The FTC is beginning 2024 with a bang. Just a few short days after announcing a settlement with lead-generation company Response Tree, the FTC has announced another decision. In this latest announcement, the FTC has described this as its first settlement with data broker over the sale of sensitive information. According to the FTC, X-Mode Social, and its successor company Outlogic, LLC, tracked and sold to third parties precise location information, which information could identify if people visited “sensitive” locations like medical or reproductive clinics or domestic abuse shelters. This allegation is similar to that the agency made last year against Kochava, in a case that is still pending.

According to the FTC, X-Mode licensed location data in two ways. First, the company would tie raw location data to a device’s unique identifier (the Mobile Advertiser ID or MAID). That raw data could, according to the FTC, be matched to where a person physically visited. This included sensitive locations. X-Mode also licensed audience segments based on location, which location might show interest (examples the FTC gave in its complaint included “Size Inclusive Clothing Stores.”). Information was gathered from consumers both through X-Mode’s own apps (Drunk Mode and Walk Against Humanity) as well as through third party apps. According to the FTC, X-Mode incentivized those apps to include its tracking tools by “promising passive revenue.”

Although Android phone users can elect to opt out of personalized ads, the FTC alleged that X-Mode nevertheless gathered information even if consumers had exercised this opt-out. The FTC also alleged that X-Mode was deceptive in how it described its use of information. In particular, that it did not fully disclose the company’s activities. Although, for example, it said that it shared information with brands or online ad networks, it did not disclose that it sold information to the government for national security purposes. Also of concern to the FTC were allegedly deceptive disclosures about information practices made to the third parties who might include the company’s tracking tools in their apps. This was particular important, the FTC noted, since most of the location information gathered by X-Mode was from these third parties.

In settling with the FTC, under the proposed order the company must, among other things, destroy previously collected information and implement fairly detailed processes and procedures for ensuring that sensitive location information is not sold. The company will also need to give people a “simple and easy-to-find way” of opting out of collection and use of location information. Similar to requirements under state privacy laws, the proposed order also requires that consumers be given information about how to get a list of the third parties with whom their information has been shared.

Putting It Into Practice: This settlement announcement is yet another reminder that the FTC will be looking closely at information sharing and sale activities, especially when the information is sensitive in nature. With this in mind, for those companies purchasing information from third parties, it will be helpful to add privacy compliance to the diligence process.