InMarket Media LLC; Analysis of Proposed Consent Order To Aid Public Comment, 4301-4304 [2024-01269]
Download as PDF
Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices
FEDERAL FINANCIAL INSTITUTIONS
EXAMINATION COUNCIL
The ASC convened a Special Closed
Meeting to discuss a personnel matter.
No action was taken by the ASC.
FEDERAL TRADE COMMISSION
[Docket No. AS24–02]
James R. Park,
Executive Director.
[FR Doc. 2024–01259 Filed 1–22–24; 8:45 am]
InMarket Media LLC; Analysis of
Proposed Consent Order To Aid Public
Comment
BILLING CODE 6700–01–P
AGENCY:
Appraisal Subcommittee Notice of
Meeting
Appraisal Subcommittee of the
Federal Financial Institutions
Examination Council.
AGENCY:
ACTION:
Notice of special meeting.
In accordance with Section
1104(b) of Title XI of the Financial
Institutions Reform, Recovery, and
Enforcement Act of 1989, as amended,
notice is hereby given that the Appraisal
Subcommittee (ASC) met for a Special
Meeting on this date.
Location: Virtual meeting via Webex.
Date: January 17, 2024.
Time: 10:38 a.m. ET.
SUMMARY:
Action and Discussion Items
ASC Grants Handbook (revised)
ASC Fiscal Year 2024 Notice of Funding
Availability (State Grant)
The ASC convened a Special Meeting
to vote on the above-referenced items.
The vote for each item passed 7–0.
James R. Park,
Executive Director.
[FR Doc. 2024–01260 Filed 1–22–24; 8:45 am]
BILLING CODE 6700–01–P
FEDERAL FINANCIAL INSTITUTIONS
EXAMINATION COUNCIL
[Docket No. AS24–03]
Appraisal Subcommittee Notice of
Meeting
Appraisal Subcommittee of the
Federal Financial Institutions
Examination Council.
AGENCY:
Notice of special closed
meeting.
ACTION:
In accordance with section
1104(b) of title XI of the Financial
Institutions Reform, Recovery, and
Enforcement Act of 1989, as amended,
notice is hereby given that the Appraisal
Subcommittee (ASC) met for a Special
Closed Meeting on this date.
Location: Virtual meeting via Webex.
Date: January 17, 2024.
Time: 10:45 a.m. ET.
SUMMARY:
khammond on DSKJM1Z7X2PROD with NOTICES
4301
Action and Discussion Item
VerDate Sep<11>2014
17:41 Jan 22, 2024
FEDERAL RESERVE SYSTEM
The consent agreement in this
matter settles alleged violations of
federal law prohibiting unfair or
deceptive acts or practices. The attached
Analysis of Proposed Consent Order to
Aid Public Comment describes both the
allegations in the complaint and the
terms of the consent order—embodied
in the consent agreement—that would
settle these allegations.
DATES: Comments must be received on
or before February 22, 2024.
ADDRESSES: Interested parties may file
comments online or on paper by
following the instructions in the
Request for Comment part of the
SUPPLEMENTARY INFORMATION section
below. Please write ‘‘InMarket Media
LLC; File No. 202 3088’’ on your
comment and file your comment online
at https://www.regulations.gov by
following the instructions on the webbased form. If you prefer to file your
comment on paper, please mail your
comment to the following address:
Federal Trade Commission, Office of the
Secretary, 600 Pennsylvania Avenue
NW, Mail Stop H–144 (Annex M),
Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT:
Gorana Neskovic (202–326–2322),
Attorney, Division of Privacy and
Identity Protection, Bureau of Consumer
Protection, Federal Trade Commission,
600 Pennsylvania Ave. NW,
Washington, DC 20580.
SUPPLEMENTARY INFORMATION: Pursuant
to Section 6(f) of the Federal Trade
Commission Act, 15 U.S.C. 46(f), and
FTC Rule § 2.34, 16 CFR 2.34, notice is
hereby given that the above-captioned
consent agreement containing a consent
order to cease and desist, having been
filed with and accepted, subject to final
approval, by the Commission, has been
placed on the public record for a period
of 30 days. The following Analysis to
Aid Public Comment describes the
terms of the consent agreement and the
allegations in the complaint. An
electronic copy of the full text of the
consent agreement package can be
obtained at https://www.ftc.gov/newsevents/commission-actions.
You can file a comment online or on
paper. For the Commission to consider
your comment, we must receive it on or
SUMMARY:
Change in Bank Control Notices;
Acquisitions of Shares of a Bank or
Bank Holding Company
The notificants listed below have
applied under the Change in Bank
Control Act (Act) (12 U.S.C. 1817(j)) and
§ 225.41 of the Board’s Regulation Y (12
CFR 225.41) to acquire shares of a bank
or bank holding company. The factors
that are considered in acting on the
applications are set forth in paragraph 7
of the Act (12 U.S.C. 1817(j)(7)).
