On May 25, 2012, the Federal Communications Commission (FCC) released a report on location-based services (LBS) outlining government and industry efforts to address the privacy issues surrounding such services. The FCC declined to adopt any regulations or best practices, but stated it would “continue to monitor industry compliance with applicable statutory requirements and evolving industry best practices.”  

The FCC identified several privacy issues implicated by location-based services, specifically:

• Notice and transparency. After noting the importance of companies informing users of what the company is doing with collected LBS information, the FCC recognized various industry efforts by CTIA, the Mobile Marketing Association, the Direct Marketing Association, and private companies to provide users with notice of how location-based service information is used.  However, the FCC cited numerous reports that concluded many apps lacked basic privacy policies.
• Meaningful consumer choice. Consumers should have an opportunity to tell a company what it can and cannot do with their information. The FCC noted that most choice is provided as “opt-in,” i.e. the user must consent before the information is used, but that challenges arise between real-time meaningful choice and user experience. Industry standards, such as CTIA, are identified by the FCC as providing guidance on consumer choice.
• Third party access to personal information. Noting that many entities, such as the carrier, operating system, and app developer, may have access to LBS information, the FCC identified app developers in particular as possibly not having privacy standards in place. The FCC noted that entities like the Future of Privacy Forum and TRUSTe are recommending app developers adopt privacy practices, and that mobile operating systems and carriers are requiring apps seek permission before using location-based services.
• Data security and minimization. The FCC noted that because location-based service data is considered particularly sensitive information, heightened security requirements can be reasonably expected of the industry. The FCC also noted that as little data should be stored for a short a period as possible to lessen security breaches, although there is a tension because law enforcement would find location data valuable suggesting longer storage times would be valuable. 

In conclusion, the FCC stated that it will continue to monitor these issues, specifically:

• Consideration of Privacy Issues at Earliest Stages of Product Development. What are the most effective means to ensure privacy considerations become an integral part of the product design and development process for all players in the LBS industry? What should consumers be told?
• Security of data. What are the rights, duties, and obligations of the parties that generate, aggregate, or hold LBS-related data to secure such data from unauthorized disclosure or access? Do they vary as a result of a party’s relationship with the customer?
• Timing and sufficiency of notice. How much information should be pushed to consumers at different points in their interaction with an LBS, mobile, application or other provider and how should it be presented? Must the information be provided each time an application or service is used? Should there always be an opt out?
• Data Minimization. Should parties be encouraged to collect the minimal amount of data technically required to provide a location-based service and retain that data for the minimum amount of time necessary?

The FCC stated it will take additional steps if privacy issues are not being met as effectively and comprehensively as possible or within reasonable time frames.

The LBS report is available here.

For further information, contact Ross A. Buntrock, Michael B. Hazzard, or Jason A. Koslofsky or any of our attorneys in the Telecom Group.