December 23, 2013
The Federal Trade Commission (FTC) recently reached a settlement agreement with Goldenshores Technologies LLC regarding its “Brightest Flashlight Free” app, one of the most popular apps available. The settlement addressed claims that the app deceived consumers with respect to the collection and use of their geo-location information. This case highlights the growing significance of privacy concerns associated with geographic location information of consumers.
The app in dispute was available free to Android operating systems users. When downloaded, the app enabled use of the host device as a flashlight. This convenient capability made the app highly popular, downloaded by millions of individual users.
According to the FTC, the app collected geographic location information and made that information available to third parties. Among the parties accessing the information were advertising networks. Those networks were able to use the geo-location information to target advertising.
The settlement agreement requires that the privacy policies associated with the app be significantly modified. Those modifications include actions to ensure that there are no misrepresentations regarding the ways in which personal information, including geo-location information, is collected, used, and shared. The FTC requires that the privacy statement be clear and accurate regarding the extent of actual control that individual consumers are able to exercise over their personal information.
The FTC is also requiring remedial action as to information already collected from consumers through the app. The settlement requires that all personal information that has already been collected by the app must now be deleted.
This settlement provides several important lessons. The first is that geographic location information is included among personal information that receives protection from unauthorized collection, use, and sharing.
Another important lesson is that many communications and information technology devices, systems, and networks incorporate automatic data collection, storage, and sharing operations. It is vital to understand the extent to which the equipment, software, and systems used by your organization automatically collect personal data. In this case, the FTC has indicated that you and your organization will be held accountable for the automated data collection and sharing activities of your devices, networks, and systems.
Finally, this case illustrates that statements and practices that lead consumers to believe that they have more control over their personal information than they really do can constitute deceptive trade practices. The FTC has put us all on notice that it expects the information privacy policies and statements presented to consumers to provide clear and accurate representations of the actual practices and procedures applied to consumer information.