InMarket Media LLC; Analysis of Proposed Consent Order To Aid Public Comment, 4301-4304 [2024-01269]

Download as PDF Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices FEDERAL FINANCIAL INSTITUTIONS EXAMINATION COUNCIL The ASC convened a Special Closed Meeting to discuss a personnel matter. No action was taken by the ASC. FEDERAL TRADE COMMISSION [Docket No. AS24–02] James R. Park, Executive Director. [FR Doc. 2024–01259 Filed 1–22–24; 8:45 am] InMarket Media LLC; Analysis of Proposed Consent Order To Aid Public Comment BILLING CODE 6700–01–P AGENCY: Appraisal Subcommittee Notice of Meeting Appraisal Subcommittee of the Federal Financial Institutions Examination Council. AGENCY: ACTION: Notice of special meeting. In accordance with Section 1104(b) of Title XI of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, as amended, notice is hereby given that the Appraisal Subcommittee (ASC) met for a Special Meeting on this date. Location: Virtual meeting via Webex. Date: January 17, 2024. Time: 10:38 a.m. ET. SUMMARY: Action and Discussion Items ASC Grants Handbook (revised) ASC Fiscal Year 2024 Notice of Funding Availability (State Grant) The ASC convened a Special Meeting to vote on the above-referenced items. The vote for each item passed 7–0. James R. Park, Executive Director. [FR Doc. 2024–01260 Filed 1–22–24; 8:45 am] BILLING CODE 6700–01–P FEDERAL FINANCIAL INSTITUTIONS EXAMINATION COUNCIL [Docket No. AS24–03] Appraisal Subcommittee Notice of Meeting Appraisal Subcommittee of the Federal Financial Institutions Examination Council. AGENCY: Notice of special closed meeting. ACTION: In accordance with section 1104(b) of title XI of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, as amended, notice is hereby given that the Appraisal Subcommittee (ASC) met for a Special Closed Meeting on this date. Location: Virtual meeting via Webex. Date: January 17, 2024. Time: 10:45 a.m. ET. SUMMARY: khammond on DSKJM1Z7X2PROD with NOTICES 4301 Action and Discussion Item VerDate Sep<11>2014 17:41 Jan 22, 2024 FEDERAL RESERVE SYSTEM The consent agreement in this matter settles alleged violations of federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the complaint and the terms of the consent order—embodied in the consent agreement—that would settle these allegations. DATES: Comments must be received on or before February 22, 2024. ADDRESSES: Interested parties may file comments online or on paper by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Please write ‘‘InMarket Media LLC; File No. 202 3088’’ on your comment and file your comment online at https://www.regulations.gov by following the instructions on the webbased form. If you prefer to file your comment on paper, please mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H–144 (Annex M), Washington, DC 20580. FOR FURTHER INFORMATION CONTACT: Gorana Neskovic (202–326–2322), Attorney, Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Ave. NW, Washington, DC 20580. SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule § 2.34, 16 CFR 2.34, notice is hereby given that the above-captioned consent agreement containing a consent order to cease and desist, having been filed with and accepted, subject to final approval, by the Commission, has been placed on the public record for a period of 30 days. The following Analysis to Aid Public Comment describes the terms of the consent agreement and the allegations in the complaint. An electronic copy of the full text of the consent agreement package can be obtained at https://www.ftc.gov/newsevents/commission-actions. You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or SUMMARY: Change in Bank Control Notices; Acquisitions of Shares of a Bank or Bank Holding Company The notificants listed below have applied under the Change in Bank Control Act (Act) (12 U.S.C. 1817(j)) and § 225.41 of the Board’s Regulation Y (12 CFR 225.41) to acquire shares of a bank or bank holding company. The factors that are considered in acting on the applications are set forth in paragraph 7 of the Act (12 U.S.C. 1817(j)(7)). The public portions of the applications listed below, as well as other related filings required by the Board, if any, are available for immediate inspection at the Federal Reserve Bank(s) indicated below and at the offices of the Board of Governors. This information may also be obtained on an expedited basis, upon request, by contacting the appropriate Federal Reserve Bank and from the Board’s Freedom of Information Office at https://www.federalreserve.gov/foia/ request.htm. Interested persons may express their views in writing on the standards enumerated in paragraph 7 of the Act. Comments regarding each of these applications must be received at the Reserve Bank indicated or the offices of the Board of Governors, Ann E. Misback, Secretary of the Board, 20th Street and Constitution Avenue NW, Washington, DC 20551–0001, not later than February 6, 2024. A. Federal Reserve Bank of Chicago (Colette A. Fried, Assistant Vice President) 230 South LaSalle Street, Chicago, Illinois 60690–1414. Comments can also be sent electronically to Comments.applications@chi.frb.org: 1. Sue Ann McClaren, Denver, Colorado; to retain voting shares of Easton Bancshares, Inc., and thereby indirectly retain voting shares of Community Bank of Easton, both of