News & Insights  |  Newsletters

FTC Acts Against App’s Undisclosed Geolocation Dissemination

December 2013

The Federal Trade Commission (FTC or Commission) recently announced a consent agreement with Goldenshores Technologies, LLC, and its principal member that will restrict practices allegedly used in marketing the “Brightest Flashlight Free” application developed for Google's Android operating system.  These restrictions affect the important area of collecting and marketing real-time consumer geolocation information.

As understood by the Commission, the subject app “activates all lights on a mobile device, including, where available, the device's LED camera flash and screen to provide outward-facing illumination.”  The app has been popular, ranked by Google as “one of the top free applications,” and apparently has been downloaded “tens of millions of times” from the Google application store alone.

Geolocation Collection

Although geolocation information would not seem necessary to run a flashlight, the app collected the precise geographic location of the mobile device and transmitted that location and the device's identifiers “to various third parties, including advertising networks.”  The Commission did not categorically object to gathering and distributing such data, but it deemed doing so without adequate prior disclosure to be a “deceptive practice” that violates Section 5 of the FTC Act.

Specifically, the FTC interpreted the app's promotional materials and user license agreement as not making “any statements relating to the collection and use of data from users' mobile devices.”  The FTC deemed the facts that “the application transmits, or allows the transmission of their devices' precise location along with persistent device identifiers to various third parties, including third-party advertising networks,” to be “material to users in their decision to install the application.”  The assertion that failure to disclose a material fact constitutes a form of deception is broadly consistent with the FTC's traditional implementation of its authority to restrain deceptive practices in commerce.

The bottom line is that the Commission now clearly deems at least some geolocation collection and sharing in some contexts to be material facts that must be disclosed as a matter of federal law.

Collection Before Choice

The FTC also objected to Goldenshores' practices related to providing app users a purported opportunity to accept or refuse the terms of its user license.  The FTC found the “refuse” button option to be “illusory” in that the “application transmits or causes the transmission of their device data, including the device's precise geolocation and persistent identifier, even before they accept or refuse the terms” of the license, so the represented choice is “false or misleading.”

Perhaps the FTC's view would not go beyond the specific facts of this case, but merchants who use an “opt out” process to turn off some function that otherwise is operating may wish to review their systems in light of the Commission enforcement policy reflected in the Goldenshores matter.

Sanctions Imposed

The agreed-to order does not require Goldenshores or its principal to pay money to the government or to consumers, but it does impose a number of requirements that would seem likely to burden significantly their future marketing.

They are ordered not to “misrepresent in any manner” not just the collection and use of geolocation information but rather any of 12 types of specified identifying information about consumers.  This mandate is not limited to the flashlight app, but instead will apply to the marketing of “any product or service.”  Thus, Goldenshores' future marketing will be conducted under the threat of the substantial sanctions the Commission may impose for violating its orders.

In the case of future collection and/or dissemination of geolocation information by apps, Goldenshores must “clearly and prominently” (an extensively defined term) disclose (separate from its license or privacy policy) four categories of information about the collection and use, and “immediately prior to the initial collection” obtain “affirmative express consent from the consumer to the transmission of such information.” 

Additionally, Goldenshores is required to “delete” the information it previously has collected.  It must maintain specified types of records for FTC review for five years, give the FTC notice of corporate changes, and file a report describing how it has complied with the order.  The order will remain in effect for at least 20 years.

In that context, those contemplating whether to engage in similar marketing practices may wish to consider whether an ounce of prevention might not be the preferable course.