Federal regulators are expanding their crackdown against companies that improperly profit off people’s most sensitive personal information, announcing a first-of-its-kind settlement on Thursday that will prohibit a broker from selling users’ precise location data.
The announcement comes a week after the agency announced a separate agreement that blocked the location data broker Outlogic, formerly X-Mode Social, from selling location data that could reveal a person’s medical visits. That order marked the first time the agency struck a deal to prohibit a company from selling sensitive location data.
The FTC has targeted privacy violations by data brokers as an enforcement priority, with the agency’s consumer protection chief, Sam Levine, speaking out last year against what he called a “fever” by companies to scoop up and trade people’s delicate data with little regard for their well-being.
In its announcement, the FTC said that InMarket maintained lists of users based on detailed grouping traits, such as for “parents of preschoolers” and “Christian church goers,” that it could use to fuel its advertising offering, in addition to targeting users based on their location. The company was listed by the Markup, a tech publication, in 2021 as one of the dozens of brokers that made up the multibillion-dollar market trading location data.
“All too often, Americans are tracked by serial data hoarders that endlessly vacuum up and use personal information,” FTC Chair Lina Khan said in a statement.
The FTC approved the order 3-0, with all of its Democratic commissioners voting in favor. The agency has lacked a full complement for months, with both of its Republican commissioners stepping down over the past two years after speaking out at times against Khan’s leadership.
“We share the FTC’s commitment to advancing consumer privacy, and while we fundamentally disagree with the FTC’s allegations, we are happy to reaffirm the steps InMarket is taking to further our policies around data disclosure and use,” Jason Knapp, InMarket’s chief legal officer and chief privacy officer, said in a statement.
In addition to agreeing to the limits on its use of sensitive and precise location data, the company as part of the settlement will be required to create a new plan to protect users’ privacy, delete data it previously collected without consent, and make it easier for consumers to opt out of data collection.
The order’s definition of precise location data includes GPS coordinates and cell tower information, as well as identifiers collected from WiFi or Bluetooth services.
The earlier Outlogic order is part of a broader push by the Biden administration to expand privacy protections in the wake of the Supreme Court’s overturning Roe v. Wade, which sparked fears that people’s sensitive data could be used to target those seeking abortions.
In July 2022, Biden signed an executive order asking the FTC to take new steps to protect sensitive user data related to reproductive health services, such as abortion.