Easton, Illinois. Board of Governors of the Federal Reserve System. Michele Taylor Fennell, Deputy Associate Secretary of the Board. BILLING CODE P Jkt 262001 Federal Trade Commission. Proposed consent agreement; request for comment. ACTION: [FR Doc. 2024–01159 Filed 1–22–24; 8:45 am] Personnel Matter [File No. 202 3088] PO 00000 Frm 00028 Fmt 4703 Sfmt 4703 E:\FR\FM\23JAN1.SGM 23JAN1 khammond on DSKJM1Z7X2PROD with NOTICES 4302 Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices before February 22, 2024. Write ‘‘InMarket Media LLC; File No. 202 3088’’ on your comment. Your comment—including your name and your state—will be placed on the public record of this proceeding, including, to the extent practicable, on the https:// www.regulations.gov website. Because of heightened security screening, postal mail addressed to the Commission will be subject to delay. We strongly encourage you to submit your comments online through the https:// www.regulations.gov website. If you prefer to file your comment on paper, write ‘‘InMarket Media LLC; File No. 202 3088’’ on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H–144 (Annex M), Washington, DC 20580. Because your comment will be placed on the publicly accessible website at https://www.regulations.gov, you are solely responsible for making sure your comment does not include any sensitive or confidential information. In particular, your comment should not include sensitive personal information, such as your or anyone else’s Social Security number; date of birth; driver’s license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure your comment does not include sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any ‘‘trade secret or any commercial or financial information which . . . is privileged or confidential’’—as provided by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule § 4.10(a)(2), 16 CFR 4.10(a)(2)—including competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names. Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled ‘‘Confidential,’’ and must comply with FTC Rule § 4.9©. In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule § 4.9(c). Your comment will be kept confidential only if the General Counsel grants your VerDate Sep<11>2014 17:41 Jan 22, 2024 Jkt 262001 request in accordance with the law and the public interest. Once your comment has been posted on the https:// www.regulations.gov website—as legally required by FTC Rule § 4.9(b)—we cannot redact or remove your comment from that website, unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule § 4.9(c), and the General Counsel grants that request. Visit the FTC website at https:// www.ftc.gov to read this document and the news release describing the proposed settlement. The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding, as appropriate. The Commission will consider all timely and responsive public comments it receives on or before February 22, 2024. For information on the Commission’s privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/ privacy-policy. Analysis of Proposed Consent Order To Aid Public Comment The Federal Trade Commission (‘‘Commission’’) has accepted, subject to final approval, an agreement containing a consent order from InMarket Media LLC (‘‘InMarket’’). The proposed consent order (‘‘Proposed Order’’) has been placed on the public record for 30 days for receipt of public comments from interested persons. Comments received during this period will become part of the public record. After 30 days, the Commission will again review the agreement, along with the comments received, and will decide whether it should make final the Proposed Order or withdraw from the agreement and take appropriate action. Respondent InMarket is a Delaware company with its headquarters in Texas. Respondent is a digital marketing platform and a data aggregator. Since approximately May 2010, InMarket has operated an advertising service that uses mobile device location data to deliver ads to consumers’ mobile devices. InMarket collects and purchases mobile device location data and uses that data to allow advertisers to target particular groups of consumers. InMarket collects location data directly from mobile devices through its proprietary software development kit (‘‘the InMarket SDK’’). The InMarket SDK is incorporated into two mobile apps that InMarket owns and operates: CheckPoints, which offers shopping rewards for completing small tasks, and ListEase, which helps consumers create shopping lists. Respondent also makes PO 00000 Frm 00029 Fmt 4703 Sfmt 4703 the InMarket SDK available to thirdparty app developers and it has been incorporated into more than 300 thirdparty apps. InMarket uses the location data and other personal information it collects to group consumers, identified by mobile device identifiers, into advertising audiences, and then allows advertisers to target these audiences (e.g., ‘‘coffee lover,’’ ‘‘pet owner’’). Advertisers may target audiences directly through InMarket (that is, the advertisements will appear on mobile devices through the InMarket SDK). They may also purchase ‘‘audiences’’ from InMarket and target their advertisements to these audiences on real-time bidding platforms. When InMarket’s proprietary apps request consent to access location data, they state that