FTC Issues First-Ever Orders Restricting Data Broker Industry
By Alvin Zhang
Earlier this month, the FTC issued its first-ever bans on the sales of sensitive user data by data broker companies.[1] In orders issued on January 9 and 18, the agency barred digital marketing companies OutLogic (formerly known as X-Model Social) and InMarket Media from sharing, selling, or transferring their users’ sensitive location data.[2]
The FTC’s recent actions highlight a growing concern over the use of personal data in advertising.[3] Prior to the bans, OutLogic and InMarket were using their users’ location data to map them into demographic categories—for example, “low-income millennials,” “blue-collar workers,” or “well-off suburban moms”—which were then used for creating targeted ads.[4] In barring the two companies from using this information without consent, the FTC noted that precise location data could reveal sensitive details about a user’s life, such as whether they visited a domestic abuse center or reproductive health clinic, or whether they were a member of a place of worship.[5] The FTC’s orders also signal its stance against the use of all-inclusive consent forms for obtaining user data. In a statement issued following the order against OutLogic, FTC Chair Lina Kahn stated, “With this action, the Commission rejects the [widespread] premise . . . that vaguely worded disclosures can give a company free license to use or sell people’s sensitive location data.”[6]
The FTC’s recent orders may be a sign of more regulations to come, given the rapidly increasing use of personal data in advertising. Companies like Oracle, Equifax, and FICO dominate the emerging data broker industry, and researchers estimate that the industry—valued at around $300 billion in 2021—could surpass $500 billion by 2028.[7] As privacy concerns will continue to create tensions between consumers, corporations, and regulators, the rules and frameworks governing these relationships may become increasingly critical in the future.[8]
Alvin Zhang is a 2L at Vanderbilt Law School.
[1] FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data, FTC (Jan. 9, 2024), https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data; Jeffery Burt, InMarket is Second Data Broker to Settle with FTC This Month, Security Boulevard (Jan. 22, 2024), https://securityboulevard.com/2024/01/inmarket-is-second-data-broker-to-settle-with-ftc-this-month/.
[2] Cristiano Lima-Strong, Regulators Crack Down on Company Selling Detailed Location Data, Wash. Post (Jan. 18, 2024), https://www.washingtonpost.com/technology/2024/01/18/ftc-location-data-privacy/.
[3] See id.
[4] Lesley Fair, How “Location, Location, Location” Can Lead To “Enforcement, Enforcement, Enforcement”, FTC Business Blog (Jan. 18, 2024), https://www.ftc.gov/business-guidance/blog/2024/01/how-location-location-location-can-lead-enforcement-enforcement-enforcement.
[5] Jeffery Burt, FTC Issues Its First-Ever Order Against a Data Broker, Security Boulevard (Jan. 11, 2024), https://securityboulevard.com/2024/01/ftc-issues-its-first-ever-order-against-a-data-broker/.
[6] See Statement of Chair Lina M. Khan, In the Matter of X-Mode Social, Inc. and Outlogic, LLC (Jan. 9, 2024), https://www.ftc.gov/system/files/ftc_gov/pdf/StatementofChairLinaM.KhanandRKSandAB-final_0.pdf.
[7] Global Data Broker Market Size, Share, Opportunities, COVID-19 Impact, And Trends By Data Type (Consumer Data, Business Data), By End-User (BFSI, Retail, Automotive, Construction, Others), And By Geography – Forecasts From 2023 To 2028, Knowledge Sourcing Intelligence (June 2023), https://www.knowledge-sourcing.com/report/global-data-broker-market.
[8] Sara Quach et al., Digital Technologies: Tensions in Privacy and Data, J. of the Acad. Mark. Sci. 50, 1299-1300 (2022) (talking about how tensions between consumers, firms, and regulators will demand more complex regulatory frameworks in the future).