FTC wins first settlement banning sale of location data

The US Federal Trade Commission has secured its first data broker settlement agreement, prohibiting X-Mode Social from sharing or selling sensitive location data.

In its complaint, the FTC accused X-Mode, which sold its assets to successor firm Outlogic in 2021, of selling raw non-anonymized location data collected through its own apps and an SDK for embedding in third-party applications.

The X-Mode SDK has been found in hundreds of apps downloaded billions of times on both Apple and Android devices.

"By securing a first-ever ban on the use and sale of sensitive location data, the FTC is continuing its critical work to protect Americans from intrusive data brokers and unchecked corporate surveillance," chair Lina Khan said of the settlement.

According to the FTC complaint [PDF], X-Mode/Outlogic has for years collected and sold data associated with mobile advertising IDs, which can easily be matched to an individual mobile device to figure out what locations an individual has visited.

If that sounds familiar, it's the same allegations the FTC leveled against data broker Kochava when it filed a complaint against that company in 2022.

According to the FTC's complaints against Kochava and Outlogic, data collected and sold by the companies could easily be used to link individuals to places of worship, homeless and domestic violence shelters, addiction facilities, reproductive health clinics, and other sensitive locations.

The threat of data misuse by governments and individuals since the overturning of Roe vs Wade has made the collection of this data type an even more pressing issue to address.

Per the settlement [PDF], Outlogic will be required to delete all data it has previously collected, and requires the company to honor opt-out requests. The FTC said the company had not previously asked users for consent to have their location data collected.

Additionally, Outlogic will be required to maintain a list of sensitive locations for which it won't gather data, and must implement procedures to ensure buyers of its location data can't associate what they've purchased with sensitive locations.

"The FTC's action against X-Mode makes clear that businesses do not have free license to market and sell Americans' sensitive location data," Khan said.