WP: Flashlight app kept users in the dark about sharing location data: FTC

http://www.washingtonpost.com/business/technology/flashlight-app-kept-users-in-the-dark-about-sharing-location-data-ftc/2013/12/05/1be26fa6-5dc7-11e3-be07-006c776266ed_story.html

Flashlight app kept users in the dark about sharing location data: FTC

By Cecilia Kang

December 5, 2013

Up to 100 million users downloaded a popular Android app that turned their phones into flashlights. What they didn't realize was that their smartphones also became sophisticated tracking devices, with the app collecting information that could pinpoint their precise location.

The Federal Trade Commission on Thursday issued its first enforcement action related to location-based technology, reaching a settlement with the maker of Brightest Flashlight Free [1] for allegedly hiding the fact that it sold information about the location of its users and the unique string of numbers assigned to a device.

The free flashlight app deceived users by indicating that the data would be used only for internal purposes, the FTC said. It also gave users the fake option to refuse location tracking, collecting and sharing the data with third parties regardless of a consumer's choice, according to the agency.

The FTC's action highlights growing worries among regulators and lawmakers about the rampant collection of data on Internet users [2] with little explanation of how that information is being used for targeted advertising. The explosion of mobile technology poses particular concern, as Web users are constantly attached to devices that communicate with satellites, cell towers and WiFi networks that can pinpoint location.

"This whole area has been a concern of ours because there is a proliferation of apps and still a lot of work to do to protect privacy," said Jessica Rich, head of the FTC's consumer protection bureau. In a December 2012 report on kids' privacy, FTC investigators found that 60 percent of children's-oriented apps it surveyed had shared location information, device IDs and phone numbers with third parties but didn't adequately disclose those practices.

Location data allow marketers to create even more detailed profiles of users and serve them promotions for products in real time.

"The blending of data sounds like a futuristic thing, but it's really starting to happen, and the amount of data being created from smartphones makes it even easier," said Nicole Ozer, the technology and civil liberties director at the ACLU office in San Francisco. "These are mainly free apps but are costing people when it comes to their personal and sensitive information."

With location data and device IDs, an advertising company can stitch together information about a user across several apps, experts say. That would enable a marketer to follow a user who buys movie tickets for an Arlington theater on Fandango, makes an Open Table restaurant reservation at McPherson Square and likes the Facebook pages of Nutella and L.L. Bean.

That information can then be used by Starbucks or Macy's, for example, to sell coupons for stores that user will likely pass on their daily commute.

"These are the keys to the kingdom that enable you to create rich profiles on users," Rich said.

The FTC said its settlement with Goldenshores Technologies, the developer of Brightest Flashlight Free, requires the firm to rewrite its privacy policy to fully disclose that it shares geo-location and device ID data with third parties, including advertising networks. Goldenshores Technologies also agreed to delete the personal information it has collected about its users, the FTC said.

The company, based in Idaho, did not respond to an e-mailed request for comment.

Marketing firms say location-based advertising is in its infancy but will be a boon to online firms that have struggled to sell ads on mobile devices. Total online advertising revenues were $3 billion in the first six months of 2013, and mobile phone ads were less than 20 percent of that amount. Mobile advertising grew 145 percent in that period, however, and mobile ads that incorporate location information will make up a majority of ads by 2015, according to the Interactive Advertising Bureau, a trade group for online advertisers.

"We now have mobile ad networks that are exclusively location-based, and they are doing really interesting things like creating customer profiles that give richer information on traffic patterns in a given location. There's a lot of opportunity," said Sarah Hudgins, the IAB's director of public policy.

Over the past year, several bills have been introduced in Congress to curb location-based data collection. But some lawmakers are reluctant to damage the success of Silicon Valley and marketing firms, analysts say.

"Despite heightened privacy concerns these days, I doubt Congress will clamp down on location-based tracking. Republicans in particular aren't likely to support new regulation of a booming corner of the economy like online advertising," said Paul Gallant, an analyst at Guggenheim Securities.

Sen. Al Franken (D-Minn.), who introduced a location-based privacy bill last year, has criticized companies for making it too difficult to stop the practice.

In a letter to Palo Alto-based retail marketing firm Euclid, Franken criticized the company for its practice of collecting data on smartphone users who were connected to WiFi networks in stores without asking permission. The company, Franken said, collected data on about 50 million users walking near, through and around stores. Euclid allowed consumers to reject tracking on their phones, though they had to do so by going to the company's Web site.

"I fully support the action taken by the FTC today," Franken said. "I hope it encourages more companies to get users' permission before they share people's data location information with third parties."

[1] http://ftc.gov/opa/2013/12/goldenshores.shtm

[2] http://www.washingtonpost.com/blogs/the-switch/wp/2013/07/31/your-location-history-is-like-a-fingerprint-and-cops-can-get-it-without-a-warrant/