the data will be used for the app’s own function (e.g., to earn extra shopping points or to receive a reminder about items on a shopping list when in the store), and do not disclose that they are collecting the data to target advertising, or that the data may be retained for up to five years. InMarket also does not monitor or keep records of whether the third parties that use the InMarket SDK properly disclose to users that location data will be shared with third parties to target advertising, or that it will be retained for up to five years. InMarket thus fails to obtain informed consumer consent in its proprietary apps, CheckPoints and ListEase, and fails to verify that the third-party apps that incorporate InMarket’s SDK obtain informed consumer consent. In addition to failing to obtain informed consent, InMarket has retained the collected data for up to five years— far longer than necessary to accomplish the purpose of collection. This unreasonable retention period, combined with InMarket’s comprehensive data collection practices, significantly increases the risk that the sensitive location data would be disclosed or misused, causing harm to consumers. The Commission’s proposed fourcount complaint alleges that Respondent violated section 5(a) of the FTC Act by (1) unfairly collecting and using consumer location data from its own apps, (2) unfairly collecting and using consumer location data from third party apps, (3) unfairly retaining consumer location data, and (4) deceptively failing to disclose use of location data. With respect to the first count, the proposed complaint alleges that Respondent failed to fully disclose to users of the InMarket apps the purposes for which the users’ location data would E:\FR\FM\23JAN1.SGM 23JAN1 khammond on DSKJM1Z7X2PROD with NOTICES Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices be used, such as the creation of consumer profiles and targeting for advertising. As a result, the proposed complaint alleges that Respondent caused or is likely to cause consumers substantial injury in the form of loss of privacy about their day-to-day movements, and a related increased risk of disclosure of such sensitive data. With respect to the second count, the proposed complaint alleges Respondent collected location data from third-party apps that incorporate its SDK without taking reasonable steps to verify that the consumers were informed that their data would be shared with InMarket and used to develop consumer profiles to target them with advertising. The proposed complaint alleges that this collection of location data without consent verification caused substantial injury to consumers in the form of loss of privacy about their day-to-day movements, and a related increased risk of disclosure of such sensitive data. InMarket’s primary mechanism for ensuring that consumers have provided appropriate consent is through contractual requirements with its thirdparty app partners. However, contractual provisions, without additional safeguards, are insufficient to protect consumers’ privacy. With respect to the third count, the proposed complaint alleges that Respondent retained detailed, sensitive information about consumers’ movement for up to five years, which is longer than reasonably necessary to fulfill the purpose for which that information was collected. As a result, the proposed complaint alleges that such retention caused or is likely to cause substantial injury in the form of loss of privacy about day-to-day movements of consumers, and an increased risk of disclosure of such sensitive data. With respect to the fourth count, the proposed complaint alleges that Respondent failed to inform consumers about its location data use practices. Respondent represented that its apps would use the user’s location information for shopping-related activities such as earning extra points when walking into stores. Instead, InMarket has supplemented that data with information about users it purchased from other sources, shared that information with third parties for advertising purposes, and has used that information to develop predictions about consumer behavior and characteristics. The proposed complaint alleges that these facts would be material to consumers when deciding whether to grant location permissions to VerDate Sep<11>2014 17:41 Jan 22, 2024 Jkt 262001 InMarket’s apps, and their omission was therefore a deceptive act or practice. Summary of Proposed Order With Respondent The Proposed Order contains injunctive relief designed to prevent Respondent from engaging in the same or similar acts or practices in the future. Geolocation data can vary significantly in its precision. The privacy concerns posed by the proposed complaint relate to more precise location data—that is, location data that could be used to identify specific locations a consumer visits. As a result, the Proposed Order is limited to location data that identifies consumers’ locations in a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. Provision I prohibits Respondent from misrepresenting (1) the extent to which it collects, maintains, uses, discloses, or deletes location data, and (2) the extent to which such data is deidentified. Provision II prohibits Respondent from selling or licensing precise location data in exchange for any valuable