The FTC says that InMarket also failed to ensure that third-party apps have obtained informed consent. In fact, the company failed to tell third party apps that the location data provided will be combined with other data to create profiles of consumers, according to the complaint.

The FTC also says that the company’s policy of retaining geolocation data for five years was unnecessary to carry out the purposes for which it was collected and increased the risk that this sensitive data could be disclosed, misused and linked back to the consumer, thereby exposing sensitive information about the consumer.

In addition to the ban on selling or licensing precise location data, the proposed order also requires InMarket to take several steps to strengthen protections for consumers. Under the proposed order, the company:

• Must delete or destroy all the location data it previously collected and any products produced from this data unless it obtains consumer consent or ensures the data has been deidentified or rendered non-sensitive.
• Must provide a simple and easy-to-find way for consumers to withdraw their consent for the collection and use of their location data for InMarket apps and a mechanism to request deletion of any location data that InMarket previously collected.
• Must notify consumers whose location data was collected through InMarket’s apps about the FTC’s action against the company and provide them with a way to opt out of data collection or request to delete their data.
• Will be limited from collecting or using location data from InMarket apps unless it obtains consumers’ informed consent to the collection of their location data.
• Will be required to create a sensitive location data program to prevent the company from using, selling, licensing, transferring or otherwise sharing any products or services that categorize or target consumers based on sensitive location data.
• Must develop an assessment program to ensure that companies that provide location data to InMarket are obtaining informed consent from consumers for the collection, use and sale of the data or must stop using such information.
• Establish and implement a comprehensive privacy program that protects the privacy of consumers’ personal information and also create a data retention schedule.