Privacy Lawsuit Against App Publisher Has Potential Industry-wide Repercussions

Los Angeles City Attorney Michael Feuer has brought a lawsuit against The Weather Channel (TWC) on behalf of the people of the State of California for serving geolocation-specific advertisements through its mobile application (app) without allegedly sufficient notice and consent. The People of the State of California v. TWC Product and Technology, LLC, Los Angeles Superior Court Case No. _ (filed January _, 2019) (complaint). The suit is being brought under California’s unfair competition law (the UCL) as an unfair and deceptive practice. California Business and Professions Code Sections 17200 et seq. The suit asserts that TWC “deceptively collected, shared and profited from the location information of millions of American consumers,” using their data for practices such as targeted marketing and hedge fund analysis.

The city attorney’s claim of insufficiency of transparency and choice is brought notwithstanding that the app’s privacy policy and settings disclose that geolocation may be shared with third parties for commercial purposes and used for advertising. The complaint alleges that since the pop-up request for consent to track location (an Apple and Android requirement) does not explain these uses, nor does the app’s description in the app store, the privacy policy and settings disclosures are inadequate, because users would not have “any reason to believe that their location will be used for anything other than personalized local weather, data, alerts and forecasts. Users therefore have no reason to seek such information by combing through the app’s lengthy ‘Privacy Policy’ and ‘Privacy Settings’ sections – buried in each of which are opaque discussions of TWC’s potential transmission of geolocation data to third parties and use for additional commercial purposes. Indeed, on information and belief, the vast majority of users do not read those sections at all.”

In other words, the theory of the case is that it is a deceptive and unfair practice under California law to rely on consent to enable location awareness generally and a disclosure of the advertising and other commercial uses of that data collection in the privacy policy, rather than to provide far more clear, conspicuous and proximate notice of the data practices. If successful, this case could move transparency and choice best practices to a legal baseline, and in doing so alter the way many website and mobile app publishers provide notice of things like interest-based and location-aware advertising. It could also open the litigation floodgates, since the UCL permits class actions by private plaintiffs.

The suit seeks civil penalties of up to $2,500 for each violation of the UCL. In these cases, a judge determines the number of violations and the amount of the penalties based on the AG’s recommendations, but the number of incidents could be calculated broadly based on number of users and data uses, in which case the potential penalties could be enormous. This case reflects a growing trend of increased sensitivity by consumers, lawmakers, regulators and consumer protection authorities regarding the ways companies collect, use and share consumer data, and what transparency and choice they provide data subjects. It also demonstrates that even without specific privacy legislation such as that recently passed by California (our prior posts here and here), state and local prosecutors, and in many states private plaintiffs, may be able to challenge commercially commonplace data practices under state unfair and deceptive practices acts and other consumer protection laws of general application.

The California attorney general issued guidance in 2013 on recommendations for mobile app privacy notice and practices – “Privacy on the Go.” The U.S. Federal Trade Commission (FTC) published similar guidance also in 2013 – “Mobile Privacy Disclosures, Building Trust Through Transparency.” The guidance provided by the California attorney general recommends providing a notice that location data will be collected, and an option to allow or prevent the practice. Similarly, the FTC recommends providing a “just-in-time disclosure to consumers and obtain their affirmative express consent before allowing apps to access sensitive content like geolocation.” While both are mere recommendations and not regulatory requirements, companies should review their website and mobile app privacy practices and notices and take these recommendations into consideration in deciding if they need to provide more enhanced notice or greater data subject control.

While TWC appeared to be following the recommendations from the California attorney general and the FTC regarding mobile app privacy and providing notice of location tracking practices, the Los Angeles city attorney is seeking a level of transparency beyond even what the attorney general and FTC have suggested as best practices. Interestingly, in December, a major social media platform was fined under a similar action in Italy. The fine was not brought by the Italian Data Protection Authorities, but instead was issued by the Italian Competition Authority (ICA). The ICA found the social media platform to be in violation of articles 21 and 22 of the Italian Consumer Code for misleading consumers about how their data will be used for commercial purposes. Accordingly, there appears to be a worldwide trend of applying consumer protection laws of general application to data practices. Indeed, the U.S. Federal Trade Commission has long relied on its deception and unfairness authority under Section 5 of the FTC Act to regulate consumer privacy. The Weather Channel case is not unique in relying on unfair and deceptive acts and practices laws to address consumer data practices, but it does suggest the standards for measuring deception and unfairness when it comes to transparency and choice may be evolving.

Although we do not necessarily agree with the city attorney that a failure by TWC to provide more specific particularity around its geolocation practices constituted deceptive or unfair practices, considering the position the city attorney has taken, we recommend that companies consider adopting some kind of enhanced notice. For instance, as suggested by the Los Angeles city attorney, the description of the app in the app store could explain that the app is ad-supported and uses location to send location-relevant ads. Or there could be enhanced in-app notice as part of the app download and onboarding process, such as use of a pop-up or push notification. Publishers may even be able to provide a customized location permission request alert. Apple allows apps to provide a custom text known as a purpose string or usage description string for display in the system’s permission request alert. See https://developer.apple.com/design/human-interface-guidelines/ios/app-architecture/requesting-permission/. While we have not seen apps live in the U.S. with custom language around location in the permission request, we have seen a higher level of particularity within these requests in the EU. For example, many EU app disclosures state that location will be used for “geographically relevant ads.” This is not surprising, since EU law, unlike U.S. law, specifically requires explicit consent to collection and particular uses of geolocation data. Here, TWC did use a custom permission request alert, which stated, “Allow ‘The Weather’ to access your location? You’ll get personalized local weather data, alerts and forecasts.” If that notice had included “and location-relevant ads,” that might have been enough for the company to avoid the claims on inadequate notice and choice.

It is significant to note that this is not the first case of this kind. The FTC, and other states, have brought similar actions against companies for deceptive business practices around disclosures of location tracking practices. Prior cases, however, have involved publishers providing an opt-out from GPS location tracking while continuing to track location using other methods such as Wi-Fi tower proximity, and not explaining to users that the opt-out really did not stop location tracking, but stopped merely one form of it. Those cases are markedly different from the Weather Channel case, which is really about enhanced notice.

We will monitor this case and report on how it progresses. In the meantime, companies should consider the ways they give notice of data practices, especially those that might arguably be unexpected by data subjects, and consider when and how to give enhanced notice and choice. For more information, contact the authors.