Last week, the LA City Attorney announced that it has agreed to settle its lawsuit against The Weather Channel over alleged improper location data practices. The settlement serves as reminder about the increasing scrutiny over location data, and the need to revisit policies and practices in preparation for the launch of iOS 14.
As a quick recap of events, in January 2019 the LA City Attorney brought a lawsuit against TWC Product and Technology LLC (the operator of The Weather Channel app) and its parent company IBM for allegedly violating California's unfair competition law. The lawsuit alleged that The Weather Channel app asked users to provide access to their location data when first opening the app for "personalized local weather data, alerts and forecasts," but unfairly and deceptively used that location data for advertising and other commercial purposes, including for purposes of TWC and IBM building their own location targeting platform and sharing with third party hedge funds. According to the complaint, TWC and IBM violated the law by failing to sufficiently disclose their use of location data for advertising and other commercial purposes, and misleading users into giving opt-in consent for access to location data.
The parties filed various pleadings, and settled on August 10, 2020. In the settlement, the LA City Attorney released all claims against TWC and IBM in return for the defendants agreeing to (1) revise their opt-in consent notice to include additional disclosures regarding location data; (2) revise their "learn more" page to include additional disclosures regarding location data; and (3) give reasonable notice to the LA City Attorney in advance of any changes made to those disclosures for the next two years. Separate from the lawsuit, IBM also agreed to donate roughly $1 million of equipment to LA to help with COVID-19 contact tracing efforts.
The lawsuit and settlement provide some key takeaways for companies that collect location data:
- Get your consent right: The collection of precise location data generally requires opt-in consent. While iOS and Android provide tools for obtaining consent, companies often fail to disclose all the intended uses for data in the consent box. In this case, The Weather Channel allegedly collected location data for purposes beyond those necessary to provide its weather services. If your company intends to use location data beyond those necessary to provide the services, make sure those purposes are clearly set out in the consent box. Otherwise the consent obtained may not be sufficient to cover the intended purposes.
- Provide clear and conspicuous disclosures. One of the major allegations in the complaint was that the defendants did not provide clear and conspicuous disclosures around their location data practices. In the settlement, the LA City Attorney required the defendants to clarify their practices in the consent box and "learn more" page, including adding cross-references to the privacy policy and permission settings. Clear and conspicuous disclosures are not just a good idea, they are required by law.
- Monitor your sharing with third parties. Many companies automatically share location data with third parties through SDKs, APIs, and other integrated technologies. Even if you think a third party your company shares location data with is only using the data to provide services to you, make sure that is accurate. Your company could be held responsible for the practices of third party data recipients.
- The definition of location data is a moving target. Despite using the term "location" over seventy times in the complaint, the LA City Attorney never expressly defined the term. The complaint alleged that The Weather Channel app tracked user movements in minute detail, and the collection was not limited to general information about state, city, or zip code. This vague definition illustrates that not all regulators are on the same page as to what constitutes location data. Most companies in the advertising space rely on the NAI's definition of precise location data, but that may change in the near future. California's new ballot initiative, the California Consumer Privacy Rights Act (CPRA), includes a much a broader definition of location data.
- Regulators come in all shapes and sizes. When we use the term "regulator," we generally think about the FTC and State Attorneys General. However, this lawsuit is an example of a city taking action against a company. Expect more actions from various regulatory bodies moving forward.
- Not all publicity is good publicity. In December 2018, a major news organization published an article around location data, which highlighted The Weather Channel app. One month later, the LA City Attorney filed its complaint against The Weather Channel app, which specifically referenced that article. This lawsuit is a good example of how regulators often chase low hanging fruit.
- Prepare for iOS 14. The settlement noted that the defendants may need to change their disclosures in the near future due to changes in operating system functionality, among other things. This note is likely a reference to the upcoming release of iOS 14, which will impose new privacy obligations on companies, including robust app store disclosures, opt-in consent for tracking, and controls over precise location data. Companies should review the iOS 14 developer privacy guidelines in preparation for the release later this year.
This post first appeared in Frankfurt Kurnit's Focus on the Data blog (www.focusonthedata.com). It provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
