In a decisive enforcement action, the Federal Trade Commission (FTC) recently targeted X-Mode Social, Inc. (now operating as Outlogic) for its handling of precise geolocation data. This significant move underscores the FTC's dedication to protecting consumer privacy through increased privacy-focused enforcement actions, and serves as a critical reminder for businesses of the essential need for comprehensive privacy programs that emphasize user consent, transparency, and robust data security. 

X-Mode Social, Inc. was found to have sold precise location data without adequate disclosure and consent, including data revealing consumers' visits to sensitive locations. The company failed to remove sensitive locations from the data it sold and did not ensure users were fully informed about how their location data was being used. 

As a result, the FTC's proposed order prohibits X-Mode from selling sensitive location data and requires it to implement a program to prevent the use or sale of such data, along with obtaining opt-in consent before using sensitive location data. This action vividly illustrates that companies are not entitled to freely commercialize detailed location information without strict compliance with applicable data protection requirements and privacy laws.

Key Takeaways 

Businesses can find several critical takeaways in this enforcement action relating to the collection, use, and sharing of sensitive and geolocation information:

1. Emphasis on Informed Consent: The FTC's action reiterates the paramount importance of obtaining explicit, informed consent from users before collecting, using, or sharing their geolocation data. This consent must be grounded in clear, transparent privacy policies that offer users a real choice in how their data is handled.
2. Need for Robust Data Governance: A strong data governance framework is essential for businesses in order to comply with ever-expanding data protection and privacy laws, especially when handling sensitive and geolocation information. This includes establishing and maintaining comprehensive and up-to-date policies and technical safeguards to prevent unauthorized use, sale, or disclosure of sensitive data.
3. Special Handling of Sensitive Location Data: Sensitive and geolocation information require additional consideration beyond the collection of general personal information. The action underscores the necessity for programs that specifically address the management of sensitive location data, ensuring that such data is treated with the highest level of care and respect for individual privacy.

Businesses should interpret this development as a prompt to bolster their privacy strategies, ensuring they not only meet current legal obligations but are also well-prepared for future legislative shifts. By focusing on these key areas, businesses can improve their privacy programs in a way that not only complies with regulatory requirements, but also fosters consumer trust and transparency, positioning them for success in an increasingly privacy-conscious market.