Notice2024-28745
Mobilewalla Inc.; Analysis of Proposed Consent Order To Aid Public Comment
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
December 6, 2024
Issuing agencies
Federal Trade Commission
Abstract
The consent agreement in this matter settles alleged violations of Federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the complaint and the terms of the consent order--embodied in the consent agreement--that would settle these allegations.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 235 (Friday, December 6, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 235 (Friday, December 6, 2024)]
[Notices]
[Pages 96996-97004]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-28745]
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 202 3196]
Mobilewalla Inc.; Analysis of Proposed Consent Order To Aid
Public Comment
AGENCY: Federal Trade Commission.
ACTION: Proposed consent agreement; request for comment.
-----------------------------------------------------------------------
SUMMARY: The consent agreement in this matter settles alleged
violations of Federal law prohibiting unfair or deceptive acts or
practices. The attached Analysis of Proposed Consent Order to Aid
Public Comment describes both the allegations in the complaint and the
terms of the consent order--embodied in the consent agreement--that
would settle these allegations.
DATES: Comments must be received on or before January 6, 2025.
ADDRESSES: Interested parties may file comments online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Please write ``Mobilewalla;
File No. 202 3196'' on your comment and file your comment online at
<a href="https://www.regulations.gov">https://www.regulations.gov</a> by following the instructions on the web-
based form. If you prefer to file your comment on paper, please mail
your comment to the following address: Federal Trade Commission, Office
of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144 (Annex
D), Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: David Walko (202-326-2775), Division
of Privacy and Identity Protection, Bureau of Consumer Protection,
Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC
20580.
SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec. 2.34, 16 CFR
2.34, notice is hereby given that the above-captioned consent agreement
containing a consent order to cease and desist, having been
[[Page 96997]]
filed with and accepted, subject to final approval, by the Commission,
has been placed on the public record for a period of 30 days. The
following Analysis to Aid Public Comment describes the terms of the
consent agreement and the allegations in the complaint. An electronic
copy of the full text of the consent agreement package can be obtained
at <a href="https://www.ftc.gov/news-events/commission-actions">https://www.ftc.gov/news-events/commission-actions</a>.
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or before January 6, 2025.
Write ``Mobilewalla; File No. 202 3196'' on your comment. Your
comment--including your name and your State--will be placed on the
public record of this proceeding, including, to the extent practicable,
on the <a href="https://www.regulations.gov">https://www.regulations.gov</a> website.
Because of heightened security screening, postal mail addressed to
the Commission will be subject to delay. We strongly encourage you to
submit your comments online through the <a href="https://www.regulations.gov">https://www.regulations.gov</a>
website. If you prefer to file your comment on paper, write
``Mobilewalla; File No. 202 3196'' on your comment and on the envelope,
and mail your comment to the following address: Federal Trade
Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail
Stop H-144 (Annex D), Washington, DC 20580.
Because your comment will be placed on the publicly accessible
website at <a href="https://www.regulations.gov">https://www.regulations.gov</a>, you are solely responsible for
making sure your comment does not include any sensitive or confidential
information. In particular, your comment should not include sensitive
personal information, such as your or anyone else's Social Security
number; date of birth; driver's license number or other State
identification number, or foreign country equivalent; passport number;
financial account number; or credit or debit card number. You are also
solely responsible for making sure your comment does not include
sensitive health information, such as medical records or other
individually identifiable health information. In addition, your comment
should not include any ``trade secret or any commercial or financial
information which . . . is privileged or confidential''--as provided by
section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule Sec. 4.9(c). In
particular, the written request for confidential treatment that
accompanies the comment must include the factual and legal basis for
the request and must identify the specific portions of the comment to
be withheld from the public record. See FTC Rule Sec. 4.9(c). Your
comment will be kept confidential only if the General Counsel grants
your request in accordance with the law and the public interest. Once
your comment has been posted on the <a href="https://www.regulations.gov">https://www.regulations.gov</a>
website--as legally required by FTC Rule Sec. 4.9(b)--we cannot redact
or remove your comment from that website, unless you submit a
confidentiality request that meets the requirements for such treatment
under FTC Rule Sec. 4.9(c), and the General Counsel grants that
request.
Visit the FTC website at <a href="https://www.ftc.gov">https://www.ftc.gov</a> to read this document
and the news release describing the proposed settlement. The FTC Act
and other laws the Commission administers permit the collection of
public comments to consider and use in this proceeding, as appropriate.
The Commission will consider all timely and responsive public comments
it receives on or before January 6, 2025. For information on the
Commission's privacy policy, including routine uses permitted by the
Privacy Act, see <a href="https://www.ftc.gov/site-information/privacy-policy">https://www.ftc.gov/site-information/privacy-policy</a>.
Analysis of Proposed Consent Order To Aid Public Comment
The Federal Trade Commission (``Commission'') has accepted, subject
to final approval, an agreement containing a consent order from
Mobilewalla Inc. (``Mobilewalla''). The proposed consent order
(``Proposed Order'') has been placed on the public record for 30 days
for receipt of public comments from interested persons. Comments
received during this period will become part of the public record.
After 30 days, the Commission will again review the agreement, along
with the comments received, and will decide whether it should make
final the Proposed Order or withdraw from the agreement and take
appropriate action.
Respondent Mobilewalla is a Delaware company with its headquarters
in Georgia. Founded in 2008, Mobilewalla is a data broker that
aggregates consumer information, including location data, to use and
sell for its clients' purposes, including marketing, analytics, and
non-commercial uses.
Mobilewalla does not collect information directly from consumers.
Instead, Mobilewalla purchases consumers' location data and other
personal information, including consumers' unhashed and hashed phone
numbers from third-party data brokers. Mobilewalla has also collected
data through real-time bidding (``RTB'') exchanges and other
advertising platforms.
When Mobilewalla bid to place an advertisement for its clients
through an RTB exchange, Mobilewalla collected and retained the
information contained in the bid request, including the device's mobile
advertising identifier (``MAID''), a timestamp, and precise location
data, if the consumer had location sharing turned on.
Mobilewalla has sold or licensed raw consumer data, including a
device's latitude and longitude coordinates paired with MAIDs, to its
clients. Mobilewalla also analyzes the location data it obtains and,
based on the locations and events visited by consumers' mobile devices,
categorizes MAIDs into ``audience segments'' based on interests or
characteristics purportedly revealed by the locations or events.
Mobilewalla has offered standard audience segments such as ``Music
Lovers'' but has also created custom audience segments for clients,
such as audience segments targeting pregnant women, Hispanic
churchgoers, and members of the LGBTQ+ community.
Mobilewalla does not take sufficient steps to verify that consumers
consent to its use of their data. Mobilewalla relies on its data
suppliers to obtain consumer consent for the collection and use of
their data. Mobilewalla's contracts with its data suppliers include
vague provisions requiring the suppliers to comply with applicable law
when transferring consumer data to Mobilewalla but does not
specifically require consumer consent. In addition, Mobilewalla has
minimal procedures to verify whether its suppliers obtained consumer
consent. Mobilewalla typically evaluates new data suppliers through a
questionnaire and by reviewing the disclosures to consumers from three
to five apps from which the supplier collects consumers' data, even
though some suppliers collect consumers' data from thousands of apps.
Mobilewalla does not subsequently or periodically check whether the
apps have changed their disclosures.
