Mobile Device Privacy Concerns Rise
Recent disclosures that iPhone and Android mobile devices collect and store location information have brought heightened scrutiny to privacy aspects of mobile devices and applications. These disclosures come on the heels of news earlier in the month that federal prosecutors are investigating whether some smartphone applications collect and disclose other types of sensitive consumer information to third parties without informing consumers. (See companion article "Federal Investigators Eyeing Data Collection by Smartphone Apps").
Sources of Concern
Mobile privacy concerns have fed a news cycle feeding frenzy. The disclosures about the iPhone and Android collections spawned, within a week, calls for federal investigations, Congressional inquiries, a hullabaloo on the Internet and at least one class action lawsuit. The Wall Street Journal has published a series of articles about data collection by mobile devices, including those operated by web-based Internet services.
Location privacy issues can arise from a mobile operating system or from an application running on a device. The notion that entities are gathering and retaining location information-or data about a user's tastes-stirs a visceral response among many members of the American public. Concerns range from being tracked by "Big Brother" (or "Big Business") to whether private companies are collecting a trove of data available to law enforcement. On the other hand, it appears that a considerable portion of the public assumes that their location is being tracked readily, that people no longer have much privacy or simply are not greatly troubled by the fuss. Indeed, disclosing location is the very purpose of apps such as FourSquare.
The business interest is evident. Businesses stand to benefit from knowing mobile users' locations and preferences. Some mobile apps, of course, inherently require location data to provide other location-based services, such as identifying nearby restaurants or generating a map. For others, location may be used for other service-related reasons. Last but not least, a potentially valuable reason is to use location to target advertising.
The current law governing mobile privacy is a mess. Courts have split on even as fundamental a question as whether law enforcement needs a search warrant to obtain records of a device's location. FCC regulations restricting the use of location information by carriers by their terms apply only to carriers and not to wi-fi operators or applications that use GPS data.
The investigation into data collection by smartphone applications reportedly may center on the Consumer Fraud and Abuse Act. In this context, the data at issue may well go beyond location to include user tastes and preferences. If so, prosecutors may be proceeding under a theory that app publishers exceed their authority to harvest certain kinds of personal information via smartphones, as users granted only limited authority to publishers when they downloaded apps, and in so doing may have knowingly committed fraud.
The Electronic Communications Privacy Act (ECPA) may also bear on mobile products and services, particularly when it is data on a device other than location that is being collected and disclosed. Questions may arise whether a particular provider is an "electronic communications service" or a "remote computing system," classifications that trigger various obligations and protections under EPCA.
Finally, the small screens native to mobile devices cast doubt on whether privacy policies on mobile devices can provide sufficient "notice" to elicit a meaningful consumer "consent." Both industry and government are looking into ways that "notice" can be provided in a meaningful way.
Stay tuned. Mobile privacy is currently under review by the FTC, federal prosecutors, Congress, self-regulatory organizations and an actively engaged private sector. New developments occur seemingly daily.
For further information on how to stay apprised of these developments, or how your business can navigate the privacy pitfalls affecting mobile devices, please contact the attorney listed below.