FTC Lends Support to Federal Geolocation Data Bill

The Location Privacy Protection Act

The FTC testimony was part of a hearing to discuss “The Location Privacy Protection Act of 2014” (LPPA) which was introduced in March by Sen. Al Franken (D-MN). The LPPA would prohibit businesses from knowingly collecting geolocation information from mobile devices without obtaining the consent of the individual that is using the mobile device. Additionally, under the LPPA, consent must be “affirmative express consent after receiving clear, prominent, and accurate notice” that (a) informs the individual that his or her geolocation information will be collected; (b) identifies the other entities with whom the geolocation information may be shared; and (c) provides the individual a link to additional disclosures about the company’s data practices, including information about opting-out.

The LPPA would also require businesses that collect geolocation information from more than 1,000 devices a year to maintain a website that discloses (a) the type of information the business collects from mobile devices; (b) the purposes for which it collects, uses, and discloses the information; (c) any entities with which it shares the information; and (d) how an individual may electronically revoke their consent.

Notably, the LPPA would also create a private right of action, allowing individuals to sue companies that violate the law. Violators could be liable for up to $1,000,000 per violation.

The FTC’s Stance

In her testimony before the Senate Judiciary, the FTC’s Director of the Bureau of Consumer Protection emphasized that the Commission considers geolocation data to be sensitive personal information and noted that the Commission has taken action under its existing legal authorities — notably Section 5 of the FTC Act — against companies that misrepresent their data collection or use practices. In the testimony, the FTC noted that it supports the goals of the LPPA, particularly improving the transparency of geolocation services and providing consumers with greater control over their information.

So What?

Passage of the LPPA could have a major impact on the way companies collect and use geolocation information. Under existing law, businesses are prohibited from misrepresenting their data collection practices. Thus, a business cannot claim in its privacy policy that it does not collect or share consumers’ geolocation information if it is, in fact, doing so. Federal law, however, does not currently require companies to disclose whether or not they collect geolocation data. Although businesses are already required to disclose if they collect certain geolocation data from children under the age of 13, the LPPA would be among the first federal laws to require businesses to obtain express consent before collecting geolocation data from the general public. Businesses would also be likely to see a new round of civil lawsuits targeting their collection and use of geolocation data.

The LPPA is pending a vote in the Senate Judiciary Committee. Arent Fox will continue to monitor the LPPA and similar legislation and provide updates as soon as they become available.