In addition to failing to take sufficient steps to verify consumer
consent,
[[Page 96998]]
Mobilewalla has retained the collected data indefinitely--far longer
than necessary to accomplish the purpose of collection. This
unreasonable retention period, combined with Mobilewalla's
comprehensive data collection practices, significantly increases the
risk that the sensitive location data would be disclosed or misused,
causing harm to consumers.
The Commission's proposed five-count complaint alleges that
Mobilewalla violated section 5(a) of the FTC Act by (1) unfairly
selling consumers' sensitive location information, (2) unfairly
targeting consumers based on sensitive characteristics, (3) unfairly
collecting consumers' information from RTB exchanges, (4) unfairly
collecting and using consumer location information without consent
verification, and (5) unfairly retaining consumer location information.
With respect to the first count, the proposed complaint alleges
that Mobilewalla sold consumers sensitive location information
associated with unique persistent identifiers that reveal consumers'
visits to sensitive locations. With respect to the second count, the
proposed complaint alleges Mobilewalla has categorized consumers into
audience segments based on sensitive characteristics, such as medical
conditions and religious beliefs, derived from location data.
Mobilewalla has sold or transferred these audience segments to third
parties for marketing and other purposes, including identifying and
targeting consumers who participate in political rallies and protests
or attempting to identify and target consumers who participate in union
organizing.
With respect to the third count, the proposed complaint alleges
that Mobilewalla collected consumers' personal information, including
location data, from RTB exchanges, when Mobilewalla had no winning bid.
With respect to the fourth count, the proposed complaint alleges that
Mobilewalla failed to take reasonable steps to verify that consumers
consent to Mobilewalla's use of their location data to track them,
develop audience segments, target them with advertising, and use and
share their location information with clients for commercial,
political, law enforcement, and other purposes. Despite collecting data
from thousands of apps, Mobilewalla only checked a very small number of
apps to determine whether the app disclosed that the app collected
location information and shared it with third parties. Mobilewalla also
did not periodically check apps' disclosures, even though many apps
change their disclosures over time.
With respect to the fifth count, the proposed complaint alleges
that Mobilewalla retained detailed, sensitive information about
consumers, including their location data, indefinitely, which is longer
than reasonably necessary to fulfill the purpose for which that
information was collected. This practice caused substantial injury in
the form of a loss of privacy about the day-to-day movements of
millions of consumers, including through the use of retroactive
geofences, and an increased risk of disclosure and use of such
sensitive information.
The proposed complaint alleges that Mobilewalla has caused or is
likely to cause substantial injury in the form of loss of privacy about
day-to-day movements of consumers and an increased risk of disclosure
of such sensitive information. Additionally, with respect to the fourth
count, the proposed complaint alleges that Mobilewalla has caused or is
likely to cause substantial injury in the form of the chilling of
consumers' First Amendment rights and an increased risk of public or
harmful disclosure of sensitive information about consumers' private
lives, including their fertility choices, religious worship, sexuality,
and other such sensitive information.
Summary of Proposed Order With Respondent
The Proposed Order contains injunctive relief designed to prevent
Mobilewalla from engaging in the same or similar acts or practices in
the future. Geolocation data can vary significantly in its precision.
The privacy concerns posed by the proposed complaint relate to more
precise location data--that is, location data that could be used to
identify specific locations a consumer visits. As a result, the
Proposed Order is limited to location data that identifies consumers'
locations in a geographic area that is equal to or less than the area
of a circle with a radius of 1,850 feet.
Provision I prohibits Mobilewalla from misrepresenting (1) the
extent to which it collects, maintains, uses, discloses, or deletes
location data, and (2) the extent to which such data is deidentified.
Provision II prohibits Mobilewalla from collecting or retaining
consumer information that Mobilewalla accesses while participating in
RTB exchanges for any other purpose than participating in the auctions
that occur on the exchange.
Provision III prohibits Mobilewalla from selling, licensing,
transferring, sharing, disclosing, or using sensitive location data in
any products or services.
Sensitive locations are defined as those locations associated with
(1) medical facilities (e.g., family planning centers, general medical
and surgical hospitals, offices of physicians, offices of mental health
physicians and practitioners, residential mental health and substance
abuse facilities, outpatient mental health and substance abuse centers,
outpatient care centers, psychiatric and substance abuse hospitals, and
specialty hospitals); (2) religious organizations;( 3) correctional
facilities; (4) labor union offices; (5) locations held out to the
public as predominantly providing education or childcare services to
minors; (6) locations held out to the public as predominantly providing
services to LGBTQ+ individuals such as service organizations, bars and
nightlife; (7) locations held out to the public as predominantly
providing services based on racial or ethnic origin; or (8) locations
held out to the public as predominantly providing temporary shelter or
social services to homeless, survivors of domestic violence, refugees,
or immigrants; (9) locations of public gatherings of individuals during
political or social demonstrations, marches, and protests; or (10)
military installations, offices, or buildings.
Provision IV requires that Mobilewalla implement and maintain a
sensitive location data program to develop a comprehensive list of
sensitive locations and to prevent the use, sale, license, transfer, or
disclosure of sensitive location data. Provision V prohibits
Mobilewalla from selling or disclosing Location Data that may determine
the identity or location of an individual's private residence.
Provision VI requires Mobilewalla to implement a Supplier
Assessment Program by which they assess their suppliers and help ensure
that consumers have provided consent for the collection and use of
Location Data obtained by Mobilewalla. Under this program, Mobilewalla
must conduct initial assessments of all suppliers within 30 days of
entering into a data sharing agreement. The program also requires that
Mobilewalla confirm that consumers provide Affirmative Express Consent,
if feasible, or confirm that consumers provide specific consent to the
collection, use, and sale of their location data. Mobilewalla must also
create and maintain records of its Suppliers' assessment responses.
Finally, Mobilewalla must cease from using, selling, or disclosing
location data for which consumers do not provide consent.
[[Page 96999]]
Provision VII requires Mobilewalla to provide a clear and
conspicuous means for consumers to request the identities of any third
parties to whom Respondent sold or otherwise disclosed their location
data during the one-year period preceding the request. Provision VIII
requires Mobilewalla to provide a simple, easily-located means for
consumers to withdraw any consent provided and Provision IX requires
Mobilewalla to delete and cease collecting location data after
Mobilewalla receives notice that the consumer has withdrawn their
consent. Provision X also requires Mobilewalla to provide a simple,
easily-located means for consumers to request that Mobilewalla delete
location data that Mobilewalla previously collected and to delete the
location data within 30 days of receipt of such request.
Provision XI requires that Mobilewalla (1) document and adhere to a
retention schedule for the covered information it collects from
consumers, including the purposes for which it collects such
information, the specific business needs, and an established timeframe
for its deletion, and (2) prior to collecting or using new type of
information related to consumers that was not previously collected, and
is not described in its retention schedule, update its retention
schedule. Provision XII requires Mobilewalla to delete any historic
location data and consumers' unhashed and hashed phone numbers in their
control and any work product created from this data and to instruct
their customers to also delete this information, unless Mobilewalla
contains a record in accordance with the Supplier Assessment Program
(Provision VI) that consumers consented to the collection, use, and
disclosure of their historic location data or the historic location
data is deidentified or rendered non-sensitive. Provision XIII requires
Mobilewalla to establish and implement, and thereafter maintain, a
comprehensive privacy program that protects the privacy of consumers'
personal information.
