Regulator action · 9 January 2024
In re X-Mode Social, Inc. and Outlogic, LLC (precise location data)
FTC Docket No. C-4802 (2024) · United States Federal Trade Commission
What it means for your code
If you embed a monetisation SDK, you are the one asking for the permission. Find out what the SDK does with the location you hand it, and say so in the permission prompt.
What happened
A data broker bought precise location data gathered by its SDK inside other developers' apps and resold it, including traces that revealed visits to clinics and places of worship.
What was decided
Selling precise location data without informed consent is unfair, and location revealing visits to sensitive places requires specific safeguards; the company was ordered to delete the data and to police its downstream customers.
⚖ Deletion order and a ban on selling sensitive location data
The legal test applied
- Selling precise location data without informed consent is unfair
- Location revealing visits to sensitive places requires specific safeguards
- The seller must impose and police downstream use restrictions
What would have changed the outcome
- Coarse location, or consent obtained in a prompt naming the recipient and the use, changes the analysis
Source: United States Federal Trade Commission, www.ftc.gov. Summary and analysis by Lawpatch. Risk analysis, not legal advice; the law may have moved on since this decision.