The public portions of the
applications listed below, as well as
other related filings required by the
Board, if any, are available for
immediate inspection at the Federal
Reserve Bank(s) indicated below and at
the offices of the Board of Governors.
This information may also be obtained
on an expedited basis, upon request, by
contacting the appropriate Federal
Reserve Bank and from the Board’s
Freedom of Information Office at
https://www.federalreserve.gov/foia/
request.htm. Interested persons may
express their views in writing on the
standards enumerated in paragraph 7 of
the Act.
Comments regarding each of these
applications must be received at the
Reserve Bank indicated or the offices of
the Board of Governors, Ann E.
Misback, Secretary of the Board, 20th
Street and Constitution Avenue NW,
Washington, DC 20551–0001, not later
than February 6, 2024.
A. Federal Reserve Bank of Chicago
(Colette A. Fried, Assistant Vice
President) 230 South LaSalle Street,
Chicago, Illinois 60690–1414.
Comments can also be sent
electronically to
Comments.applications@chi.frb.org:
1. Sue Ann McClaren, Denver,
Colorado; to retain voting shares of
Easton Bancshares, Inc., and thereby
indirectly retain voting shares of
Community Bank of Easton, both of
Easton, Illinois.
Board of Governors of the Federal Reserve
System.
Michele Taylor Fennell,
Deputy Associate Secretary of the Board.
BILLING CODE P
Jkt 262001
Federal Trade Commission.
Proposed consent agreement;
request for comment.
ACTION:
[FR Doc. 2024–01159 Filed 1–22–24; 8:45 am]
Personnel Matter
[File No. 202 3088]
PO 00000
Frm 00028
Fmt 4703
Sfmt 4703
E:\FR\FM\23JAN1.SGM
23JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
4302
Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices
before February 22, 2024. Write
‘‘InMarket Media LLC; File No. 202
3088’’ on your comment. Your
comment—including your name and
your state—will be placed on the public
record of this proceeding, including, to
the extent practicable, on the https://
www.regulations.gov website.
Because of heightened security
screening, postal mail addressed to the
Commission will be subject to delay. We
strongly encourage you to submit your
comments online through the https://
www.regulations.gov website. If you
prefer to file your comment on paper,
write ‘‘InMarket Media LLC; File No.
202 3088’’ on your comment and on the
envelope, and mail your comment to the
following address: Federal Trade
Commission, Office of the Secretary,
600 Pennsylvania Avenue NW, Mail
Stop H–144 (Annex M), Washington, DC
20580.
Because your comment will be placed
on the publicly accessible website at
https://www.regulations.gov, you are
solely responsible for making sure your
comment does not include any sensitive
or confidential information. In
particular, your comment should not
include sensitive personal information,
such as your or anyone else’s Social
Security number; date of birth; driver’s
license number or other state
identification number, or foreign
country equivalent; passport number;
financial account number; or credit or
debit card number. You are also solely
responsible for making sure your
comment does not include sensitive
health information, such as medical
records or other individually
identifiable health information. In
addition, your comment should not
include any ‘‘trade secret or any
commercial or financial information
which . . . is privileged or
confidential’’—as provided by Section
6(f) of the FTC Act, 15 U.S.C. 46(f), and
FTC Rule § 4.10(a)(2), 16 CFR
4.10(a)(2)—including competitively
sensitive information such as costs,
sales statistics, inventories, formulas,
patterns, devices, manufacturing
processes, or customer names.
Comments containing material for
which confidential treatment is
requested must be filed in paper form,
must be clearly labeled ‘‘Confidential,’’
and must comply with FTC Rule § 4.9©.
In particular, the written request for
confidential treatment that accompanies
the comment must include the factual
and legal basis for the request and must
identify the specific portions of the
comment to be withheld from the public
record. See FTC Rule § 4.9(c). Your
comment will be kept confidential only
if the General Counsel grants your
VerDate Sep<11>2014
17:41 Jan 22, 2024
Jkt 262001
request in accordance with the law and
the public interest. Once your comment
has been posted on the https://
www.regulations.gov website—as legally
required by FTC Rule § 4.9(b)—we
cannot redact or remove your comment
from that website, unless you submit a
confidentiality request that meets the
requirements for such treatment under
FTC Rule § 4.9(c), and the General
Counsel grants that request.
Visit the FTC website at https://
www.ftc.gov to read this document and
the news release describing the
proposed settlement. The FTC Act and
other laws the Commission administers
permit the collection of public
comments to consider and use in this
proceeding, as appropriate. The
Commission will consider all timely
and responsive public comments it
receives on or before February 22, 2024.
For information on the Commission’s
privacy policy, including routine uses
permitted by the Privacy Act, see
https://www.ftc.gov/site-information/
privacy-policy.