Provisions XIV-XVII are reporting and compliance provisions, which
include recordkeeping requirements and provisions requiring Mobilewalla
to provide information or documents necessary for the Commission to
monitor compliance. Provision XVIII states that the Proposed Order will
remain in effect for 20 years, with certain exceptions.
The purpose of this analysis is to facilitate public comment on the
Proposed Order, and it is not intended to constitute an official
interpretation of the complaint or Proposed Order, or to modify the
Proposed Order's terms in any way.
By direction of the Commission, Commissioner Holyoak dissenting.
April J. Tabor,
Secretary.
Statement of Chair Lina M. Khan Joined by Commissioner Alvaro M. Bedoya
Last year a new report revealed the relative ease with which
foreign adversaries can gather sensitive data on Americans.\1\ Foreign
states could identify, for example, whether someone has a substance
abuse problem, a gambling addiction, or major financial problems--a
``torrent of blackmail data'' ripe for abuse.\2\ The report noted that
people susceptible to this type of surveillance include active military
personnel, defense officials, lawmakers, and judges. Beyond government
employees, hundreds of millions of Americans are at risk. Precise
location data, for example, can be harnessed by managers tracking
employees suspected of workplace organizing, law enforcers monitoring
protestors who oppose government policies, or stalkers keeping tabs on
their victims.
---------------------------------------------------------------------------
\1\ Irish Council for Civil Liberties, America's Hidden Security
Crisis: How Data About United States Defence Personnel & Political
Leaders Flows to Foreign States & Non-State Actors (2023), <a href="https://www.iccl.ie/wp-content/uploads/2023/11/Americas-hidden-security-crisis.pdf">https://www.iccl.ie/wp-content/uploads/2023/11/Americas-hidden-security-crisis.pdf</a>. See also Justin Sherman, et al., Data Brokers and the
Sale of Data on U.S. Military Personnel Risks to Privacy, Safety,
and National Security (Duke Univ. Sanford Sch. of Pub. Pol'y 2023),
<a href="https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-data-on-us-military-personnel/">https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-data-on-us-military-personnel/</a>; Joseph Cox, The Hundreds of Little-
Known Firms Getting Data on Americans, Vice (June 28, 2021), <a href="https://www.vice.com/en/article/hundreds-companies-bidstream-data-location-browsing/">https://www.vice.com/en/article/hundreds-companies-bidstream-data-location-browsing/</a>.
\2\ Id.
---------------------------------------------------------------------------
The mechanism for this surveillance is shockingly commonplace:
``real-time bidding'' (RTB) exchanges, an advertising technology
present on a huge swath of websites and apps. RTB exchanges host the
online auctions that determine which advertisement gets served to a
specific individual on a specific website or app. Because these ads are
targeted, RTB technology captures reams of personal data, such as a
person's browsing history and their location and movements over time--
and then broadcasts this sensitive data to anyone seeking to bid on the
ad slot. One report estimates that RTB technologies track and broadcast
what every U.S. internet user does every 30 seconds they are online--or
747 times a day on average.\3\ Strikingly, a firm can capture and
retain individuals' web browsing data, location data, and other
sensitive details even when it does not serve any ads to them. As
lawmakers have noted, the exposure of this bidstream data creates an
``outrageous privacy violation'' \4\ as well as a major threat to
national security.\5\
---------------------------------------------------------------------------
\3\ Id. at p. 7.
\4\ Letter from Sen. Wyden to Chair Simons (July 30, 2020),
<a href="https://www.wyden.senate.gov/imo/media/doc/073120_Wyden_Cassidy_Led_FTC_Investigation_letter.pdf">https://www.wyden.senate.gov/imo/media/doc/073120_Wyden_Cassidy_Led_FTC_Investigation_letter.pdf</a>.
\5\ Joseph Cox, Congress Says Foreign Intel Services Could Abuse
Ad Networks for Spying, Vice (Apr. 6, 2021), <a href="https://www.vice.com/en/article/congress-foreign-intelligence-agencies-bidstream-real-time-bidding/">https://www.vice.com/en/article/congress-foreign-intelligence-agencies-bidstream-real-time-bidding/</a>.
---------------------------------------------------------------------------
Today the FTC is bringing an enforcement action against
surveillance practices that illegally harness RTB data--the first time
the Commission has taken action against the use of this ``bidstream''
data. Specifically, our action against Mobilewalla charges that the
data broker, among other things, unfairly collected people's sensitive
data (including precise location) from real-time bidding exchanges--
even when it did not place an ad through the bid.
This conduct was part of a broader set of practices that
Mobilewalla undertook to unlawfully collect, sell, and retain sensitive
information on millions of Americans. Our investigation uncovered that
Mobilewalla gathered large swaths of people's personal information,
including location data, and sold ``audience segments'' that third
parties could use to target people based on sensitive characteristics.
Mobilewalla's audience segments included, for example, Hispanic
churchgoers, pregnant women, members of the LGBTQ+ community, workers
participating in union organizing, and people who participate in
political rallies. Mobilewalla built these profiles through a variety
of mechanisms beyond its use of bidstream data, such as by creating
``geo-fences'' around places like pregnancy centers, political
protests, and state capitols.\6\ Mobilewalla even began collecting
people's phone numbers, which, paired with MAIDs, could be used to
identify the person frequenting a specific location.
---------------------------------------------------------------------------
\6\ In one instance, one of Mobilewalla's clients used its data
to ``geo-fence the homes of individuals relevant to a private
lawsuit and track where those individuals had traveled to over the
preceding two years, including whether they visited federal law
enforcement offices.'' Complaint, In re Mobilewalla, Inc., FTC File
No. 2023196 (Dec. 3, 2024) at ] 50.
---------------------------------------------------------------------------
The Commission's complaint charges that Mobilewalla's practices
constituted unfair conduct in violation of the FTC Act. Specifically,
the complaint alleges that: (1) Mobilewalla's sale of people's
sensitive location data is unfair; (2) Mobilewalla's sale and transfer
of audience segments based on sensitive characteristics--like their
medical conditions, religious beliefs,
[[Page 97000]]
participation in workplace organizing, or attendance at political
protests--is unfair; (3) Mobilewalla's collection of people's personal
information, including geolocation data, from RTB exchanges even when
Mobilewalla had no winning bid is unfair; (4) Mobilewalla's failure to
take reasonable steps to verify that users consent to its use of their
location data to surveil them, develop audience segments based on
sensitive characteristics, target them with advertising, and
disseminate their location data with a host of clients is unfair, and
(5) Mobilewalla's indefinite retention of people's sensitive location
information is unfair.
The Commission's action against Mobilewalla marks the FTC's fifth
case involving the illegal dissemination of geolocation information--
all pursued in the last 28 months.\7\ This steady clip of cases
reflects our recognition that location data is among the most sensitive
of people's data, revealing everything from where someone spends the
night to what medical services they seek. Indeed, the District of Idaho
last year recognized that invasions of privacy can substantially injure
Americans, even without a showing of further harm.\8\ And noting that
``location records hold for many Americans the `privacies of life,' ''
the Supreme Court has held that constitutional safeguards against
unchecked government surveillance extend to digital location tracking--
even when the data is originally collected by private companies.\9\
---------------------------------------------------------------------------
\7\ Press Release, Fed. Trade Comm'n, FTC Sues Kochava for
Selling Data that Tracks People at Reproductive Health Clinics,
Places of Worship, and Other Sensitive Locations (Aug. 29, 2022),
<a href="https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other">https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other</a>; Press Release, Fed. Trade Comm'n, FTC Order
Prohibits Data Broker X-Mode Social and Outlogic from Selling
Sensitive Location Data (Jan. 9, 2024), <a href="https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data">https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data</a>; Press
Release, Fed. Trade Comm'n, FTC Order Will Ban InMarket from Selling
Precise Consumer Location Data (Jan. 18, 2024), <a href="https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-will-ban-inmarket-selling-precise-consumer-location-data">https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-will-ban-inmarket-selling-precise-consumer-location-data</a>; Press Release, Fed. Trade
Comm'n, Gravy Analytics (Dec. 3, 2024), <a href="https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers">https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers</a>.