consideration. Provision III prohibits Respondent from selling, licensing, transferring, or sharing, any product or service that categorizes or targets consumers based on sensitive location data. Sensitive locations are defined as those locations associated with: (1) sexual and reproductive health providers, offices of mental health practitioners and related mental health and substance abuse facilities, offices of oncologists and pediatricians; (2) religious organizations; (3) correctional facilities; (4) labor union offices; (5) locations held out to the public as predominantly providing education or childcare services to minors; (6) locations held out to the public as predominantly providing services to LGBTQ+ individuals; (7) locations held out to the public as predominantly providing services based on racial or ethnic origin; (8) locations held out to the public as providing temporary shelter or social services to homeless, survivors of domestic violence, refugees, or immigrants; or (9) locations of public gatherings of individuals during political or social demonstrations, marches and protests. Provision IV requires that Respondent implement and maintain a sensitive location data program to develop a comprehensive list of sensitive locations and to prevent the use, sale, license, transfer, or disclosure of sensitive location data. Provision V prohibits Respondent from collecting, using, and disclosing PO 00000 Frm 00030 Fmt 4703 Sfmt 4703 4303 location data from its apps (1) without a record documenting the consumer’s affirmative express consent obtained prior to the collection or use of location data, and (2) unless consumers receive a clear and conspicuous reminder every six months about location data being collected. Provision VI requires that Respondent design and implement an SDK supplier assessment program to help ensure that consumers have provided consent for the collection and use of location data obtained by Respondent through its SDK. Under this program, Respondent must conduct initial assessments of all their SDK data suppliers within 30 days of entering into a data sharing agreement, or within 30 days of the initial date of data collection. The program also requires that Respondent confirm that consumers provide consent and create and maintain records of SDK suppliers’ assessment responses. Finally, Respondent must cease from using, selling, or disclosing location data for which consumers do not provide consent. Provision VII requires that Respondent provide a simple, easilylocated means for consumers to withdraw any consent provided and Provision VIII requires that Respondent cease collecting location data within 7 days after Respondent receives notice that the consumer has withdrawn their consent. Provision IX also requires Respondent to provide a simple, easilylocated means for consumers to request that Respondent deletes location data that Respondent previously collected and to delete the location data within 30 days of receipt of such request unless a shorter period for deletion is required by law. Provision X requires that Respondent (1) document and adhere to a retention schedule for the covered information it collects from consumers, including the purposes for which it collects such information, the specific business needs, and an established timeframe for its deletion, and (2) prior to collecting or using new type of information related to consumers that was not previously collected, and is not described in its retention schedule, update its retention schedule. Provision XI requires Respondent to provide a notice to each consumer whose location data was collected through the Respondent’s apps without Affirmative Express Consent, either via email or in the app itself, notifying the consumer about InMarket’s settlement with the Commission. Provision XII requires that Respondent delete or destroy all historic location data. Respondent has the E:\FR\FM\23JAN1.SGM 23JAN1 4304 Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices option to retain historic location data if it has obtained affirmative express consent or it ensures that the historic location data is deidentified or rendered non-sensitive. Provision XIII requires Respondent to establish and implement, and thereafter maintain, a comprehensive privacy program that protects the privacy of consumers’ personal information. Provisions XIV–XVII are reporting and compliance provisions, which include recordkeeping requirements and provisions requiring Respondent to provide information or documents necessary for the Commission to monitor compliance. Provision XVIII states that the Proposed Order will remain in effect for 20 years, with certain exceptions. The purpose of this analysis is to facilitate public comment on the Proposed Order, and it is not intended to constitute an official interpretation of the complaint or Proposed Order, or to modify the Proposed Order’s terms in any way. By direction of the Commission. April J. Tabor, Secretary. [FR Doc. 2024–01269 Filed 1–22–24; 8:45 am] BILLING CODE 6750–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Centers for Disease Control and Prevention Board of Scientific Counselors, National Center for Injury Prevention and Control; Amended Notice of Meeting Centers for Disease Control and Prevention, Department of