Analysis of Proposed Consent Order To
Aid Public Comment
The Federal Trade Commission
(‘‘Commission’’) has accepted, subject to
final approval, an agreement containing
a consent order from InMarket Media
LLC (‘‘InMarket’’). The proposed
consent order (‘‘Proposed Order’’) has
been placed on the public record for 30
days for receipt of public comments
from interested persons. Comments
received during this period will become
part of the public record. After 30 days,
the Commission will again review the
agreement, along with the comments
received, and will decide whether it
should make final the Proposed Order
or withdraw from the agreement and
take appropriate action.
Respondent InMarket is a Delaware
company with its headquarters in Texas.
Respondent is a digital marketing
platform and a data aggregator. Since
approximately May 2010, InMarket has
operated an advertising service that uses
mobile device location data to deliver
ads to consumers’ mobile devices.
InMarket collects and purchases
mobile device location data and uses
that data to allow advertisers to target
particular groups of consumers.
InMarket collects location data directly
from mobile devices through its
proprietary software development kit
(‘‘the InMarket SDK’’). The InMarket
SDK is incorporated into two mobile
apps that InMarket owns and operates:
CheckPoints, which offers shopping
rewards for completing small tasks, and
ListEase, which helps consumers create
shopping lists. Respondent also makes
PO 00000
Frm 00029
Fmt 4703
Sfmt 4703
the InMarket SDK available to thirdparty app developers and it has been
incorporated into more than 300 thirdparty apps.
InMarket uses the location data and
other personal information it collects to
group consumers, identified by mobile
device identifiers, into advertising
audiences, and then allows advertisers
to target these audiences (e.g., ‘‘coffee
lover,’’ ‘‘pet owner’’). Advertisers may
target audiences directly through
InMarket (that is, the advertisements
will appear on mobile devices through
the InMarket SDK). They may also
purchase ‘‘audiences’’ from InMarket
and target their advertisements to these
audiences on real-time bidding
platforms.
When InMarket’s proprietary apps
request consent to access location data,
they state that the data will be used for
the app’s own function (e.g., to earn
extra shopping points or to receive a
reminder about items on a shopping list
when in the store), and do not disclose
that they are collecting the data to target
advertising, or that the data may be
retained for up to five years. InMarket
also does not monitor or keep records of
whether the third parties that use the
InMarket SDK properly disclose to users
that location data will be shared with
third parties to target advertising, or that
it will be retained for up to five years.
InMarket thus fails to obtain informed
consumer consent in its proprietary
apps, CheckPoints and ListEase, and
fails to verify that the third-party apps
that incorporate InMarket’s SDK obtain
informed consumer consent.
In addition to failing to obtain
informed consent, InMarket has retained
the collected data for up to five years—
far longer than necessary to accomplish
the purpose of collection. This
unreasonable retention period,
combined with InMarket’s
comprehensive data collection
practices, significantly increases the risk
that the sensitive location data would be
disclosed or misused, causing harm to
consumers.
The Commission’s proposed fourcount complaint alleges that
Respondent violated section 5(a) of the
FTC Act by (1) unfairly collecting and
using consumer location data from its
own apps, (2) unfairly collecting and
using consumer location data from third
party apps, (3) unfairly retaining
consumer location data, and (4)
deceptively failing to disclose use of
location data.
With respect to the first count, the
proposed complaint alleges that
Respondent failed to fully disclose to
users of the InMarket apps the purposes
for which the users’ location data would
E:\FR\FM\23JAN1.SGM
23JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices
be used, such as the creation of
consumer profiles and targeting for
advertising. As a result, the proposed
complaint alleges that Respondent
caused or is likely to cause consumers
substantial injury in the form of loss of
privacy about their day-to-day
movements, and a related increased risk
of disclosure of such sensitive data.
With respect to the second count, the
proposed complaint alleges Respondent
collected location data from third-party
apps that incorporate its SDK without
taking reasonable steps to verify that the
consumers were informed that their data
would be shared with InMarket and
used to develop consumer profiles to
target them with advertising. The
proposed complaint alleges that this
collection of location data without
consent verification caused substantial
injury to consumers in the form of loss
of privacy about their day-to-day
movements, and a related increased risk
of disclosure of such sensitive data.
InMarket’s primary mechanism for
ensuring that consumers have provided
appropriate consent is through
contractual requirements with its thirdparty app partners. However,
contractual provisions, without
additional safeguards, are insufficient to
protect consumers’ privacy.
With respect to the third count, the
proposed complaint alleges that
Respondent retained detailed, sensitive
information about consumers’
movement for up to five years, which is
longer than reasonably necessary to
fulfill the purpose for which that
information was collected. As a result,
the proposed complaint alleges that
such retention caused or is likely to
cause substantial injury in the form of
loss of privacy about day-to-day
movements of consumers, and an
increased risk of disclosure of such
sensitive data.
With respect to the fourth count, the
proposed complaint alleges that
Respondent failed to inform consumers
about its location data use practices.