\8\ Memorandum Decision & Order, FTC v. Kochava Inc., 2:22-cv-
00377-BLW (D. Idaho May 4, 2023) (``Thus, under the plain language
of the FTC Act, a defendant whose acts or practices violate consumer
privacy may be said to inflict an `injury' upon consumers within the
meaning of Section 5(n)'').
\9\ Carpenter v. United States, 585 U.S. 296, 138 S. Ct. 2206,
2217 (2018) (quoting Riley v. California, 573 U.S. 373, 403 (2014)).
See also Statement of Chair Lina M. Khan Joined by Comm'r Rebecca
Kelly Slaughter and Comm'r Alvaro Bedoya In the Matter of X-Mode
Social, Inc. and Outlogic, LLC (Jan. 9, 2024), <a href="https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/statement-chair-lina-m-khan-joined-commissioner-rebecca-kelly-slaughter-commissioner-alvaro-bedoya-0">https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/statement-chair-lina-m-khan-joined-commissioner-rebecca-kelly-slaughter-commissioner-alvaro-bedoya-0</a>; Statement of Comm'r Alvaro Bedoya
Joined By Chair Lina M. Khan In the Matter of Gravy Analytics (Dec.
3, 2024), <a href="https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/statement-commissioner-alvaro-m-bedoya-joined-chair-lina-m-khan-commissioner-rebecca-kelly-slaughter-3">https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/statement-commissioner-alvaro-m-bedoya-joined-chair-lina-m-khan-commissioner-rebecca-kelly-slaughter-3</a>.
---------------------------------------------------------------------------
Today's action highlights two areas meriting continued focus for
the Commission and policymakers concerned about threats to Americans'
privacy. First, the ease with which real-time bidding technology can be
exploited to surveil Americans should raise serious alarm. No real
safeguards limit who can access, harness, or retain this data, meaning
that the multi-billion-dollar industry built around targeted
advertising leaves Americans' sensitive data shockingly exposed.
Second, this matter further highlights the continued shortcomings
of the ``notice and consent'' paradigm. Most people never interact with
Mobilewalla and have no idea that Mobilewalla amasses data detailing
their precise location and movements. In theory, Mobilewalla would rely
on its data suppliers to obtain consumer consent for the collection and
use of their data. But in practice, Mobilewalla has minimal procedures
to verify whether its suppliers actually obtained consumer consent--and
many disclosures are broad enough to render consent effectively
meaningless. In recent years, the Commission's orders have moved away
from remedies and relief premised exclusively on consumer consent--and
included greater reliance on presumptive bans and prohibitions.\10\
Continuing to ensure our orders reflect the realities of how people
engage in today's economy will be critical for Americans to enjoy real
privacy.
---------------------------------------------------------------------------
\10\ See, e.g., X-Mode, InMarket, supra note 7; Press Release,
Fed. Trade Comm'n, FTC Order Will Ban Avast from Selling Browsing
Data for Advertising Purposes, Require It to Pay $16.5 Million Over
Charges the Firm Sold Browsing Data After Claiming Its Products
Would Block Online Tracking (Feb. 22, 2024), <a href="https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over">https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over</a>; Press Release, Fed. Trade Comm'n, FTC Enforcement
Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info
for Advertising (Feb. 1, 2023), <a href="https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising">https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising</a>.
---------------------------------------------------------------------------
I am grateful to the DPIP team for their excellent work on this
matter.
Concurring and Dissenting Statement of Commissioner Andrew N. Ferguson
Today the Commission approves complaints against, and proposed
consent orders with, Gravy Analytics \1\ (``Gravy'') \2\ and
Mobilewalla \3\ for various practices concerning the collection and
dissemination of precise location data allegedly constituting unfair or
deceptive acts or practices in violation of section 5 of the Federal
Trade Commission Act.\4\ Gravy and Mobilewalla are data brokers that
aggregate and sell consumer data, including location data.\5\ Gravy and
Mobilewalla do not collect the data from consumers.\6\ Those data are
collected from applications that consumers use on their smartphones,
and Gravy and Mobilewalla purchase or otherwise acquire those data
after they are collected.\7\ Gravy and Mobilewalla then sell those data
to private firms for advertising, analytics, and other purposes, as
well as to the government.\8\
---------------------------------------------------------------------------
\1\ Also named is Venntel, Inc., a wholly-owned subsidiary of
Gravy Analytics.
\2\ Complaint, In re Gravy Analytics (``Gravy Complaint'').
\3\ Complaint, In re Mobilewalla (``Mobilewalla Complaint'').
\4\ 15 U.S.C. 45.
\5\ Gravy Complaint ] 7; Mobilewalla Complaint ]] 3, 18.
\6\ Gravy Complaint ] 8; Mobilewalla Complaint ] 4.
\7\ Gravy Complaint ]] 9-10; Mobilewalla Complaint ]] 4, 5.
\8\ Gravy Complaint ]] 13-21; Mobilewalla Complaint ]] 6, 19,
36. As my colleagues' statements make clear, the sale of data to the
government for law-enforcement, national-security, and immigration-
enforcement purposes implicates different constitutional and
statutory questions than the sale of those same data to private
firms. I take no firm position on those questions except to say that
I believe that the restrictions on sale to the government in the
Gravy order are lawful.
---------------------------------------------------------------------------
Part I
I concur entirely in two of the counts the Commission brings
against both firms, and one that we bring against Mobilewalla alone.
These counts are sufficient to justify my vote in favor of submitting
the complaints and proposed consent orders for public comment. First,
the Commission alleges that Gravy and Mobilewalla sell consumers'
precise location data without taking sufficient measures to anonymize
the information or filter out sensitive locations.\9\ This type of
data--records of a person's precise physical locations--is inherently
intrusive and revealing of people's most private affairs. The sale of
such revealing information that can be linked directly to an individual
consumer poses an obvious risk of
[[Page 97001]]
substantial injury to that consumer.\10\ The theft or accidental
dissemination of those data would be catastrophic to the consumer. The
consumer cannot avoid the injury. Unless the consumer has consented to
the sale of intimate data linked directly to him, the sale of the data
happens entirely without his knowledge.\11\ Finally, given that the
anonymized data remain valuable to firms for advertising and analytics,
the injury that the consumer suffers is not outweighed by any
countervailing benefits for the consumer.\12\ The sale of non-
anonymized, precise location data without first obtaining the
meaningfully informed consent of the consumer is therefore an unfair
act or practice in violation of section 5.
---------------------------------------------------------------------------
\9\ Gravy Complaint ]] 73-75; Mobilewalla Complaint ]] 66-67.