Health and Human Services (HHS). ACTION: Notice. AGENCY: In accordance with the Federal Advisory Committee Act, the Centers for Disease Control and Prevention (CDC) announces an amendment to the following meeting for the Board of Scientific Counselors, National Center for Injury Prevention and Control (BSC, NCIPC). SUPPLEMENTARY INFORMATION: Notice is hereby given of a change in the meeting of Board of Scientific Counselors, National Center for Injury Prevention and Control; January 11, 2024, first session from 10 a.m. to 12:05 p.m., EST (OPEN), and second session from 1 p.m. to 4:30 p.m., EST (CLOSED), in the original Federal Register notice. khammond on DSKJM1Z7X2PROD with NOTICES SUMMARY: VerDate Sep<11>2014 17:41 Jan 22, 2024 Jkt 262001 The notice of the virtual meeting was published in the Federal Register on November 17, 2023, 88 FR 80305. The meeting notice is being amended. The closed session that was scheduled for January 11, 2024, from 1 p.m. to 4:30 p.m., EST, has been canceled. The notice is being amended to update the SUMMARY, DATES, ADDRESSES, and SUPPLEMENTARY INFORMATION and should read as follows: SUMMARY: In accordance with the Federal Advisory Committee Act, the Centers for Disease Control and Prevention (CDC) announces the following meeting for the Board of Scientific Counselors, National Center for Injury Prevention and Control (BSC, NCIPC). This meeting is open to the public. Time will be available for public comment. DATES: The meeting will be held on January 11, 2024, from 10 a.m. to 12:05 p.m., EST. The public comment period will be from 11:45 a.m. to 12 p.m., EST. ADDRESSES: Webinar, Atlanta, Georgia. All participants must register by using the following link to attend the meeting: https://cdc.zoomgov.com/meeting/ register/vJItf-igpjopGsXuGUhsdlIOm RCB2yx509k. SUPPLEMENTARY INFORMATION: Purpose: The Board of Scientific Counselors, National Center for Injury Prevention and Control (BSC, NCIPC) will: (1) conduct, encourage, cooperate with, and assist other appropriate public health authorities, scientific institutions, and scientists in the conduct of research, investigations, experiments, demonstrations, and studies relating to the causes and strategies related to the prevention of injury, overdose, and violence; (2) assist States and other entities in preventing intentional and unintentional injuries, and to promote health and well-being; and (3) make recommendations of grants and cooperative agreements for research and prevention activities related to injury, overdose, and violence. The BSC, NCIPC makes recommendations regarding policies, strategies, objectives, and priorities and reviews progress toward injury, overdose, and violence prevention. The Board also provides advice on the appropriate balance of intramural and extramural research and provides guidance on the needs, structure, progress, and performance of intramural programs. Further, the Board provides guidance on extramural scientific program matters. Additionally, the Board provides second-level scientific and programmatic review of applications for research grants, cooperative agreements, and training grants related to injury, PO 00000 Frm 00031 Fmt 4703 Sfmt 4703 overdose, and violence prevention, and recommends approval of projects that merit further consideration for funding support. The Board also provides feedback and input on strategic plans, resources, and priority publications related to injury, overdose, and violence prevention. Matters To Be Considered: The meeting will include a discussion on the updated Intimate Partner Violence Research Priorities. Agenda items are subject to change as priorities dictate. FOR FURTHER INFORMATION CONTACT: Christopher R. Harper, Ph.D., Designated Federal Officer, Board of Scientific Counselors, National Center for Injury Prevention and Control, Centers for Disease Control and Prevention, 4770 Buford Highway NE, Mailstop S–1069, Atlanta, Georgia 30341. Telephone: (404) 718–8330; Email: ncipcbsc@cdc.gov. The Director, Office of Strategic Business Initiatives, Office of the Chief Operating Officer, Centers for Disease Control and Prevention, has been delegated the authority to sign Federal Register notices pertaining to announcements of meetings and other committee management activities, for both the Centers for Disease Control and Prevention and the Agency for Toxic Substances and Disease Registry. Kalwant Smagh, Director, Office of Strategic Business Initiatives, Office of the Chief Operating Officer, Centers for Disease Control and Prevention. [FR Doc. 2024–01165 Filed 1–22–24; 8:45 am] BILLING CODE 4163–18–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Centers for Disease Control and Prevention [60Day-24–1071; Docket No. CDC–2024– 0002] Proposed Data Collection Submitted for Public Comment and Recommendations Centers for Disease Control and Prevention (CDC), Department of Health and Human Services (HHS). ACTION: Notice with comment period. AGENCY: The Centers for Disease Control and Prevention (CDC), as part of its continuing effort to reduce public burden and maximize the utility of government information, invites the general public and other Federal agencies the opportunity to comment on a continuing information collection, as required by the Paperwork Reduction SUMMARY: E:\FR\FM\23JAN1.SGM 23JAN1

