FTC Staff Report Recommends Ways to Improve Mobile Privacy Disclosures

The Federal Trade Commission, the nation’s chief privacy agency, issued a staff report recommending ways that key players in the rapidly expanding mobile marketplace can better inform consumers about their data practices.

The report makes recommendations for critical players in the mobile marketplace: mobile platforms (operating system providers, such as Amazon, Apple, BlackBerry, Google, and Microsoft), application (app) developers, advertising networks and analytics companies, and app developer trade associations.  Most of the recommendations involve making sure that consumers get timely, easy-to-understand disclosures about what data they collect and how the data is used.

“The mobile world is expanding and innovating at breathtaking speed, allowing consumers to do things that would have been hard to imagine only a few years ago,” said FTC Chairman Jon Leibowitz.  “These best practices will help to safeguard consumer privacy and build trust in the mobile marketplace, ensuring that the market can continue to thrive.”

The FTC staff report is based on the FTC’s enforcement and policy experience with mobile issues and a May 2012 FTC workshop, which brought together representatives from industry, trade associations, academia, and consumer privacy groups to explore privacy disclosures on mobile devices.

The report describes the explosive growth of mobile services:  in the fourth quarter of 2012, consumers worldwide bought approximately 217 million smartphones.  Smartphones and tablets offer a wide variety of benefits to consumers.  They can be used to make audio and video phone calls, find the nearest coffee shop or gas station, check traffic, browse a digital library while waiting for an appointment, and connect with friends for spontaneous get-togethers.

At the same time, the report states that mobile technology raises unique privacy concerns.  More than other types of technology, mobile devices are typically personal to an individual, almost always on, and with the user.  This can facilitate unprecedented amounts of data collection.  In addition, since a single mobile device can facilitate data collection and sharing among many entities, consumers may wonder where they should turn if they have questions about their privacy.

The report cites recent data showing that consumers increasingly are concerned about their privacy on mobile devices.  For example, 57 percent of all app users have either uninstalled an app over concerns about having to share their personal information, or declined to install an app in the first place for similar reasons.  Less than one-third of Americans feel they are in control of their personal information on their mobile devices.

Based on the Commission’s prior work in this area and information obtained through the panel discussions, written submissions, and the report offers several suggestions for the major participants in the mobile ecosystem as they work to improve mobile privacy disclosures.

The report recommends that mobile platforms should:

• Provide just-in-time disclosures to consumers and obtain their affirmative express consent before allowing apps to access sensitive content like geolocation;
• Consider providing just-in-time disclosures and obtaining affirmative express consent for other content that consumers would find sensitive in many contexts, such as contacts, photos, calendar entries, or the recording of audio or video content;
• Consider developing a one-stop “dashboard” approach to allow consumers to review the types of content accessed by the apps they have downloaded;
• Consider developing icons to depict the transmission of user data;
• Promote app developer best practices.  For example, platforms can require developers to make privacy disclosures, reasonably enforce these requirements, and educate app developers;
• Consider providing consumers with clear disclosures about the extent to which platforms review apps prior to making them available for download in the app stores and conduct compliance checks after the apps have been placed in the app stores; and
• Consider offering a Do Not Track (DNT) mechanism for smartphone users.  A mobile DNT mechanism, which a majority of the Commission has endorsed, would allow consumers to choose to prevent tracking by ad networks or other third parties as they navigate among apps on their phones.

App developers should:

• Have a privacy policy and make sure it is easily accessible through the app stores;
• Provide just-in-time disclosures and obtain affirmative express consent before collecting and sharing sensitive information (to the extent the platforms have not already provided such disclosures and obtained such consent);
• Improve coordination and communication with ad networks and other third parties that provide services for apps, such as analytics companies, so the app developers can better understand the software they are using and, in turn, provide accurate disclosures to consumers.  For example, app developers often integrate third-party code to facilitate advertising or analytics within an app with little understanding of what information the third party is collecting and how it is being used.
• Consider participating in self-regulatory programs, trade associations, and industry organizations, which can provide guidance on how to make uniform, short-form privacy disclosures.

Advertising networks and other third parties should:

• Communicate with app developers so that the developers can provide truthful disclosures to consumers; 
• Work with platforms to ensure effective implementation of DNT for mobile.

App developer trade associations, along with academics, usability experts and privacy researchers can:

• Develop short form disclosures for app developers; 
• Promote standardized app developer privacy policies that will enable consumers to compare data practices across apps;
• Educate app developers on privacy issues.

 “FTC staff strongly encourages companies in the mobile ecosystem to work expeditiously to implement the recommendations in this report.  Doing so likely will result in enhancing the consumer trust that is so vital to companies operating in the mobile environment.  Moving forward, as the mobile landscape evolves, the FTC will continue to closely monitor developments in this space and consider additional ways it can help businesses effectively provide privacy information to consumers,” the report states.

The National Telecommunications and Information Agency, within the U.S. Department of Commerce, is working with other stakeholders to develop a code of conduct on mobile application transparency.  To the extent that strong privacy codes are developed, the FTC will view adherence to such codes favorably in connection with its law enforcement work.

The FTC also introduces Mobile App Developers: Start with Security, a new business guide that encourages developers to aim for reasonable data security, evaluate the app ecosystem before development, and includes tips such as making someone responsible for data security and taking stock of the data collected and maintained.

The vote approving the report was 4-0-1, with Commissioner Joshua D. Wright not participating.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC's online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics.  Like the FTC on Facebook, follow us on Twitter, and subscribe to press releases for the latest FTC news and resources.