\10\ 15 U.S.C. 45(n); see FTC v. Kochava, Inc., 715 F. Supp. 3d
1319, 1323-24 (D. Idaho 2024).
\11\ 15 U.S.C. 45(n).
\12\ Ibid.
---------------------------------------------------------------------------
Second, the Commission accuses both companies of collecting, using,
and selling precise location information without sufficiently verifying
that the consumers who generated the data consented to the collection
of those data by the applications that collected it.\13\ Given that the
failure to obtain meaningful consent to the collection of precise
location data is widespread, data brokers that purchase sensitive
information cannot avoid liability by turning a blind eye to the strong
possibility that consumers did not consent to its collection and sale.
The sale of precise location data collected without the consumer's
consent poses a similarly unavoidable and substantial risk of injury to
the consumer as does the sale of the non-anonymized data. I therefore
concur in these counts against Gravy and Mobilewalla.\14\
---------------------------------------------------------------------------
\13\ Gravy Complaint ]] 76-78; Mobilewalla Complaint ]] 71-72.
\14\ Section 5 does not impose strict liability for the purchase
of precise location data collected without the consumer's consent,
nor do I understand the complaints and orders as interpreting
section 5 hold data brokers strictly liable for every purchase of
precise location data that was collected without the consumer's
consent. Data brokers need only take reasonable steps to ensure that
the data they are acquiring were originally collected with the
consumer's consent. Gravy Complaint ] 76 (faulting Gravy for not
taking ``reasonable steps to verify that consumers provide informed
consent to Respondents' collection, use, or sale of the data for
commercial and government purposes.''); Mobilewalla Complaint ] 71
(similar).
---------------------------------------------------------------------------
I further concur in one additional count charged against
Mobilewalla alone. The Commission accuses it of having committed an
unfair act or practice for its conduct on real-time bidding exchanges
(RTBs).\15\ An RTB is a marketplace where advertisers bid in real time
on the opportunity to show an advertisement to a user as the user is
visiting a website or using an application.\16\ The auctions take place
in the blink of an eye, and the listings on which advertisers bid
include information such as the user's mobile advertising ID (MAIDs)
and current precise location.\17\ Advertisers crave these data because
it allows them to maximize the value of each ad impression by
displaying the ads only to the users most likely to find the
advertisement useful. The Commission accuses Mobilewalla of sitting on
the RTBs, submitting bids, collecting the MAIDs and location data for
the bids, retaining those data even when it did not win the auction,
and combining those data with data acquired from other sources to
identify the user represented by the MAID.\18\ It aggregated and sold
this combined identity and location information to its clients.\19\
This alleged practice violated Mobilewalla's legal contracts with the
exchanges.\20\
---------------------------------------------------------------------------
\15\ Mobilewalla Complaint ] 70.
\16\ Id. ] 9.
\17\ Ibid.
\18\ Id. ]] 12-15.
\19\ Id. ] 18.
\20\ Mobilewalla Complaint ] 10.
---------------------------------------------------------------------------
The violation of a private contract alone is not enough to
establish a violation of section 5.\21\ But these agreements protected
more than just Mobilewalla's contractual counterparties. They also
protected large numbers of consumers from the risk of having their
private data aggregated, linked to their identity, and sold without
their consent, as Mobilewalla did. Mobilewalla's breach of its
contractual obligations therefore exposed consumers to the same
substantial risk of injury as collection of their data without consent,
was not reasonably avoidable by consumers (as this conduct was far
removed from their knowledge and control), and was not outweighed by
any countervailing benefits to consumers. It is therefore in the public
interest to hold Mobilewalla liable for this conduct under section 5,
as it would be even if no contract governed Mobilewalla's obligations
regarding the unconsented collection and retention of these precise
location data.\22\
---------------------------------------------------------------------------
\21\ See FTC v. Klesner, 280 U.S. 19, 28 (1929) (Section 5's
requirement that enforcement ``would be to the interest of the
public'' is not satisfied in the case of a purely private dispute,
as ``the mere fact that it is to the interest of the community that
private rights shall be respected is not enough to support a finding
of public interest.'').
\22\ See id. at 27-28 (explaining that protection of private
rights can be incident to the public interest, and that such cases
might include those where the conduct threatens the existence of
competition, involves the ``flagrant oppression of the weak by the
strong,'' or where the aggregate loss is sufficient to make the
matter one of public consequence but incapable of vindication by
individual private suits).
---------------------------------------------------------------------------
Part II
I dissent from the Commission's counts against both firms accusing
them of unfairly categorizing consumers based on sensitive
characteristics, and of selling those categorizations to third
parties.\23\ The FTC Act prohibits the collection and subsequent sale
of precise location data for which the consumer has not consented to
the collection or sale. It further requires data brokers to take
reasonable steps to ensure that consumers originally consented to the
collection of the data that the data brokers subsequently use and sell.
If a company aggregates and categorizes data that were collected
without the consumer's consent, and subsequently sells those
categorizations, it violates section 5. But it does so only because the
data were collected without consent for such use, not because the
categories into which it divided the data might be on an indeterminate
naughty categories list. The FTC Act imposes consent requirements in
certain circumstances. It does not limit how someone who lawfully
acquired those data might choose to analyze those data, or the
conclusions that one might draw from them.\24\
---------------------------------------------------------------------------
\23\ Gravy Complaint ]] 79-81; Mobilewalla Complaint ]] 68-69.
\24\ Of course, other laws might prohibit particular uses of
data that were collected consistently with the requirements of
section 5. Using lawfully obtained data to draw conclusions about a
consumer's race alone would not violate section 5, but using those
conclusions to make an employment or housing decision, for example,
might violate the Civil Rights Act of 1964, 42 U.S.C. 2000e et seq.,
or the Fair Housing Act, 42 U.S.C. 3601 et seq. But merely drawing a
conclusion from lawfully obtained data does not violate section 5.
---------------------------------------------------------------------------
Consider an analogous context: the collection of data by private
investigators. Private investigators do not violate the law if they
follow someone on the public streets to his place of employment,
observe him entering a church, observe him attending the meeting of a
political party, or watch him enter a hospital. These are all public
acts that people carry out in the sight of their fellow citizens every
day. Nor do private investigators violate the law by concluding from
their lawful observations that the person works for that company,
practices that religion, belongs to that political party, or suffers
from an illness. Nor would the law prohibit the private investigator
from selling his conclusions to a client. But the law would forbid
private investigators from trespassing on the employer's property; from
surreptitiously planting cameras inside
[[Page 97002]]
the church sanctuary to observe the rites; from recording the
proceedings of the political meeting without consent; or from extorting
hospital staff for information about the person's condition. The law
prohibits collecting data in unlawful ways; it does not prohibit
drawing whatever conclusions one wants, or selling those conclusions to
someone else, so long as the data from which the conclusions were drawn
were lawfully obtained.
The same principle should apply to section 5. The added wrinkle is
that in the information economy, private data are usually collected in
the context of a commercial relationship between the user and the
developer of an application or website. Just as we expect a merchant to
disclose the material terms of a transaction before collecting payment,
we expect that the user of an app or website be informed of how their
private information--part, and often all, of the consideration they
give in exchange for use of the app or website--will be collected and
used, and given a chance to decline the transaction. Commercial
fairness might also require more than vague hidden disclosures,
especially when the loss of privacy is substantial, as is the case with
collection of precise location data and its sale to third parties.