Respondent represented that its apps
would use the user’s location
information for shopping-related
activities such as earning extra points
when walking into stores. Instead,
InMarket has supplemented that data
with information about users it
purchased from other sources, shared
that information with third parties for
advertising purposes, and has used that
information to develop predictions
about consumer behavior and
characteristics. The proposed complaint
alleges that these facts would be
material to consumers when deciding
whether to grant location permissions to
VerDate Sep<11>2014
17:41 Jan 22, 2024
Jkt 262001
InMarket’s apps, and their omission was
therefore a deceptive act or practice.
Summary of Proposed Order With
Respondent
The Proposed Order contains
injunctive relief designed to prevent
Respondent from engaging in the same
or similar acts or practices in the future.
Geolocation data can vary
significantly in its precision. The
privacy concerns posed by the proposed
complaint relate to more precise
location data—that is, location data that
could be used to identify specific
locations a consumer visits. As a result,
the Proposed Order is limited to
location data that identifies consumers’
locations in a geographic area that is
equal to or less than the area of a circle
with a radius of 1,850 feet.
Provision I prohibits Respondent from
misrepresenting (1) the extent to which
it collects, maintains, uses, discloses, or
deletes location data, and (2) the extent
to which such data is deidentified.
Provision II prohibits Respondent from
selling or licensing precise location data
in exchange for any valuable
consideration.
Provision III prohibits Respondent
from selling, licensing, transferring, or
sharing, any product or service that
categorizes or targets consumers based
on sensitive location data. Sensitive
locations are defined as those locations
associated with: (1) sexual and
reproductive health providers, offices of
mental health practitioners and related
mental health and substance abuse
facilities, offices of oncologists and
pediatricians; (2) religious
organizations; (3) correctional facilities;
(4) labor union offices; (5) locations held
out to the public as predominantly
providing education or childcare
services to minors; (6) locations held out
to the public as predominantly
providing services to LGBTQ+
individuals; (7) locations held out to the
public as predominantly providing
services based on racial or ethnic origin;
(8) locations held out to the public as
providing temporary shelter or social
services to homeless, survivors of
domestic violence, refugees, or
immigrants; or (9) locations of public
gatherings of individuals during
political or social demonstrations,
marches and protests.
Provision IV requires that Respondent
implement and maintain a sensitive
location data program to develop a
comprehensive list of sensitive locations
and to prevent the use, sale, license,
transfer, or disclosure of sensitive
location data.
Provision V prohibits Respondent
from collecting, using, and disclosing
PO 00000
Frm 00030
Fmt 4703
Sfmt 4703
4303
location data from its apps (1) without
a record documenting the consumer’s
affirmative express consent obtained
prior to the collection or use of location
data, and (2) unless consumers receive
a clear and conspicuous reminder every
six months about location data being
collected.
Provision VI requires that Respondent
design and implement an SDK supplier
assessment program to help ensure that
consumers have provided consent for
the collection and use of location data
obtained by Respondent through its
SDK. Under this program, Respondent
must conduct initial assessments of all
their SDK data suppliers within 30 days
of entering into a data sharing
agreement, or within 30 days of the
initial date of data collection. The
program also requires that Respondent
confirm that consumers provide consent
and create and maintain records of SDK
suppliers’ assessment responses.
Finally, Respondent must cease from
using, selling, or disclosing location
data for which consumers do not
provide consent.
Provision VII requires that
Respondent provide a simple, easilylocated means for consumers to
withdraw any consent provided and
Provision VIII requires that Respondent
cease collecting location data within 7
days after Respondent receives notice
that the consumer has withdrawn their
consent. Provision IX also requires
Respondent to provide a simple, easilylocated means for consumers to request
that Respondent deletes location data
that Respondent previously collected
and to delete the location data within 30
days of receipt of such request unless a
shorter period for deletion is required
by law.
Provision X requires that Respondent
(1) document and adhere to a retention
schedule for the covered information it
collects from consumers, including the
purposes for which it collects such
information, the specific business
needs, and an established timeframe for
its deletion, and (2) prior to collecting
or using new type of information related
to consumers that was not previously
collected, and is not described in its
retention schedule, update its retention
schedule.
Provision XI requires Respondent to
provide a notice to each consumer
whose location data was collected
through the Respondent’s apps without
Affirmative Express Consent, either via
email or in the app itself, notifying the
consumer about InMarket’s settlement
with the Commission.
Provision XII requires that
Respondent delete or destroy all historic
location data. Respondent has the
E:\FR\FM\23JAN1.SGM
23JAN1
4304
Federal Register / Vol. 89, No. 15 / Tuesday, January 23, 2024 / Notices
option to retain historic location data if
it has obtained affirmative express
consent or it ensures that the historic
location data is deidentified or rendered
non-sensitive. Provision XIII requires
Respondent to establish and implement,
and thereafter maintain, a
comprehensive privacy program that
protects the privacy of consumers’
personal information.
