InMobi, a Singapore-based mobile advertising company, will pay almost $1 million in civil penalties and implement a comprehensive privacy program to settle charges that the company violated the Federal Trade Commission Act and the Children's Online Privacy Protection Act by deceptively tracking the locations of hundreds of millions of consumers, including children, to serve them geo-targeted advertising.
Although InMobi said its ad software only tracked consumers when they affirmatively opted in, as stated in its privacy settings, it actually tracked consumer locations whether or not the consumer provided permission—and even when consumers denied permission to access their location information, the agency alleged.
The problem played out on more than 1 billion devices worldwide, the FTC added, via multiple forms of location-based advertising. Combining the information collected from consumers with the wireless networks they were near, InMobi created a database that the company then used to infer the physical location of consumers even when they turned off the location collection on their device, some of whom were children.
It therefore violated COPPA's requirement that parental consent must be obtained prior to collecting and using a child's personally identifiable information, which includes geolocation data, the agency said.
"InMobi tracked the locations of hundreds of millions of consumers, including children, without their consent, in many cases totally ignoring consumers' express privacy preferences," Jessica Rich, Director of the FTC's Bureau of Consumer Protection, said in a press release about the case. "This settlement ensures that InMobi will honor consumers' privacy choices in the future, and will be held accountable for keeping their privacy promises."
To settle the case, InMobi agreed to pay $950,000 (of a $4 million partially suspended civil penalty) and make changes to its practices, including implementing a comprehensive privacy program (with independent audits every two years for the next 20 years).
The company will be prohibited from collecting consumer location information without affirmative, express consent and must honor consumers' location privacy settings. Location information of consumers collected without their consent, as well as all the information collected from children, must be deleted. Future misrepresentations about privacy practices as well as future violations of COPPA are prohibited.
To read the complaint and stipulated order in U.S. v. InMobi Pte Ltd., click here.
Why it matters: While the agency typically focuses on misleading claims made to consumers, the FTC filed suit against InMobi based on deceptive statements made to other businesses where the misrepresentations actually impacted consumers. "As a result, application developers could not provide accurate information to consumers regarding their applications' privacy practices," according to the FTC's complaint, its first action against the operator of a mobile ad network.