Agencies

[Federal Register Volume 89, Number 15 (Tuesday, January 23, 2024)]
[Notices]
[Pages 4301-4304]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-01269]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

[File No. 202 3088]


InMarket Media LLC; Analysis of Proposed Consent Order To Aid 
Public Comment

AGENCY: Federal Trade Commission.

ACTION: Proposed consent agreement; request for comment.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged 
violations of federal law prohibiting unfair or deceptive acts or 
practices. The attached Analysis of Proposed Consent Order to Aid 
Public Comment describes both the allegations in the complaint and the 
terms of the consent order--embodied in the consent agreement--that 
would settle these allegations.

DATES: Comments must be received on or before February 22, 2024.

ADDRESSES: Interested parties may file comments online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Please write ``InMarket Media 
LLC; File No. 202 3088'' on your comment and file your comment online 
at https://www.regulations.gov by following the instructions on the 
web-based form. If you prefer to file your comment on paper, please 
mail your comment to the following address: Federal Trade Commission, 
Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144 
(Annex M), Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: Gorana Neskovic (202-326-2322), 
Attorney, Division of Privacy and Identity Protection, Bureau of 
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Ave. 
NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal 
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec.  2.34, 16 CFR 
2.34, notice is hereby given that the above-captioned consent agreement 
containing a consent order to cease and desist, having been filed with 
and accepted, subject to final approval, by the Commission, has been 
placed on the public record for a period of 30 days. The following 
Analysis to Aid Public Comment describes the terms of the consent 
agreement and the allegations in the complaint. An electronic copy of 
the full text of the consent agreement package can be obtained at 
https://www.ftc.gov/news-events/commission-actions.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or

[[Page 4302]]

before February 22, 2024. Write ``InMarket Media LLC; File No. 202 
3088'' on your comment. Your comment--including your name and your 
state--will be placed on the public record of this proceeding, 
including, to the extent practicable, on the https://www.regulations.gov website.
    Because of heightened security screening, postal mail addressed to 
the Commission will be subject to delay. We strongly encourage you to 
submit your comments online through the https://www.regulations.gov 
website. If you prefer to file your comment on paper, write ``InMarket 
Media LLC; File No. 202 3088'' on your comment and on the envelope, and 
mail your comment to the following address: Federal Trade Commission, 
Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144 
(Annex M), Washington, DC 20580.
    Because your comment will be placed on the publicly accessible 
website at https://www.regulations.gov, you are solely responsible for 
making sure your comment does not include any sensitive or confidential 
information. In particular, your comment should not include sensitive 
personal information, such as your or anyone else's Social Security 
number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure your comment does not include 
sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.  
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule Sec.  4.9(copyright). 
In particular, the written request for confidential treatment that 
accompanies the comment must include the factual and legal basis for 
the request and must identify the specific portions of the comment to 
be withheld from the public record. See FTC Rule Sec.  4.9(c). Your 
comment will be kept confidential only if the General Counsel grants 
your request in accordance with the law and the public interest. Once 
your comment has been posted on the https://www.regulations.gov 
website--as legally required by FTC Rule Sec.  4.9(b)--we cannot redact 
or remove your comment from that website, unless you submit a 
confidentiality request that meets the requirements for such treatment 
under FTC Rule Sec.  4.9(c), and the General Counsel grants that 
request.
    Visit the FTC website at https://www.ftc.gov to read this document 
and the news release describing the proposed settlement. The FTC Act 
and other laws the Commission administers permit the collection of 
public comments to consider and use in this proceeding, as appropriate. 
The Commission will consider all timely and responsive public comments 
it receives on or before February 22, 2024. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