Provisions XIV–XVII are reporting
and compliance provisions, which
include recordkeeping requirements and
provisions requiring Respondent to
provide information or documents
necessary for the Commission to
monitor compliance.
Provision XVIII states that the
Proposed Order will remain in effect for
20 years, with certain exceptions.
The purpose of this analysis is to
facilitate public comment on the
Proposed Order, and it is not intended
to constitute an official interpretation of
the complaint or Proposed Order, or to
modify the Proposed Order’s terms in
any way.
By direction of the Commission.
April J. Tabor,
Secretary.
[FR Doc. 2024–01269 Filed 1–22–24; 8:45 am]
BILLING CODE 6750–01–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Disease Control and
Prevention
Board of Scientific Counselors,
National Center for Injury Prevention
and Control; Amended Notice of
Meeting
Centers for Disease Control and
Prevention, Department of Health and
Human Services (HHS).
ACTION: Notice.
AGENCY:
In accordance with the
Federal Advisory Committee Act, the
Centers for Disease Control and
Prevention (CDC) announces an
amendment to the following meeting for
the Board of Scientific Counselors,
National Center for Injury Prevention
and Control (BSC, NCIPC).
SUPPLEMENTARY INFORMATION: Notice is
hereby given of a change in the meeting
of Board of Scientific Counselors,
National Center for Injury Prevention
and Control; January 11, 2024, first
session from 10 a.m. to 12:05 p.m., EST
(OPEN), and second session from 1 p.m.
to 4:30 p.m., EST (CLOSED), in the
original Federal Register notice.
khammond on DSKJM1Z7X2PROD with NOTICES
SUMMARY:
VerDate Sep<11>2014
17:41 Jan 22, 2024
Jkt 262001
The notice of the virtual meeting was
published in the Federal Register on
November 17, 2023, 88 FR 80305.
The meeting notice is being amended.
The closed session that was scheduled
for January 11, 2024, from 1 p.m. to 4:30
p.m., EST, has been canceled. The
notice is being amended to update the
SUMMARY, DATES, ADDRESSES, and
SUPPLEMENTARY INFORMATION and should
read as follows:
SUMMARY: In accordance with the
Federal Advisory Committee Act, the
Centers for Disease Control and
Prevention (CDC) announces the
following meeting for the Board of
Scientific Counselors, National Center
for Injury Prevention and Control (BSC,
NCIPC). This meeting is open to the
public. Time will be available for public
comment.
DATES: The meeting will be held on
January 11, 2024, from 10 a.m. to 12:05
p.m., EST. The public comment period
will be from 11:45 a.m. to 12 p.m., EST.
ADDRESSES: Webinar, Atlanta, Georgia.
All participants must register by using
the following link to attend the meeting:
https://cdc.zoomgov.com/meeting/
register/vJItf-igpjopGsXuGUhsdlIOm
RCB2yx509k.
SUPPLEMENTARY INFORMATION:
Purpose: The Board of Scientific
Counselors, National Center for Injury
Prevention and Control (BSC, NCIPC)
will: (1) conduct, encourage, cooperate
with, and assist other appropriate public
health authorities, scientific
institutions, and scientists in the
conduct of research, investigations,
experiments, demonstrations, and
studies relating to the causes and
strategies related to the prevention of
injury, overdose, and violence; (2) assist
States and other entities in preventing
intentional and unintentional injuries,
and to promote health and well-being;
and (3) make recommendations of grants
and cooperative agreements for research
and prevention activities related to
injury, overdose, and violence. The
BSC, NCIPC makes recommendations
regarding policies, strategies, objectives,
and priorities and reviews progress
toward injury, overdose, and violence
prevention. The Board also provides
advice on the appropriate balance of
intramural and extramural research and
provides guidance on the needs,
structure, progress, and performance of
intramural programs. Further, the Board
provides guidance on extramural
scientific program matters.
Additionally, the Board provides
second-level scientific and
programmatic review of applications for
research grants, cooperative agreements,
and training grants related to injury,
PO 00000
Frm 00031
Fmt 4703
Sfmt 4703
overdose, and violence prevention, and
recommends approval of projects that
merit further consideration for funding
support. The Board also provides
feedback and input on strategic plans,
resources, and priority publications
related to injury, overdose, and violence
prevention.
Matters To Be Considered: The
meeting will include a discussion on the
updated Intimate Partner Violence
Research Priorities. Agenda items are
subject to change as priorities dictate.
FOR FURTHER INFORMATION CONTACT:
Christopher R. Harper, Ph.D.,
Designated Federal Officer, Board of
Scientific Counselors, National Center
for Injury Prevention and Control,
Centers for Disease Control and
Prevention, 4770 Buford Highway NE,
Mailstop S–1069, Atlanta, Georgia
30341. Telephone: (404) 718–8330;
Email: ncipcbsc@cdc.gov.
