serving LGBTQ+ communities or to locations of public protests, and prevent the use of location data to identify specific individuals;
- Offer an easy method for consumers to retract consent and request deletion of their collected location data;
- Provide a transparent option for consumers to find out which third parties have received their personal data and allow them to remove their data from these third parties’ databases; and
- Develop a comprehensive privacy program that safeguards consumer data privacy and establish a specific data retention policy.
Ultimately, the Commission voted 3-0 to accept the proposed consent agreement. A description of the consent agreement was published on January 18, 2024 in the Federal Register and is subject to a 30-day public comment period. Thereafter the Commission will determine whether to make the proposed consent order final.
What this means to you
This consent order, in conjunction with a separate statement issued by Chair Lina M. Khan and Commissioners Rebecca Kelly Slaughter and Alvaro Bedoya, signals the FTC’s continued commitment to protecting consumers’ personal information. The separate statement clarifies that, by issuing the proposed consent order, the FTC has rejected the premise that data brokers may provide consumers vague disclosures regarding the licensing, sale, or use of sensitive location data. It can therefore be inferred that the FTC will likely be increasing its scrutiny of the use of, and the disclosures made to consumers regarding the use of, sensitive consumer location data. Data brokers and users of consumer location data should review contracts, disclosures, policies and procedures, and actual practices related to consumer location data to ensure consistency with the FTC’s expectations and avoidance of unfair or deceptive acts or practices.
Contact us
If you have any questions about the impact of this proposed consent order on your policies, procedures, or disclosures associated with data collection, retention, or deletion, please contact Chris Friedman, Leslie Sowers, Jacob Huston, or your Husch Blackwell attorney.