FTC’s location-data crackdown hits PIs

The FTC’s Jan 2024 order against Outlogic (X‑Mode) over selling precise location data without opt‑in makes me wonder how fast the door is closing on mobile-sourced geo intel for private cases. If more brokers get similar orders, what happens if this scales — are you revising vendor lists now or waiting to see where this goes next?

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍‌⁠‌⁠​​‌‍‍‌‌‍‍‍​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌‍⁠‍‌‍‌‌‌⁠‌⁠‌‌⁠⁠‌⁠‌​‌‍⁠⁠‌⁠​​‌‍‍‌‌‍​⁠​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​‍​‍‌‍⁠‍‌‍‌‌‌⁠‌⁠​‍​‍​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‌​⁠​‌​⁠​​​⁠​‌​⁠​⁠​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍‌⁠‌‌‌​⁠‍​⁠‌‍‌‍‌‌‌​​‌‌‍​‍​⁠​‍‌‌​⁠​⁠​‌​⁠​​‌​‍​​⁠‌⁠​⁠​‌‌​⁠‌​⁠‌​​‍⁠‌​‍​‍‌⁠⁠‌​

— after the Jan 2024 Outlogic/X‑Mode order, we froze all raw GPS buys and told vendors no deal without verifiable opt-in logs and a DPA. > geo intel for private cases. If more brokers get similar orders, what happens if Has anyone gotten a broker to surface consent provenance at the device level yet? Short answer: yes, revise now — shift to aggregated/obfuscated panels or venue-level footfall, and lean more on carrier records via legal process for critical work?

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍‌⁠‌⁠​​‌‍‍‌‌‍‍‍​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌⁠​‍‌‍‌‌‌⁠​​‌‍⁠​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​⁠‌​​⁠‌‍​⁠​​​⁠‍‌​⁠‌⁠​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‌​⁠​‌​⁠​​​⁠​‌​⁠‌⁠​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍‌‍‍‍‌​‌‍‌‍⁠‌‌‍​‌‌‍‌‍‌‍‍⁠‌⁠​‍‌​​‌‌‍‌​‌‌‌‌‌​‌​​⁠​⁠​⁠‌⁠‌‌‍‌‌‍⁠‍​⁠‌⁠​‍​‍‌⁠⁠‌​​

Post Jan 2024, requiring “opt-in logs,” SDK IDs, and 90‑day deletion; otherwise pause. https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-orders-data-broker-x-mode-outlogic-delete-sensitive-location-data Anyone auditing SDK chains?

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍‌⁠‌⁠​​‌‍‍‌‌‍‍‍​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌⁠​‍‌‍‌‌‌⁠​​‌‍⁠​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​⁠‌​​⁠‌‍​⁠​​​⁠‍‌​⁠‌⁠​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‌​⁠​‌​⁠​​​⁠​‌​⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍‌​​‌‌‌​‌‌​‍​‌‍‌⁠‌‍‌⁠‌‌‌​‌⁠‌‌‌‍⁠⁠​⁠‌⁠‌​​⁠‌‌‍‌‌​​‍‌⁠​‍‌⁠‌⁠‌​‌​‌​‌‍​‍​‍‌⁠⁠‌​​

We added a sensitive-locations prefilter on all mobile pings — anything touching clinics, shelters, schools, or houses of worship is auto-quarantined before it ever hits a case file, and we treat the rest as ‘lead-only’ until corroborated. That one change cut rework and keeps us away from the kinds of facts the FTC flagged in Kochava: https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3080-kochava-inc. @Marta, are you filtering upstream like this or relying on the broker’s screens?

‌⁠‍⁠​‍​‍‌⁠‌​​‍​‍​⁠‍‍​‍​‍‌‍‌⁠‌⁠​​‌‍‍‌‌‍‍‍​‍​‍​‍⁠​​‍​‍‌‍‍⁠​‍​‍​⁠‍‍​‍​‍‌⁠​‍‌‍‌‌‌⁠​​‌‍⁠​‌⁠‍‌​‍​‍​‍⁠​​‍​‍‌‍‍‌‌‍‌​​‍​‍​⁠‍‍​⁠‌​​⁠‌‍​⁠​​​⁠‍‌​⁠‌⁠​‍⁠​​‍​‍‌‍‌​​‍​‍​⁠‍‍​‍​‍​⁠​‍​⁠​​​⁠​‍​⁠‌‌​⁠​‌​⁠​​​⁠​‍​⁠​‌​‍​‍​‍⁠​​‍​‍‌‍‍​​‍​‍​⁠‍‍​‍​‍​⁠‌⁠‌​‌⁠‌‌‍‍‌​​‍‌‍​‌‌​⁠​‌‍⁠⁠‌‌​⁠‌‌⁠⁠‌⁠​‌‌‌​​​⁠‌‍‌​‌‍‌‌‌⁠‌​⁠‌​⁠‌​​‍​‍‌⁠⁠‌​​