FTC Testifies on Geolocation Privacy

The Federal Trade Commission testified before Congress on the Commission's efforts to address the privacy concerns raised by the tracking of information about consumers’ location, as well as proposed legislation to protect the privacy of geolocation data.

Delivering testimony before the Senate Judiciary Committee’s Subcommittee for Privacy, Technology and the Law, Jessica Rich, Director of the FTC Bureau of Consumer Protection, outlined the FTC’s ongoing efforts to protect the privacy of consumers’ geolocation information through enforcement, policymaking, and consumer and business education.

Precise geolocation data is sensitive personal information increasingly used in consumer products and services, the testimony states. These products and services make consumers’ lives easier and more efficient, but the use of geolocation information can raise concerns because it can reveal a consumer’s movements in real time and provide a detailed record of a consumer’s movements over time.

“Geolocation information can divulge intimately personal details about an individual. Did you visit an AIDS clinic last Tuesday? What place of worship do you attend? Were you at a psychiatrist's office last week? Did you meet with a prospective business customer?” the testimony states.

Geolocation information may be sold to companies to help build profiles about consumers without their knowledge or consent, or it could be accessed by cybercriminals, hackers or through surreptious means such as “stalking apps.”

The FTC has used its enforcement authority under Section 5 of the FTC Act to take action against companies engaged in unfair or deceptive practices involving geolocation information. Last month, for example, the Commission entered into a settlement with the mobile messaging app Snapchat, resolving FTC allegations that Snapchat made multiple misrepresentations to consumers about the disappearing nature of messages sent through its service, as well its transmission of users’ geolocation information. The FTC has raised similar allegations involving undisclosed collection and transmission of location data as part of  privacy complaints against a popular flashlight app, as well as a national rent-to-own retailer and one of its software vendors, the testimony states.

In addition to its enforcement activities involving geolocation information, the Commission has conducted studies, held workshops, and issued reports on mobile privacy disclosures, mobile apps directed to kids, and other topics that elucidate best practices for companies collecting, using, and sharing geolocation information, the testimony says.

The testimony also notes the FTC’s ongoing efforts to educate consumers and businesses about protecting the privacy of geolocation information. For instance, the Commission recently released an updated version of ''Net Cetera: Chatting with Kids About Being Online," and it has released guidance directed to businesses operating in the mobile arena to help educate them on best practices to handle sensitive information, such as geolocation information.

The testimony also provides the Commission’s initial views on the Location Privacy Protection Act of 2014, proposed legislation that seeks to improve the transparency of geolocation services and give consumers greater control over the collection of their geolocation information. The FTC supports the goals of the LPPA, and believes it is an important step forward in protecting consumers’ sensitive geolocation information, the testimony states.

In particular, the testimony highlights three important LPPA provisions that are consistent with the Commission’s views:

• The bill defines “geolocation information” as information that is “sufficient to identify the street name and name of the city or town” in which a device is located. This definition is consistent in many respects with the definition of “geolocation information” in the Commission's COPPA Rule.
• The LPPA requires that an entity collecting consumer geolocation information disclose its collection of such information. The Commission has recommended that companies make their data collection practices more transparent to consumers.
• The LPPA requires affirmative express consent from consumers before a covered entity may knowingly collect or disclose geolocation information, and the Commission supports that approach.

In addition, the testimony notes that the LPPA gives the Department of Justice sole enforcement authority and rulemaking authority, in consultation with the FTC. As the federal government’s leading privacy enforcement agency, the testimony recommends that the Commission have rulemaking and enforcement authority with regard to the civil provisions of the LPPA, and that DOJ have enforcement authority for the criminal provisions.

The Commission vote approving the testimony and its inclusion in the formal record was 5-0.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook, follow us on Twitter, and subscribe to press releases for the latest FTC news and resources.