Geolocation is the process or technique of identifying the physical location of a person using digital information. Geolocation allows for targeted advertisements as well as the ability to mirror a user's real location in a virtual or augmented world. Mobile apps, advertisers, and game developers are increasingly realizing the benefits of geolocation. Users are enjoying it. Even if you are not using geolocation, your monetization partners may require you to provide that data. Here are certain fundamentals that you should pay attention to.
What is geolocation?
As we mentioned, geolocation is data about a user's physical location. It is also sensitive personal information, according to the FTC—geolocation data can reveal core personal facts, such as whether you visited an AIDS clinic, where you worship, or whether you visited an employer for a job interview. Prepared Statement of the Federal Trade Commission on S.2171, the Location Privacy Protection Act of 2014 (June 4, 2014) (last visited 1/25/17).
Why should you pay attention to geolocation issues?
Many companies are using geolocation or sharing geolocation data with partners or other stakeholders. The FTC's position on geolocation data foreshadowed a complaint it filed last year against InMobi, the maker of an advertising platform for mobile app developers and advertisers. In its complaint, the FTC alleged that InMobi collected geolocation data from consumers in two ways. First, InMobi collected data through Android and iOS permissions (through which consumers could restrict access). InMobi disclosed this practice to users, and the FTC took no issue. Second, however, the FTC alleged that InMobi collected geolocation data using WiFi, regardless of consumers' location settings. The FTC alleged that this second practice—undisclosed to consumers—constituted a deceptive act or practice because consumers thought they could opt out.
The FTC also faulted InMobi for collecting geolocation data about children. The FTC argued that geolocation data was protected under the Children's Online Privacy Protection Act (COPPA) and subject to its requirements. Thus, the FTC contended that InMobi had to clearly, completely, and accurately disclose its collection and use practices, provide parents with a direct notice of its practices prior to collection and use, and obtain verifiable consent before collection and use. The FTC argued that InMobi violated COPPA by not doing so.
Ultimately, the FTC and InMobi resolved the case with a consent decree.
What do you really need to know?
Following the InMobi case and FTC's statements about geolocation, there are certain key takeaways to consider:
- Geolocation data is personal information, even if it is limited to "information sufficient to identify street name and name of a city or town";
- "affirmative express consent" is required before collecting geolocation data via any means;
- Geolocation data is personal information under COPPA and—if the service is directed toward children (under 13 years of age) or shares information with a service directed toward children—requires strict compliance with COPPA's notice and consent requirements;
- controls on collecting geolocation data are not enough—they have to be reliable and regularly audited to ensure that they work.
For new entrants using geolocation, the message is clear: document disclosure of geolocation practices and establish a consent program with internal controls and audit functions. Moreover, because courts are increasingly requiring affirmative consent in the mobile apps (a subject you can read more about here), you should not rely on any sort of "browsewrap" or hidden terms to obtain that consent.
Also, if your content is directed toward children under 13 years of age or you exchange information with any online service providers directed toward children, then you need to comply with COPPA.
For established brands, as InMobi learned the hard way, the FTC may not accept your compliance programs without a history of testing demonstrating reliability.
What if only your revenue partner is using the geolocation data?
It does not matter. If you are providing the app and interfacing with the user, then you need be well versed in geolocation and make appropriate disclosures to your users up front.