Rather than faulting these companies for disclosing data about
users without adequate consent, these counts in the complaints focus
instead on the inherent impropriety of categorizing users according to
so-called ``sensitive characteristics.'' Perhaps my colleagues are
worried that advertisements targeted on the basis of these categories
can cause emotional distress--the theory they advanced in the
Commission's Social Media 6(b) Report earlier this year.\25\ But as I
argued then, it is folly to try to identify which characteristics are
sensitive and which are not. ``[T]he list of things that can trigger
each unique individual's trauma is endless and would cover every
imaginable'' advertisement based on every possible categorization, so
whatever lines we end up drawing will be ``either arbitrary or highly
politicized.'' \26\
---------------------------------------------------------------------------
\25\ FTC, A Look Behind the Screens: Examining the Data
Practices of Social Media and Video Streaming Services, An FTC Staff
Report, at 44 (Sept. 2024), <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf">https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf</a>.
\26\ Concurring and Dissenting Statement of Commissioner Andrew
N. Ferguson, A Look Behind the Screens: Examining the Data Practices
of Social Media and Video Streaming Services, at 5 (Sept. 19, 2024),
<a href="https://www.ftc.gov/system/files/ftc_gov/pdf/ferguson-statement-social-media-6b.pdf">https://www.ftc.gov/system/files/ftc_gov/pdf/ferguson-statement-social-media-6b.pdf</a>.
---------------------------------------------------------------------------
We can already see this dysfunction in these complaints, which
mention as sensitive characteristics race, ethnicity, gender, gender
identity, sexual orientation, pregnancy, parenthood, health conditions,
religion, and attendance of a political protest, among others.\27\
While some of these characteristics often entail private facts, others
are not usually considered private information. Attending a political
protest, for example, is a public act. The public expression of
dissatisfaction or support is the point of a protest. Treating
attendance at a political protest as uniquely private and sensitive is
an oxymoron. Moreover, there are no objective criteria on which to base
this list.\28\ The statute provides no guidance. The list is therefore
a purely subjective creation of Commission bureaucrats. And it excludes
categories that many would consider deeply private and sensitive.\29\
And if we did a full accounting of characteristics that someone,
somewhere might consider sensitive, no useful categorizations would
remain. If what we are worried about is that the generation and sale of
these categorizations will be a substitute for the sale of the user
data from which they are derived, the correct approach is to treat
conclusions derived from user data as no different than the underlying
data. In either case, adequate consent is required for their
collection, use, and sale.
---------------------------------------------------------------------------
\27\ Mobilewalla Complaint ]] 27-32.
\28\ See Kyllo v. United States, 533 U.S. 27, 38-39 (2001)
(rejecting a Fourth Amendment rule that limited thermal-imaging data
collection to only ``intimate details'' because of the impossibility
of developing a principled distinction between intimate and
nonimtimate information).
\29\ Gun ownership is an example. In many States, citizens are
free to own guns without registering them. There is therefore no
public record that a person owns a gun. And in constitutional-carry
States, a citizen may carry his handgun in concealment without the
government's permission, which means that bearing a firearm outside
the home remains a private act. I expect many Americans would be
horrified if their sensitive location data were used to place them
in a ``gun owner'' category, and that category were then sold to
other firms or to the government--particularly banks have gotten in
the habit of ejecting customers who engaged in disfavored
activities. Yet gun ownership does not make the Commission's list.
But political protests do. It is hard to see this list as anything
other than the product of arbitrary or political decision making.
---------------------------------------------------------------------------
Finally, I have doubts about the viability of a final charge levied
against Mobilewalla for indefinitely retaining consumer location
information.\30\ It is a truism that data stored indefinitely is at a
greater risk of compromise than data stored for a short period of time.
But nothing in section 5 forms the basis of standards for data
retention. The difficulty is illustrated perfectly by the proposed
order we approve today. Rather than impose any particular retention
schedule, it merely requires that Mobilewalla:
---------------------------------------------------------------------------
\30\ Mobilewalla Complaint ]] 73-74.
. . . document, adhere to, and make publicly available . . . a
retention schedule . . . setting forth: (1) the purpose or purposes
for which each type of Covered Information is collected or used; (2)
the specific business needs for retaining each type of Covered
Information; and (3) an established timeframe for deletion of each
type of Covered Information limited to the time reasonably necessary
to fulfill the purpose for which the Covered Information was
collected, and in no instance providing for the indefinite retention
of any Covered Information . . .\31\
---------------------------------------------------------------------------
\31\ Decision and Order, In re Mobilewalla, Inc., at 13.
Given that Mobilewalla is in the business of selling user
information, and that the marginal cost of data storage is low, the
``specific business need'' can be nothing more than the possible
existence in the future of some buyer willing to pay more than the low
cost of storage to acquire the data. I see no reason why Mobilewalla
could not set a retention period of many decades based on this
reasoning. In fact, while two-year-old location data is intuitively
less valuable than one-year-old location data, it is quite plausible
that twenty- or thirty-year-old location data is more valuable than
location data that is only a few years old, as it may allow advertisers
to tap into nostalgic sentiments.
The trouble with both the sensitive-categories count and the data-
retention count is that the text of section 5 cannot bear the
tremendous weight my colleagues place on it. My colleagues want the FTC
Act to be a comprehensive privacy law. But it is not. Comprehensive
privacy regulation involves difficult choices and expensive tradeoffs.
Congress alone can make those choices and tradeoffs. It did not do so
when it adopted the general prohibitions of section 5 nearly nine
decades ago. And it has not adopted comprehensive privacy legislation
since then. We must respect that choice.
Until Congress acts, we should vigorously protect Americans'
privacy by enforcing the laws Congress has actually passed. But we must
not stray from the bounds of the law. If we do, we will sow uncertainty
among legitimate businesses, potentially disrupt the ongoing
negotiations in Congress on privacy legislation, and risk damaging
losses for the Commission in court.
Dissenting Statement of Commissioner Melissa Holyoak
Since arriving at the Commission, I have supported law enforcement
actions against data brokers that sold precise
[[Page 97003]]
geolocation data revealing consumers' religious beliefs, political
leanings, and medical conditions.\1\ Such enforcement actions have been
particularly important where they help preserve Americans' freedoms and
are consistent with the FTC Act, such as in a separate case the
Commission brings against Gravy Analytics today. But the instant
complaint and proposed settlement with Mobilewalla colors well outside
the lines of the Commission's authority. Indeed, the Chair is seeking
to effectuate legislative and policy goals that rest on novel legal
theories well beyond what Congress has authorized. We should not use
our enforcement powers this way.\2\ Because core aspects of this case
are misguided, I dissent. I briefly explain some of my concerns below.
And I anticipate and welcome robust comment on the proposed order
before it is finalized.
---------------------------------------------------------------------------
\1\ See, e.g., Concurring Statement of Comm'r Melissa Holyoak,
Kochava, Inc., FTC Matter No. X230009 (July 15, 2024), <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/2024-7-15-Commissioner-Holyoak-Statement-re-Kochava-final.pdf">https://www.ftc.gov/system/files/ftc_gov/pdf/2024-7-15-Commissioner-Holyoak-Statement-re-Kochava-final.pdf</a>; Concurring Statement of Comm'r
Melissa Holyoak, Joined In Part By Comm'r Alvaro M. Bedoya (Section
I Only), In re Gravy Analytics, Inc., FTC Matter No. 2123035 (Dec.
