• by Wendy Davis  @wendyndavis, January 9, 2024

Data broker Outlogic, formerly X-Mode, has agreed to settle Federal Trade Commission charges by promising to refrain from selling sensitive location data, the agency said Tuesday.

The proposed settlement also requires the company to delete all sensitive location data it “unlawfully” collected, and models or algorithms derived from that information.

“The Constitution protects Americans from unchecked government surveillance, including digital location tracking,” FTC Chair Lina Khan posted to X on Tuesday.

She added that Americans “similarly deserve protection from unchecked corporate surveillance.”

The settlement order defines “sensitive” locations as including medical facilities, religious organizations, correctional facilities, labor union offices and shelters for domestic violence victims or refugees. Another settlement term requires the company to obtain people's affirmative consent before using even non-sensitive location data.

If finalized, the order will mark the first time the FTC has banned a company from using, selling or disclosing sensitive location data, the agency's commissioners said Tuesday in a joint statement.

The FTC's complaint, also unveiled Tuesday, alleged that X-Mode obtained location data from more than 300 apps -- including games, fitness trackers and religions apps -- that include X-Mode's software development kit, which transmits users' precise geolocations.

X-Mode allegedly sold the raw location data in combination with users' mobile ad identifiers (pseudonymous alphanumeric strings), allowing third parties to tie specific individuals to locations. Recipients included “hundreds” of businesses “in industries ranging from real estate to finance, as well as private government contractors,” the FTC alleged.

“X-Mode’s location data associated with [mobile ad identifiers] could be used to track consumers to sensitive locations, including medical facilities, places of religious worship, places that may be used to infer an LGBTQ+ identification, domestic abuse shelters, and welfare and homeless shelters,” the complaint alleged.

“The location data could be used to track consumers who have visited women’s reproductive health clinics and as a result, may have had or contemplated sensitive medical procedures such as an abortion or in vitro fertilization,” the FTC wrote. “Using the data X-Mode has made available, it is possible for third parties to target consumers visiting such healthcare facilities and trace that mobile device to a single-family residence.”

The FTC additionally alleged that until recently, the broker didn't exclude “sensitive” locations from its datasets.

While the company made some disclosures regarding data sales, it failed to fully reveal the extent of its practices, according to the FTC.

For instance, in some cases the data broker allegedly said app users’ location data would be used for ad targeting and analytics, but actually sold the data to government contractors.

That information would have been "material to consumers in deciding whether to use or grant location permissions to mobile apps," the agency said in its complaint, which claimed the data broker engaged in unfair practices.

In other cases, X-Mode allegedly harvested mobile ad identifiers and location data from Android users who had activated a setting that was supposed to opt them out of ad targeting, and then provided access to marketers and other third parties.

“X-Mode provided access to this data so that its customers could, among other things, build profiles about those consumers and serve them personalized advertising,” the complaint alleges.

The FTC will decide whether to finalize the agreement after a 30-day public comment period that will start when the agreement is published in the Federal Register.

An Outlogic spokesperson stated Tuesday that the company disagrees with the FTC's "implications."

“Since its inception, X-mode has imposed strict contractual terms on all data customers prohibiting them from associating its data with sensitive locations such as healthcare facilities,” the spokesperson said, adding that the new restrictions “will not require any significant changes to business or products.”

John Davisson, director of litigation at the Electronic Privacy Information Center, says the FTC's proposed order represents “both a milestone settlement and the tip of the iceberg.”

The order “imposes real, piercing consequences on X-Mode and will make it much harder for the company to track and profit off of our movements through the world,” he tells MediaPost.

“This settlement should be a springboard for across-the-board rules that rein in the abusive data practices of brokers like X-Mode.”

X-Mode isn't the only company to draw the FTC's attention. In 2022, the agency sued mobile data broker Kochava for allegedly selling sensitive location data. Kochava denies that it violated any laws, and has asked U.S. District Court Judge B. Lynn Winmill to dismiss the agency's complaint.