The US Federal Trade Commission has banned data broker X-Mode Social from sharing or selling users’ sensitive location data, the federal regulator said Tuesday.
The first settlement of its kind prohibits X-Mode, now known as Outlogic, from sharing and selling sensitive user information to others. The settlement will also require the data broker to delete or destroy all location data it previously collected, along with any products generated from that data, unless the company obtains the consumer’s consent or ensures the data is declassified.
X-Mode buys and sells access to location data collected by common phone apps. While just one of many organizations in the multi-billion dollar data broker industry, X-Mode has faced scrutiny for selling access to commercial location data of the previous movements of the Americans towards the American government and military contractors.
Soon after, Apple and Google told developers to do so remove X-Mode from their apps or face ban from app stores.
The FTC alleged that X-Mode sold precise location data that could be used to track people’s visits to sensitive locations, such as medical and reproductive health clinics, places of religious worship, and domestic abuse shelters.
The regulator also alleged that the data broker failed to remove sensitive locations from the raw location data it sold to third parties and did not implement “reasonable or appropriate safeguards” against the subsequent use of that precise location data. For at least one of its contracts, the FTC said X-Mode provided an unnamed private clinical research company with information about consumers who had visited certain medical facilities, pharmacies or specialty injection centers in a geographic area in Columbus, Ohio.
X-Mode also failed to ensure that users of its own apps — Drunk Mode and Walk Against Humanity — were fully informed about how their precise location data would be used, the FTC said.
“The information disclosed through the location data that X-Mode/Outlogic sold not only violated consumers’ privacy, but also exposed them to potential discrimination, physical violence, emotional distress and other harms,” the FTC said in a statement.
“Geolocation data can reveal not only where a person lives and with whom they spend time, but also, for example, what medical treatments they seek and where they worship,” said FTC Chairwoman Lina M. Khan. “The FTC’s action against X-Mode makes clear that businesses do not have a free pass to market and sell Americans’ sensitive location data.”
“By securing a first-ever ban on the use and sale of sensitive location data, the FTC continues its critical work to protect Americans from intrusive data brokers and unchecked corporate surveillance,” Khan said.
According to the FTC order, X-Mode must also implement procedures to ensure that recipients of its location data do not associate the data with sites that provide services to LGBTQIA+ individuals, provide a simple way for consumers to withdraw their consent to collect and use their location data and to establish and implement a comprehensive privacy program that protects the privacy of consumers’ personal information.
A statement provided to TechCrunch by PR firm Broadsheet, which represents Outlogic, reads: “We disagree with the implications of the FTC’s press release. After a lengthy investigation, the FTC found no instance of misuse of any data and made no such allegations. Since its inception, X-Mode has imposed strict contractual terms on all data clients, prohibiting them from associating its data with sensitive locations such as healthcare facilities. Compliance with the FTC’s new policy will be ensured by implementing additional technical procedures and will not require significant business or product changes.”
Senator Ron Wyden, whose office first revealed that X-Mode had sold location data to US military contractors, said in response to the FTC’s findings: “I commend the FTC for taking tough action to hold this broker shadowy location data provider responsible for selling Americans’ location data.”
Updated with feedback from Outlogic and Ron Wyden’s office.
