The Singapore-based mobile ad company InMobi will pay $950,000 in civil penalties and implement a comprehensive privacy program to settle Federal Trade Commission ("FTC") charges, according to which it deceptively tracked the locations of hundreds of millions of consumers, including children, without their knowledge or consent in order to serve them geo-targeted ads.
The FTC alleged that InMobi undermined phone users' ability to make informed decisions regarding the collection of their location information. Although the company claimed that its software collected geographical locations only when end-users provided opt-in consent, the software actually used nearby Wi-Fi signals to identify locations when permission was not given. InMobi then archived the location information and used it to send targeted advertisements to individual phone users.
In its complaint, the FTC also alleged that InMobi violated the Children’s Online Privacy Protection Act (“COPPA”) by knowingly collecting personal information from thousands of child-directed apps in order to track children’s locations and serve them with interest-based advertising. According to the complaint, this tracking occurred notwithstanding the company's promise not to do so without sending the parents notification or receiving their consent.
Under terms of the settlement, InMobi is subject to a $4 million civil penalty, which is suspended to $950,000 based on the company’s current financial situation. In addition, the company will be required to delete all information it collected from children, and will be prohibited from other violations of COPPA. Additionally, the company will be prohibited from collecting consumers’ location information without their affirmative express consent for it to be collected, and will be required to respect consumers’ location privacy settings. The company will also be required to delete the location information of consumers it gathered without their consent and will be prohibited from further distorting its privacy practices. In addition, the settlement requires InMobi to establish a comprehensive privacy program that will be independently audited every two years for the next 20 years.
This case emphasizes the wide regulatory reach of the FTC's enforcement measures to non-US companies. It also demonstrates the expansion of FTC's enforcement policy - which has been focused so far on user facing software and services - to cover intermediary players such as ad networks.