The Director, Office of Strategic
Business Initiatives, Office of the Chief
Operating Officer, Centers for Disease
Control and Prevention, has been
delegated the authority to sign Federal
Register notices pertaining to
announcements of meetings and other
committee management activities, for
both the Centers for Disease Control and
Prevention and the Agency for Toxic
Substances and Disease Registry.
Kalwant Smagh,
Director, Office of Strategic Business
Initiatives, Office of the Chief Operating
Officer, Centers for Disease Control and
Prevention.
[FR Doc. 2024–01165 Filed 1–22–24; 8:45 am]
BILLING CODE 4163–18–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Disease Control and
Prevention
[60Day-24–1071; Docket No. CDC–2024–
0002]
Proposed Data Collection Submitted
for Public Comment and
Recommendations
Centers for Disease Control and
Prevention (CDC), Department of Health
and Human Services (HHS).
ACTION: Notice with comment period.
AGENCY:
The Centers for Disease
Control and Prevention (CDC), as part of
its continuing effort to reduce public
burden and maximize the utility of
government information, invites the
general public and other Federal
agencies the opportunity to comment on
a continuing information collection, as
required by the Paperwork Reduction
SUMMARY:
E:\FR\FM\23JAN1.SGM
23JAN1
Agencies
[Federal Register Volume 89, Number 15 (Tuesday, January 23, 2024)]
[Notices]
[Pages 4301-4304]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-01269]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 202 3088]
InMarket Media LLC; Analysis of Proposed Consent Order To Aid
Public Comment
AGENCY: Federal Trade Commission.
ACTION: Proposed consent agreement; request for comment.
-----------------------------------------------------------------------
SUMMARY: The consent agreement in this matter settles alleged
violations of federal law prohibiting unfair or deceptive acts or
practices. The attached Analysis of Proposed Consent Order to Aid
Public Comment describes both the allegations in the complaint and the
terms of the consent order--embodied in the consent agreement--that
would settle these allegations.
DATES: Comments must be received on or before February 22, 2024.
ADDRESSES: Interested parties may file comments online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Please write ``InMarket Media
LLC; File No. 202 3088'' on your comment and file your comment online
at https://www.regulations.gov by following the instructions on the
web-based form. If you prefer to file your comment on paper, please
mail your comment to the following address: Federal Trade Commission,
Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144
(Annex M), Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Gorana Neskovic (202-326-2322),
Attorney, Division of Privacy and Identity Protection, Bureau of
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Ave.
NW, Washington, DC 20580.
SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec. 2.34, 16 CFR
2.34, notice is hereby given that the above-captioned consent agreement
containing a consent order to cease and desist, having been filed with
and accepted, subject to final approval, by the Commission, has been
placed on the public record for a period of 30 days. The following
Analysis to Aid Public Comment describes the terms of the consent
agreement and the allegations in the complaint. An electronic copy of
the full text of the consent agreement package can be obtained at
https://www.ftc.gov/news-events/commission-actions.
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or
[[Page 4302]]
before February 22, 2024. Write ``InMarket Media LLC; File No. 202
3088'' on your comment. Your comment--including your name and your
state--will be placed on the public record of this proceeding,
including, to the extent practicable, on the https://www.regulations.gov website.
Because of heightened security screening, postal mail addressed to
the Commission will be subject to delay. We strongly encourage you to
submit your comments online through the https://www.regulations.gov
website. If you prefer to file your comment on paper, write ``InMarket
Media LLC; File No. 202 3088'' on your comment and on the envelope, and
mail your comment to the following address: Federal Trade Commission,
Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144
(Annex M), Washington, DC 20580.
Because your comment will be placed on the publicly accessible
website at https://www.regulations.gov, you are solely responsible for
making sure your comment does not include any sensitive or confidential
information. In particular, your comment should not include sensitive
personal information, such as your or anyone else's Social Security
number; date of birth; driver's license number or other state
identification number, or foreign country equivalent; passport number;
financial account number; or credit or debit card number. You are also
solely responsible for making sure your comment does not include
sensitive health information, such as medical records or other
individually identifiable health information. In addition, your comment
should not include any ``trade secret or any commercial or financial
information which . . . is privileged or confidential''--as provided by
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule Sec. 4.9(copyright).
In particular, the written request for confidential treatment that
accompanies the comment must include the factual and legal basis for
the request and must identify the specific portions of the comment to
be withheld from the public record. See FTC Rule Sec. 4.9(c). Your
comment will be kept confidential only if the General Counsel grants
your request in accordance with the law and the public interest. Once
your comment has been posted on the https://www.regulations.gov
website--as legally required by FTC Rule Sec. 4.9(b)--we cannot redact
or remove your comment from that website, unless you submit a
confidentiality request that meets the requirements for such treatment
under FTC Rule Sec. 4.9(c), and the General Counsel grants that
request.
Visit the FTC website at https://www.ftc.gov to read this document
and the news release describing the proposed settlement. The FTC Act
and other laws the Commission administers permit the collection of
public comments to consider and use in this proceeding, as appropriate.