3, 2024).
\2\ Cf., e.g., Dissenting Statement of Comm'r Melissa Holyoak,
Joined by Comm'r Andrew N. Ferguson, In re Rytr, LLC, FTC Matter No.
2323052, at 1 (Sept. 25, 2024) (``As I have suggested recently in
other contexts, the Commission should steer clear of using
settlements to advance claims or obtain orders that a court is
highly unlikely to credit or grant in litigation. Outside that
crucible, the Commission may more readily advance questionable or
misguided theories or cases. Nevertheless, private parties track
such settlements and, fearing future enforcement, may alter how they
act due to a complaint's statement of the alleged facts, its
articulation of the law, or how a settlement order constrains a
defendant's conduct. In all industries, but especially evolving ones
. . . misguided enforcement can harm consumers by stifling
innovation and competition. I fear that will happen after today's
case, which is another effort by the Majority to misapply the
Commission's unfairness authority under section 5 beyond what the
text authorizes. Relatedly, I believe the scope of today's
settlement is unwarranted based on the facts of this case.''
(citations omitted)), <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/holyoak-rytr-statement.pdf">https://www.ftc.gov/system/files/ftc_gov/pdf/holyoak-rytr-statement.pdf</a>.
---------------------------------------------------------------------------
Several background considerations also inform my approach and
dissent in this particular matter. First, this matter uses a settlement
to effectuate policy objectives that political leadership at the
Commission has sought for years but failed to achieve through
regulation.\3\ No matter how much political pressure Chair Khan and the
Bureau Director may feel with the shot-clock running out, the
Commission should not use complaints and orders to score political
points that stem from misuse of our statutory authorities. Second and
related: Chair Khan's decision to proceed runs directly afoul of recent
Congressional oversight from several of the FTC's authorizing
Committees that explicitly cautioned against this type of endeavor.\4\
Choosing to proceed undermines our institutional legitimacy and will
engender even more distrust from Congress--trust that current
leadership at the Commission has repeatedly broken.\5\
---------------------------------------------------------------------------
\3\ See Press Release, FTC Explores Rules Cracking Down on
Commercial Surveillance and Lax Data Security Practices (Aug. 11,
2022), <a href="https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-explores-rules-cracking-down-commercial-surveillance-lax-data-security-practices">https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-explores-rules-cracking-down-commercial-surveillance-lax-data-security-practices</a>.
\4\ See, e.g., Letter from Senator Ted Cruz, Ranking Member,
Committee on Commerce, Science, and Transportation, to Lina Khan,
Chairwoman, Fed. Trade Comm'n (Nov. 7, 2024) (cautioning that the
FTC should ``focus only on matters that are uncontroversial and
would be approved unanimously by all Commissioners''); Letter from
Representative Jim Jordan, Chairman, Committee on the Judiciary, to
Lina Khan, Chair, Fed. Trade Comm'n, at 1 (Nov. 14, 2024) (the ``FTC
should also cease all partisan activity''); Letter from
Representative Cathy McMorris Rodgers, Chair, Committee on Energy
and Commerce, to Lina Khan, Chair, Fed. Trade Comm'n (Nov. 6, 2024)
(``As a traditional part of the peaceful transfer of power, the FTC
should immediately stop work on any partisan or controversial item
under consideration . . . .'').
\5\ Accordingly, this case illustrates how leadership at the
Commission has vocally claimed to be acting on consumers' behalf
over the past several years, but then--where it has effectively
usurped the legislative branch--has actually harmed the Commission's
legitimacy and long-term ability to serve the American people.
---------------------------------------------------------------------------
With that larger context in mind, I will briefly describe some of
my concerns on the merits. According to the Complaint, Mobilewalla has
relied primarily on information it collected from real-time bidding
exchanges (RTB exchanges) to build its portfolio of consumers'
geolocation data.\6\ These exchanges facilitate advertisers' bids to
place content in front of specific consumers, whose information has
been sent to the exchange to enable the bidding.\7\ Mobilewalla would
retain information collected from RTB exchanges, including a consumer's
``precise geolocation information, if the consumer had location sharing
turned on,'' even if the bid were unsuccessful.\8\
---------------------------------------------------------------------------
\6\ See Compl. ]] 9-10.
\7\ Id.
\8\ Id. ]] 10, 33.
---------------------------------------------------------------------------
The Majority erroneously declares Mobilewalla's collection of
consumer information from the RTB exchanges is unfair. Specifically,
the Complaint alleges that the practice of collecting data was unfair
in part because it caused or is likely to cause substantial injury.\9\
But the Complaint's allegations are remarkably sparse when it comes to
establishing how the collection itself caused substantial injury, and
its related allegations do not otherwise satisfy what section 5
requires for unfairness.\10\ For the Majority, the mere collection of
data implausibly ``causes or is likely to cause'' substantial injury
and lacks countervailing benefits that section 5's cost-benefit
analysis requires assessing.\11\ Such a theory of unfairness--
assertions about a particular practice without facts alleged reflecting
causation of injury to consumers--is contrary to black-letter
unfairness law. Of course, none of these observations about the limits
of our unfairness authority mean Mobilewalla had clean hands under
contract law, where Mobilewalla's agreements with RTB exchanges barred
collection and retention of consumer data for unsuccessful bids.\12\
But--contrary to what those keeping score may conclude from this case
and settlement--a business-to-business breach of contract that may have
potential effects on consumers does not automatically give rise to an
unfairness claim under section 5.\13\
---------------------------------------------------------------------------
\9\ See id. ]] 70-71. The factual predicate appears to be that
if the data had never been collected in the first place, consumers
could never have been harmed later through its alleged misuse.
\10\ See id. ]] 7-16, 33-37.
\11\ See 15 U.S.C. 45(n).
\12\ Compl. ] 10.
\13\ Accordingly, the Commission should not seek to use a novel
section 5 theory to support what looks like a remedy for breach of
contract, as it does in Provision II of the Order. See Provision II
(``Prohibition on Collection and Retention of Covered Information
from Advertising Auctions'').
---------------------------------------------------------------------------
Count II, for ``Unfair Targeting Based on Sensitive
Characteristics,'' is also misguided. The practice this Count alleges
is unfair is the ``categorization of consumers based on sensitive
characteristics derived from location information.'' \14\ But there is
nothing intrinsically unfair about such categorization, on its own.
Instead, each unfairness claim needs to be assessed in a granular way
for both substantial injury and countervailing benefits.\15\ For
example, and contrary to any lop-sided framing of harms concerning
abortion:\16\
[[Page 97004]]
a mother considering her pregnancy may experience significant benefits
if data analysis and categorization mean she ultimately receives
tailored advertisements from crisis pregnancy centers offering prenatal
and postnatal care for her and her child.\17\ And a significant benefit
would accrue to the unborn child: her survival.\18\ Put simply,
categorization does not automatically violate section 5. But today's
case sends the opposite message.\19\
---------------------------------------------------------------------------
\14\ Compl. ] 69 (emphasis added).
\15\ See, e.g., Concurring Statement, In re Gravy Analytics,
supra note 1, at 6 (``We should not conflate our concern about
deceptive advertising (the bogus treatment) with the lawful act of
categorizing and targeting based on sensitive data, lest we
undermine the ability to connect women with life-saving care.''
