The Federal Trade Commission (FTC) has reached a settlement with data broker Mobilewalla, Inc., prohibiting the company from selling sensitive location data that could identify private residences or reveal visits to sensitive locations. This action comes after the FTC alleged that Mobilewalla sold such information without properly obtaining consumers’ consent. As part of the settlement, Mobilewalla is also barred from collecting consumer data through real-time advertising auctions for any purpose other than participating in those auctions. This is the first time the FTC has labeled this practice as an “unfair act or practice” under U.S. consumer protection laws.
FTC Chair Lina Khan emphasized the risks posed by data brokers’ tracking activities, stating, “Persistent tracking by data brokers can put millions of Americans at risk, exposing the precise locations where service members are stationed or which medical treatments someone is seeking. Mobilewalla exploited vulnerabilities in digital ad markets to harvest this data at a stunning scale. The FTC is cracking down on firms that unlawfully exploit people’s sensitive location data and ensuring that we protect Americans from unchecked surveillance.”The FTC alleges that from January 2018 to June 2020, Mobilewalla engaged in the following practices: Data Collection Without Consent: Mobilewalla harvested more than 500 million unique consumer advertising identifiers paired with precise location data. This data was sourced from real-time bidding exchanges and third-party aggregators—often without consumers’ knowledge. Inadequate Anonymization: The company allegedly failed to anonymize the raw location data it collected, meaning that individual consumers and their device movements could be identified. Misuse of Collected Data: Mobilewalla allegedly sold this raw location data to third parties, including advertisers, data brokers, and analytics firms. Profiling Consumers: The company used its location data to create “audience segments” for advertisers. For example, it tracked women who visited pregnancy centers and created ad-targeting segments focused on pregnant women. In one high-profile case, Mobilewalla generated a report on the racial demographics of protesters following the death of George Floyd in 2020. Failure to Verify Consent: The company failed to take reasonable steps to ensure that consumers consented to having their data collected, used, or shared.
According to Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, “Mobilewalla collected massive amounts of sensitive consumer data – including visits to health clinics and places of worship – and sold this data in a way that exposed consumers to harm. The FTC is acting today to stop these invasive practices and protect the public from always-on surveillance.”The FTC asserts that Mobilewalla’s actions exposed consumers to several risks, including privacy violations, discrimination, physical threats, and emotional distress. Privacy Violations: Consumers’ private activities, such as visits to health clinics and places of worship, were exposed to data buyers. Discrimination: Location-based targeting could enable advertisers to discriminate based on factors like race, health status, and religious affiliation. Physical Threats: Data on military base visits and other sensitive locations could expose consumers, including service members, to physical threats. Emotional Distress: Consumers had no reasonable way to avoid being tracked since they were unaware their data was being collected and sold.
The FTC’s proposed settlement includes strict measures to prevent future violations. Key provisions include: Ban on Data Sales: Mobilewalla is prohibited from selling or sharing sensitive location data related to health clinics, religious sites, LGBTQ+ spaces, labor union offices, political gatherings, correctional facilities, and military installations. Restrictions on Auction Data Use: The company can no longer collect or store data obtained through ad auctions for purposes unrelated to the auction itself. Data Deletion Requirements: Mobilewalla must implement a mechanism for consumers to request the deletion of their location data. Additionally, the company must delete older, sensitive data it has already collected. Mandatory Privacy Program: Mobilewalla is required to establish and maintain a comprehensive privacy program. This program will include routine audits and employee training to protect consumers’ personal information. Supplier Accountability Program: The company must establish a supplier assessment program to ensure it only works with partners that obtain consumer consent for data collection and use. Consumer Disclosures: Mobilewalla must provide consumers with a clear way to withdraw consent for data collection and ensure that their data is deleted upon request.The FTC’s enforcement action against Mobilewalla is part of a broader effort to curb unlawful data collection and tracking practices. Similar actions include lawsuits and settlements with data brokers like Kochava, which allegedly sold tracking data for people visiting reproductive health clinics, and X-Mode, which sold raw location data. This case is notable for being the first time the FTC classified the collection of ad-auction data for non-auction purposes as an “unfair practice.”
The proposed consent agreement will be published in the Federal Register, and the public will have 30 days to submit comments before the FTC decides whether to make the order final. If finalized, the order will have the force of law, and any violation could result in a civil penalty of up to $51,744 per violation. The FTC voted 4-1 in favor of the administrative complaint and the proposed settlement. Chair Lina Khan, Commissioner Alvaro Bedoya, and Commissioner Rebecca Kelly Slaughter supported the settlement, while Commissioner Melissa Holyoak dissented. Commissioner Andrew Ferguson issued a statement that both concurred with and dissented from certain parts of the proposal.
If you’re ready to take control of your data and protect your privacy, check out the Breadcrumbs app. Download it today at breadcrumbsdata.com and start securing your digital footprint.