Broad access to personal data raises a potential competitive advantage when advertising products to a diverse range of consumers. In particular, the use of sensitive geolocation data toward targeted advertising campaigns is proliferating and attracting attention from U.S. consumers and regulators alike.
The availability of location data through data brokerage and general technology advances are spurring new opportunities for collection and subsequent monetization. "It is incredible how granular this data can get," Texas Attorney General's Office Director of Privacy and Tech Enforcement Tyler Bridegan, CIPP/E, said during a recent BBB National Programs webinar.
"I think we will continue to see sort of how that monetization plays out in new use cases," Bridegan added. "Companies should be cautioned to make sure their customers know what is ultimately happening with that data."
Enforcement efforts
U.S. federal and state regulators are notably active on alleged location data matters within the last year.
The U.S. Federal Trade Commission, under former chair Lina Khan, took significant actions on location data allegations, most notable being its January settlement with automaker General Motors and subsidiary OnStar that bans their disclosure of drivers' location data for five years while mandating obtained consent before selling driver data. The agency also finalized actions against several data brokers' location data sales.
The Texas attorney general's office brought its own action in the GM location data case before the FTC settlement, suing the company in August 2024 based on findings from a broader investigation into the automobile industry's potential privacy violations months earlier. Texas also brought location data charges against Insurer Allstate and subsidiary Arity following the industry probe.
Through these cases, Bridegan said Texas has observed traditional targeted advertising use evolve "into new ways of monetizing that data." In the driving data context, he said location data is being leveraged toward insurance underwriting, potentially harming consumers' ability to obtain car insurance due to unfavorable data shared about their driving habits.
Arkansas recently brought its own General Motors and OnStar location data actions, suing them under the state's Deceptive Trade Practices Act. In a statement, Arkansas Attorney General Tim Griffin said the alleged nonconsensual practices "deceived consumers" and the state will seek "monetary relief, injunctive relief, and attorneys’ fees and expenses."
While state-level enforcement is showing signs of growth, the FTC may dial back its work on location data and other privacy violations. FTC Chair Andrew Ferguson previously signaled the agency will limit the application of Section 5 of the FTC Act in privacy cases, as the agency will look to "stop abusing FTC enforcement authorities as a substitute for comprehensive federal privacy legislation."
Despite a change in the FTC's posture, Hunton Andrews Kurth Partner and former FTC Division of Advertising Practices Chief of Staff Phyllis Marcus said there is still a "sense among these commissioners that there can be actual consumer injury from collecting sensitive information from consumers."
The FTC may view a potential privacy violation as the "collection of sensitive information without consent, but not in the packaging of that information," according to Marcus. "There doesn't seem to be support for the idea that targeted advertising in and of itself violates section five."
Self-regulatory efforts
BBB National Programs' Digital Advertising Accountability Program recently worked with the NFL to bring the sports league into the agency's compliance requirements after the DAAP found the NFL did not offer consumers the option to opt out of targeted advertising.
In coordination with DAAP, the NFL updated its privacy policy to increase transparency about the company's advertising practices, and its use of consumers geolocation data. The NFL also worked to implement an enhanced notice of location sharing and allowed consumers to opt out of sharing location information.
"The NFL case represents a concrete win for industry self-regulation, and it demonstrates that industry can rely on a common code of principles, work to comply with that code, and then be trusted to be held accountable for it," BBB National Programs Global Privacy Division and Privacy Initiatives Operations Vice President Divya Sridhar said.
Best practices
Keys to ensuring lawful data use include valid consent and transparency, but further considerations come into play with secondary use of personal information beyond its initial collection. BBB National Programs Executive Vice President of Policy Mary Engle said "meaningful" and "informed" consent can't be limited to the initial collection and must be tended to throughout the life cycle of data use.
"It is not enough to just say 'Well, we have updated our privacy policy,'" Engle said. "That kind of notice is not consent."
BBB's Digital Advertisers Alliance's Principles and IAB Tech Lab's Accountability Platform represent some of the self-regulatory tools available to bolster compliance efforts, including those around location data use.
From the regulator perspective, Bridegan said companies should put themselves "in the consumers' shoes" to reduce consumer concerns about organizations' use of data while being proactive in navigating risks associated with sensitive information.
Lexie White is a staff writer for the IAPP