The Commission will consider all timely and responsive public comments
it receives on or before February 22, 2024. For information on the
Commission's privacy policy, including routine uses permitted by the
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.
Analysis of Proposed Consent Order To Aid Public Comment
The Federal Trade Commission (``Commission'') has accepted, subject
to final approval, an agreement containing a consent order from
InMarket Media LLC (``InMarket''). The proposed consent order
(``Proposed Order'') has been placed on the public record for 30 days
for receipt of public comments from interested persons. Comments
received during this period will become part of the public record.
After 30 days, the Commission will again review the agreement, along
with the comments received, and will decide whether it should make
final the Proposed Order or withdraw from the agreement and take
appropriate action.
Respondent InMarket is a Delaware company with its headquarters in
Texas. Respondent is a digital marketing platform and a data
aggregator. Since approximately May 2010, InMarket has operated an
advertising service that uses mobile device location data to deliver
ads to consumers' mobile devices.
InMarket collects and purchases mobile device location data and
uses that data to allow advertisers to target particular groups of
consumers. InMarket collects location data directly from mobile devices
through its proprietary software development kit (``the InMarket
SDK''). The InMarket SDK is incorporated into two mobile apps that
InMarket owns and operates: CheckPoints, which offers shopping rewards
for completing small tasks, and ListEase, which helps consumers create
shopping lists. Respondent also makes the InMarket SDK available to
third-party app developers and it has been incorporated into more than
300 third-party apps.
InMarket uses the location data and other personal information it
collects to group consumers, identified by mobile device identifiers,
into advertising audiences, and then allows advertisers to target these
audiences (e.g., ``coffee lover,'' ``pet owner''). Advertisers may
target audiences directly through InMarket (that is, the advertisements
will appear on mobile devices through the InMarket SDK). They may also
purchase ``audiences'' from InMarket and target their advertisements to
these audiences on real-time bidding platforms.
When InMarket's proprietary apps request consent to access location
data, they state that the data will be used for the app's own function
(e.g., to earn extra shopping points or to receive a reminder about
items on a shopping list when in the store), and do not disclose that
they are collecting the data to target advertising, or that the data
may be retained for up to five years. InMarket also does not monitor or
keep records of whether the third parties that use the InMarket SDK
properly disclose to users that location data will be shared with third
parties to target advertising, or that it will be retained for up to
five years. InMarket thus fails to obtain informed consumer consent in
its proprietary apps, CheckPoints and ListEase, and fails to verify
that the third-party apps that incorporate InMarket's SDK obtain
informed consumer consent.
In addition to failing to obtain informed consent, InMarket has
retained the collected data for up to five years--far longer than
necessary to accomplish the purpose of collection. This unreasonable
retention period, combined with InMarket's comprehensive data
collection practices, significantly increases the risk that the
sensitive location data would be disclosed or misused, causing harm to
consumers.
The Commission's proposed four-count complaint alleges that
Respondent violated section 5(a) of the FTC Act by (1) unfairly
collecting and using consumer location data from its own apps, (2)
unfairly collecting and using consumer location data from third party
apps, (3) unfairly retaining consumer location data, and (4)
deceptively failing to disclose use of location data.
With respect to the first count, the proposed complaint alleges
that Respondent failed to fully disclose to users of the InMarket apps
the purposes for which the users' location data would
[[Page 4303]]
be used, such as the creation of consumer profiles and targeting for
advertising. As a result, the proposed complaint alleges that
Respondent caused or is likely to cause consumers substantial injury in
the form of loss of privacy about their day-to-day movements, and a
related increased risk of disclosure of such sensitive data.
With respect to the second count, the proposed complaint alleges
Respondent collected location data from third-party apps that
incorporate its SDK without taking reasonable steps to verify that the
consumers were informed that their data would be shared with InMarket
and used to develop consumer profiles to target them with advertising.
The proposed complaint alleges that this collection of location data
without consent verification caused substantial injury to consumers in
the form of loss of privacy about their day-to-day movements, and a
related increased risk of disclosure of such sensitive data. InMarket's
primary mechanism for ensuring that consumers have provided appropriate
consent is through contractual requirements with its third-party app
partners. However, contractual provisions, without additional
safeguards, are insufficient to protect consumers' privacy.
With respect to the third count, the proposed complaint alleges
that Respondent retained detailed, sensitive information about
consumers' movement for up to five years, which is longer than
reasonably necessary to fulfill the purpose for which that information
was collected. As a result, the proposed complaint alleges that such
retention caused or is likely to cause substantial injury in the form
of loss of privacy about day-to-day movements of consumers, and an
increased risk of disclosure of such sensitive data.
With respect to the fourth count, the proposed complaint alleges
that Respondent failed to inform consumers about its location data use
practices. Respondent represented that its apps would use the user's
location information for shopping-related activities such as earning
extra points when walking into stores. Instead, InMarket has
supplemented that data with information about users it purchased from
other sources, shared that information with third parties for
advertising purposes, and has used that information to develop
predictions about consumer behavior and characteristics. The proposed
complaint alleges that these facts would be material to consumers when
deciding whether to grant location permissions to InMarket's apps, and
their omission was therefore a deceptive act or practice.