    The Federal Trade Commission (``Commission'') has accepted, subject 
to final approval, an agreement containing a consent order from 
InMarket Media LLC (``InMarket''). The proposed consent order 
(``Proposed Order'') has been placed on the public record for 30 days 
for receipt of public comments from interested persons. Comments 
received during this period will become part of the public record. 
After 30 days, the Commission will again review the agreement, along 
with the comments received, and will decide whether it should make 
final the Proposed Order or withdraw from the agreement and take 
appropriate action.
    Respondent InMarket is a Delaware company with its headquarters in 
Texas. Respondent is a digital marketing platform and a data 
aggregator. Since approximately May 2010, InMarket has operated an 
advertising service that uses mobile device location data to deliver 
ads to consumers' mobile devices.
    InMarket collects and purchases mobile device location data and 
uses that data to allow advertisers to target particular groups of 
consumers. InMarket collects location data directly from mobile devices 
through its proprietary software development kit (``the InMarket 
SDK''). The InMarket SDK is incorporated into two mobile apps that 
InMarket owns and operates: CheckPoints, which offers shopping rewards 
for completing small tasks, and ListEase, which helps consumers create 
shopping lists. Respondent also makes the InMarket SDK available to 
third-party app developers and it has been incorporated into more than 
300 third-party apps.
    InMarket uses the location data and other personal information it 
collects to group consumers, identified by mobile device identifiers, 
into advertising audiences, and then allows advertisers to target these 
audiences (e.g., ``coffee lover,'' ``pet owner''). Advertisers may 
target audiences directly through InMarket (that is, the advertisements 
will appear on mobile devices through the InMarket SDK). They may also 
purchase ``audiences'' from InMarket and target their advertisements to 
these audiences on real-time bidding platforms.
    When InMarket's proprietary apps request consent to access location 
data, they state that the data will be used for the app's own function 
(e.g., to earn extra shopping points or to receive a reminder about 
items on a shopping list when in the store), and do not disclose that 
they are collecting the data to target advertising, or that the data 
may be retained for up to five years. InMarket also does not monitor or 
keep records of whether the third parties that use the InMarket SDK 
properly disclose to users that location data will be shared with third 
parties to target advertising, or that it will be retained for up to 
five years. InMarket thus fails to obtain informed consumer consent in 
its proprietary apps, CheckPoints and ListEase, and fails to verify 
that the third-party apps that incorporate InMarket's SDK obtain 
informed consumer consent.
    In addition to failing to obtain informed consent, InMarket has 
retained the collected data for up to five years--far longer than 
necessary to accomplish the purpose of collection. This unreasonable 
retention period, combined with InMarket's comprehensive data 
collection practices, significantly increases the risk that the 
sensitive location data would be disclosed or misused, causing harm to 
consumers.
    The Commission's proposed four-count complaint alleges that 
Respondent violated section 5(a) of the FTC Act by (1) unfairly 
collecting and using consumer location data from its own apps, (2) 
unfairly collecting and using consumer location data from third party 
apps, (3) unfairly retaining consumer location data, and (4) 
deceptively failing to disclose use of location data.
    With respect to the first count, the proposed complaint alleges 
that Respondent failed to fully disclose to users of the InMarket apps 
the purposes for which the users' location data would

[[Page 4303]]

be used, such as the creation of consumer profiles and targeting for 
advertising. As a result, the proposed complaint alleges that 
Respondent caused or is likely to cause consumers substantial injury in 
the form of loss of privacy about their day-to-day movements, and a 
related increased risk of disclosure of such sensitive data.
    With respect to the second count, the proposed complaint alleges 
Respondent collected location data from third-party apps that 
incorporate its SDK without taking reasonable steps to verify that the 
consumers were informed that their data would be shared with InMarket 
and used to develop consumer profiles to target them with advertising. 
The proposed complaint alleges that this collection of location data 
without consent verification caused substantial injury to consumers in 
the form of loss of privacy about their day-to-day movements, and a 
related increased risk of disclosure of such sensitive data. InMarket's 
primary mechanism for ensuring that consumers have provided appropriate 
consent is through contractual requirements with its third-party app 
partners. However, contractual provisions, without additional 
safeguards, are insufficient to protect consumers' privacy.
    With respect to the third count, the proposed complaint alleges 
that Respondent retained detailed, sensitive information about 
consumers' movement for up to five years, which is longer than 
reasonably necessary to fulfill the purpose for which that information 
was collected. As a result, the proposed complaint alleges that such 
retention caused or is likely to cause substantial injury in the form 
of loss of privacy about day-to-day movements of consumers, and an 
increased risk of disclosure of such sensitive data.
    With respect to the fourth count, the proposed complaint alleges 
that Respondent failed to inform consumers about its location data use 
practices. Respondent represented that its apps would use the user's 
location information for shopping-related activities such as earning 
extra points when walking into stores. Instead, InMarket has 
supplemented that data with information about users it purchased from 
other sources, shared that information with third parties for 
advertising purposes, and has used that information to develop 
predictions about consumer behavior and characteristics. The proposed 
complaint alleges that these facts would be material to consumers when 
deciding whether to grant location permissions to InMarket's apps, and 
their omission was therefore a deceptive act or practice.