(emphasis added)). To the extent there is harm here, it could of
course stem from wrongful disclosure of certain information in
certain circumstances--for example, disclosure of location to
government agencies circumventing Fourth Amendment protections. But
the mere categorization of consumers does not necessarily violate
section 5, and it may have significant countervailing benefits.
\16\ Cf. Compl. ]] 56-57; see also Compl., In re Gravy
Analytics, ]] 67-68 (similar allegations); Compl., Fed. Trade Comm'n
v. Kochava, Inc., 2:22-cv-00377, ]] 107-08 (D. Idaho, July 15,
2024), ECF No. 86 (similar allegations).
\17\ See Concurring Statement, In re Gravy Analytics, supra note
1, at 6 (``We also need to disentangle any objections to the content
of an advertisement from the practices of categorization and
targeting generally.'').
\18\ This example illustrates the fraught nature of the
Commission determining on its own--without Congressional
authorization--what advertising content is harmful, discriminatory,
and so on. Absent clear statutory authority, Commission enforcement
on such matters becomes a tool driven by preferences of unelected
officials.
\19\ Compl. ] 69 (alleging ``categorization of consumers based
on sensitive characteristics for marketing and other purposes is an
unfair act or practice'').
---------------------------------------------------------------------------
Count V, for ``Unfair Retention of Consumer Location Information,''
also falls short of what Section 5 requires. The Complaint alleges that
Mobilewalla ``indefinitely retains detailed, sensitive information
about consumers' movements, including consumers' location
information.'' \20\ But there is minimal analysis as to how the
practice of indefinite retention lacks potential countervailing
benefits.\21\ For example, as the Complaint makes clear, Mobilewalla
facilitates advertising and data analytics.\22\ To the extent
Mobilewalla's information enables building and optimizing predictive
models, or better tailoring advertisements over time to particular
consumers, it seems likely Mobilewalla's indefinite retention of data
may mean consumers correspondingly experience higher benefits. We will
never know whether the practice has net benefits or not, since the
Majority simply ignores that step and summarily condemns the practice.
---------------------------------------------------------------------------
\20\ Id. ] 74.
\21\ We should be considering such potential benefits, however.
Cf. Melissa Holyoak, Remarks at National Advertising Division, A
Path Forward on Privacy, Advertising, and AI, at 6-7, 9 (Sept. 17,
2024), <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/Holyoak-NAD-Speech-09-17-2024.pdf">https://www.ftc.gov/system/files/ftc_gov/pdf/Holyoak-NAD-Speech-09-17-2024.pdf</a>.
\22\ Compl. ] 19.
---------------------------------------------------------------------------
A final point today, about how my approach in this case relates to
my support for Kochava, where I concurred in filing a second amended
complaint. It is one thing to use our unfairness authority to directly
address specific acts or practices of ``disclos[ure]'' or ``the
revelation of sensitive locations implicating political, medical, and
religious activities,'' where there is an appropriate ``focus[ ] on
sales of precise geolocation data and related sensitive information,''
\23\ and where there has been a lack of consumer consent.\24\ The facts
pled in Kochava relating to disclosure and sale in that case led me to
believe that the particular ``act or practice'' of selling precise
geolocation data had a direct connection--caused or was likely to
cause--substantial injury to consumers.\25\
---------------------------------------------------------------------------
\23\ See Concurring Statement, Kochava, supra note 1, at 2-3.
\24\ Id. at 3.
\25\ See 15 U.S.C. 45(n); see also Compl., Fed. Trade Comm'n v.
Kochava, Inc., supra note 16, ] 132 (bringing a single count for
``Unfair Use and Sale of Sensitive Data,'' and alleging that
Defendants ``used and disclosed data'' from consumers (emphasis
added)). The framing of Kochava's unfairness count resembles the
framing of the first count in this Complaint against Mobilewalla,
for ``unfair sale of sensitive location information,'' related to
how Mobilewalla ``sells, licenses, or otherwise transfers precise
location information . . . that reveal[s] consumers' visits to
sensitive locations.'' See Compl. ]] 66-67. But this Complaint's
misguided use of the Commission's unfairness authority goes well
beyond Kochava's sole count.
---------------------------------------------------------------------------
In contrast, and in focusing on other types of acts or practices--
such as the relevant data's collection, its use for categorization, or
its indefinite retention--that are analytically removed from and did
not themselves necessarily cause any alleged injury based on the facts
pled, today's complaint fails to show how these acts or practices
themselves satisfy what section 5 requires.\26\ On their own, the
categorization, collection, or indefinite retention could certainly be
factual predicates that precede substantial injury. But, at least as
pled in this case, such practices themselves lack the causal connection
to substantial injury. And, stepping back, there are certainly
innocuous or beneficial instances of related data collection, its
categorization, and its indefinite retention. Thus, this case's
theories go far beyond the rationale that led me to support amending
the complaint in Kochava.\27\ In fact, the claims in this case seem
designed to lead directly to minimizing access to data, limiting the
practice of drawing inferences from it, and setting particular
boundaries around data retention. This case's regulatory implications
are therefore far broader than those in Kochava.
---------------------------------------------------------------------------
\26\ See 15 U.S.C. 45(n).
\27\ Again, I ``support[ed filing the second amended complaint
in Kochava] . . . because I agree[d] that the complaint adequately
alleg[d] a likelihood of substantial injury in the revelation of
sensitive locations implicating political, medical, and religious
activities'' Concurring Statement, Kochava, supra note 1, at 2.
---------------------------------------------------------------------------
Privacy is a vital policy topic. But unless and until the
Commission receives new authorities, we must follow the law as Congress
actually wrote it, not as some Commissioners or the Bureau Director
might amend it if they were elected legislators.\28\ Robust enforcement
consistent with our statutory authorities can have salutary deterrent
effects. But robust enforcement that is inconsistent with our statutory
authorities can also have profound ramifications on how markets
function, and how market actors proceed--including in ways that harm
the American people. And it can undermine our legitimacy in the eyes of
not just Congress, but the public.\29\ Privacy's tradeoffs should be
resolved by Congress, not unelected Commissioners. I do not believe
section 5, as drafted, authorizes us to act as a roving legislator,
writing law through complaints and settlement orders drafted to suit
our purposes or political expediency. I dissent.
---------------------------------------------------------------------------
\28\ See Concurring Statement, In re Gravy Analytics, supra note
1, at 6 (``As we consider these type of difficult privacy questions
in the future, it is of paramount importance that we challenge only
unfair or deceptive conduct, supported by specific facts and
empirical research, rather than demonizing the entire digital
advertising industry. And until Congress acts to address privacy
directly through legislation, it is vital we recognize and abide by
the limited remit of the Commission's statutory authority.'').
\29\ It is no coincidence that the number of constitutional
challenges questioning our legitimacy has correlated with the
Chair's general dismissal of the Commission's basic norms and
integrity. See, e.g., Justin Wise, FTC's Targets Take Cues From High
Court in Tests of Agency Power, Bloomberg Law (Sept. 26, 2024),
<a href="https://news.bloomberglaw.com/antitrust/ftcs-targets-take-cues-from-high-court-in-tests-of-agency-power">https://news.bloomberglaw.com/antitrust/ftcs-targets-take-cues-from-high-court-in-tests-of-agency-power</a>.
[FR Doc. 2024-28745 Filed 12-5-24; 8:45 am]
BILLING CODE 6750-01-P
</pre></body>
</html>Indexed from Federal Register on December 6, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.