Summary of Proposed Order With Respondent
The Proposed Order contains injunctive relief designed to prevent
Respondent from engaging in the same or similar acts or practices in
the future.
Geolocation data can vary significantly in its precision. The
privacy concerns posed by the proposed complaint relate to more precise
location data--that is, location data that could be used to identify
specific locations a consumer visits. As a result, the Proposed Order
is limited to location data that identifies consumers' locations in a
geographic area that is equal to or less than the area of a circle with
a radius of 1,850 feet.
Provision I prohibits Respondent from misrepresenting (1) the
extent to which it collects, maintains, uses, discloses, or deletes
location data, and (2) the extent to which such data is deidentified.
Provision II prohibits Respondent from selling or licensing precise
location data in exchange for any valuable consideration.
Provision III prohibits Respondent from selling, licensing,
transferring, or sharing, any product or service that categorizes or
targets consumers based on sensitive location data. Sensitive locations
are defined as those locations associated with: (1) sexual and
reproductive health providers, offices of mental health practitioners
and related mental health and substance abuse facilities, offices of
oncologists and pediatricians; (2) religious organizations; (3)
correctional facilities; (4) labor union offices; (5) locations held
out to the public as predominantly providing education or childcare
services to minors; (6) locations held out to the public as
predominantly providing services to LGBTQ+ individuals; (7) locations
held out to the public as predominantly providing services based on
racial or ethnic origin; (8) locations held out to the public as
providing temporary shelter or social services to homeless, survivors
of domestic violence, refugees, or immigrants; or (9) locations of
public gatherings of individuals during political or social
demonstrations, marches and protests.
Provision IV requires that Respondent implement and maintain a
sensitive location data program to develop a comprehensive list of
sensitive locations and to prevent the use, sale, license, transfer, or
disclosure of sensitive location data.
Provision V prohibits Respondent from collecting, using, and
disclosing location data from its apps (1) without a record documenting
the consumer's affirmative express consent obtained prior to the
collection or use of location data, and (2) unless consumers receive a
clear and conspicuous reminder every six months about location data
being collected.
Provision VI requires that Respondent design and implement an SDK
supplier assessment program to help ensure that consumers have provided
consent for the collection and use of location data obtained by
Respondent through its SDK. Under this program, Respondent must conduct
initial assessments of all their SDK data suppliers within 30 days of
entering into a data sharing agreement, or within 30 days of the
initial date of data collection. The program also requires that
Respondent confirm that consumers provide consent and create and
maintain records of SDK suppliers' assessment responses. Finally,
Respondent must cease from using, selling, or disclosing location data
for which consumers do not provide consent.
Provision VII requires that Respondent provide a simple, easily-
located means for consumers to withdraw any consent provided and
Provision VIII requires that Respondent cease collecting location data
within 7 days after Respondent receives notice that the consumer has
withdrawn their consent. Provision IX also requires Respondent to
provide a simple, easily-located means for consumers to request that
Respondent deletes location data that Respondent previously collected
and to delete the location data within 30 days of receipt of such
request unless a shorter period for deletion is required by law.
Provision X requires that Respondent (1) document and adhere to a
retention schedule for the covered information it collects from
consumers, including the purposes for which it collects such
information, the specific business needs, and an established timeframe
for its deletion, and (2) prior to collecting or using new type of
information related to consumers that was not previously collected, and
is not described in its retention schedule, update its retention
schedule.
Provision XI requires Respondent to provide a notice to each
consumer whose location data was collected through the Respondent's
apps without Affirmative Express Consent, either via email or in the
app itself, notifying the consumer about InMarket's settlement with the
Commission.
Provision XII requires that Respondent delete or destroy all
historic location data. Respondent has the
[[Page 4304]]
option to retain historic location data if it has obtained affirmative
express consent or it ensures that the historic location data is
deidentified or rendered non-sensitive. Provision XIII requires
Respondent to establish and implement, and thereafter maintain, a
comprehensive privacy program that protects the privacy of consumers'
personal information.
Provisions XIV-XVII are reporting and compliance provisions, which
include recordkeeping requirements and provisions requiring Respondent
to provide information or documents necessary for the Commission to
monitor compliance.
Provision XVIII states that the Proposed Order will remain in
effect for 20 years, with certain exceptions.
The purpose of this analysis is to facilitate public comment on the
Proposed Order, and it is not intended to constitute an official
interpretation of the complaint or Proposed Order, or to modify the
Proposed Order's terms in any way.
By direction of the Commission.
April J. Tabor,
Secretary.
[FR Doc. 2024-01269 Filed 1-22-24; 8:45 am]
BILLING CODE 6750-01-P