Summary of Proposed Order With Respondent

    The Proposed Order contains injunctive relief designed to prevent 
Respondent from engaging in the same or similar acts or practices in 
the future.
    Geolocation data can vary significantly in its precision. The 
privacy concerns posed by the proposed complaint relate to more precise 
location data--that is, location data that could be used to identify 
specific locations a consumer visits. As a result, the Proposed Order 
is limited to location data that identifies consumers' locations in a 
geographic area that is equal to or less than the area of a circle with 
a radius of 1,850 feet.
    Provision I prohibits Respondent from misrepresenting (1) the 
extent to which it collects, maintains, uses, discloses, or deletes 
location data, and (2) the extent to which such data is deidentified. 
Provision II prohibits Respondent from selling or licensing precise 
location data in exchange for any valuable consideration.
    Provision III prohibits Respondent from selling, licensing, 
transferring, or sharing, any product or service that categorizes or 
targets consumers based on sensitive location data. Sensitive locations 
are defined as those locations associated with: (1) sexual and 
reproductive health providers, offices of mental health practitioners 
and related mental health and substance abuse facilities, offices of 
oncologists and pediatricians; (2) religious organizations; (3) 
correctional facilities; (4) labor union offices; (5) locations held 
out to the public as predominantly providing education or childcare 
services to minors; (6) locations held out to the public as 
predominantly providing services to LGBTQ+ individuals; (7) locations 
held out to the public as predominantly providing services based on 
racial or ethnic origin; (8) locations held out to the public as 
providing temporary shelter or social services to homeless, survivors 
of domestic violence, refugees, or immigrants; or (9) locations of 
public gatherings of individuals during political or social 
demonstrations, marches and protests.
    Provision IV requires that Respondent implement and maintain a 
sensitive location data program to develop a comprehensive list of 
sensitive locations and to prevent the use, sale, license, transfer, or 
disclosure of sensitive location data.
    Provision V prohibits Respondent from collecting, using, and 
disclosing location data from its apps (1) without a record documenting 
the consumer's affirmative express consent obtained prior to the 
collection or use of location data, and (2) unless consumers receive a 
clear and conspicuous reminder every six months about location data 
being collected.
    Provision VI requires that Respondent design and implement an SDK 
supplier assessment program to help ensure that consumers have provided 
consent for the collection and use of location data obtained by 
Respondent through its SDK. Under this program, Respondent must conduct 
initial assessments of all their SDK data suppliers within 30 days of 
entering into a data sharing agreement, or within 30 days of the 
initial date of data collection. The program also requires that 
Respondent confirm that consumers provide consent and create and 
maintain records of SDK suppliers' assessment responses. Finally, 
Respondent must cease from using, selling, or disclosing location data 
for which consumers do not provide consent.
    Provision VII requires that Respondent provide a simple, easily-
located means for consumers to withdraw any consent provided and 
Provision VIII requires that Respondent cease collecting location data 
within 7 days after Respondent receives notice that the consumer has 
withdrawn their consent. Provision IX also requires Respondent to 
provide a simple, easily-located means for consumers to request that 
Respondent deletes location data that Respondent previously collected 
and to delete the location data within 30 days of receipt of such 
request unless a shorter period for deletion is required by law.
    Provision X requires that Respondent (1) document and adhere to a 
retention schedule for the covered information it collects from 
consumers, including the purposes for which it collects such 
information, the specific business needs, and an established timeframe 
for its deletion, and (2) prior to collecting or using new type of 
information related to consumers that was not previously collected, and 
is not described in its retention schedule, update its retention 
schedule.
    Provision XI requires Respondent to provide a notice to each 
consumer whose location data was collected through the Respondent's 
apps without Affirmative Express Consent, either via email or in the 
app itself, notifying the consumer about InMarket's settlement with the 
Commission.
    Provision XII requires that Respondent delete or destroy all 
historic location data. Respondent has the

[[Page 4304]]

option to retain historic location data if it has obtained affirmative 
express consent or it ensures that the historic location data is 
deidentified or rendered non-sensitive. Provision XIII requires 
Respondent to establish and implement, and thereafter maintain, a 
comprehensive privacy program that protects the privacy of consumers' 
personal information.
    Provisions XIV-XVII are reporting and compliance provisions, which 
include recordkeeping requirements and provisions requiring Respondent 
to provide information or documents necessary for the Commission to 
monitor compliance.
    Provision XVIII states that the Proposed Order will remain in 
effect for 20 years, with certain exceptions.
    The purpose of this analysis is to facilitate public comment on the 
Proposed Order, and it is not intended to constitute an official 
interpretation of the complaint or Proposed Order, or to modify the 
Proposed Order's terms in any way.
    By direction of the Commission.

April J. Tabor,
Secretary.
[FR Doc. 2024-01269 Filed 1-22-24; 8:45 am]
BILLING CODE 6750-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.