	Background

Consumers may access location-based services through smartphones or  from in-car location-based services. Companies can obtain location data in various ways. Several agencies have responsibility to address consumers’ privacy and  create related guidance. The Federal Trade Commission (FTC) has  authority to enforce action against unfair or deceptive acts or practices of  companies; the Federal Communications Commission (FCC) has  regulatory and enforcement authority over mobile carriers; and the  Department of Commerce’s (Commerce) National Telecommunications  and Information Administration (NTIA) advises the President on  telecommunications and information policy issues. Companies Primarily Collect and Share Location Data to Provide and Improve Consumer Services

Representatives from mobile industry companies we spoke to for the  September 2012 report and in-car navigation service companies we  spoke to for the December 2013 report told us they primarily collect and  share location data to provide location services and to improve those  services. Mobile carriers and application developers offer a diverse array  of services that use location information, such as services providing  navigation and social networking services that are linked to consumers’  locations. Location data can also be used  to enhance the functionality of other services that do not need to know the  consumer’s location to operate. Search engines, for example, can use  location data as a frame of reference to return results that might be more  relevant. In- car location services use location data to provide services such as turn- by-turn directions or roadside assistance. Companies’ Collection and Sharing of Location Data May Put Consumers’ Privacy at Risk

Although consumers can benefit from location-based services designed  to make their lives easier, consumers also expose themselves to privacy  risks when they allow companies to access their location data. As we stated in our September 2012 and December 2013  reports, these privacy risks include, but are not limited to the following:  Disclosure to Unknown Third Parties for Unspecified Uses:  According to privacy advocates, when a consumer agrees to use a  service that accesses location data, the consumer is unlikely to know how  his or her location data may be used in ways beyond enabling the service  itself. Amassing  such data over time allows companies to create a richly detailed profile of  individual behavior, including habits, preferences, and routines—private  information that could be exploited. Identity Theft: Criminals can use location data to steal identities when  location data are disclosed, particularly when they are combined with  other personal information. Selected Companies Have Not Consistently Implemented Practices to Protect Consumers’ Location Privacy; Federal Agencies Have Taken Actions but Federal Privacy Law Is Not Comprehensive

		Private Sector Entities Have Implemented Some Recommended Practices to Protect Consumers’ Location Privacy, but Not Consistently

Industry and privacy advocacy groups have recommended practices for  companies to follow in order to better protect consumers’ privacy while  using their personal information. For the September 2012  report, we examined 14 mobile industry companies, and the for  December 2013 report, we examined 10 in-car navigation services  companies. However, some companies have not  consistently or clearly disclosed to consumers what they are doing with  these data or which third parties they may share them with. As we reported in 2013, companies may safeguard location data that they  use or share, in part, by de-identifying them, but companies we examined  used different de-identification methods. 1). Accountability: We reported in 2012 and 2013 that companies’  accountability practices varied. For example, all 10 of the in-car  navigation services companies we examined for the 2013 report stated in  their disclosures or in interviews with us that they take steps to protect  location data that they share with third parties. Lacking clear information about how companies use and share  consumers’ location data, consumers deciding whether to allow  companies to collect, use, and share data on their location would be  unable to effectively judge whether their privacy might be violated. Federal Agencies Have Taken Actions to Protect Consumer Privacy

In our September 2012 report on mobile device location data, we reported  that federal agencies that have responsibility for consumer data privacy  protection have taken steps to promote awareness of privacy issues,  such as providing educational outreach and recommending actions aimed  at improving consumer privacy. For example, we found that NTIA  had not defined specific goals, milestones, or performance measures for  its proposed multistakeholder process, which consists of different groups  involved with consumer privacy coming together to discuss relevant  issues with the goal of developing codes of conduct for consumer privacy. Therefore, it was unclear whether the process would address location  privacy. In a December 2012 response to our  report, the Department of Commerce (NTIA is an agency of Commerce)  said it disagreed with this recommendation, stating that it is the role of the  stakeholders, not the agency, to develop goals, time frames, and  performance measures for the multistakeholder process. We will continue to  monitor NTIA’s efforts in this area. Doing so could inform  companies of FTC’s views on the appropriate actions companies should  take to protect consumers’ mobile location privacy.
Why GAO Did This Study

Smartphones and in-car navigation systems give consumers access to useful location-based services, such as mapping services. However, questions about privacy can arise if companies use or share consumers' location data without their knowledge.
Several agencies have responsibility to address consumers' privacy issues, including FTC, which has authority to take enforcement actions against unfair or deceptive acts or practices, and NTIA, which advises the President on telecommunications and information policy issues.
This testimony addresses (1) companies' use and sharing of consumers' location data, (2) consumers' location privacy risks, and (3) actions taken by selected companies and federal agencies to protect consumers' location privacy.
This testimony is based on GAO's September 2012 and December 2013 reports on mobile device location data and in-car location-based services and December 2012 and May 2013 updates from FTC and NTIA on their actions to respond to the 2012 report's recommendations.

What GAO Found

Fourteen mobile industry companies and 10 in-car navigation providers that GAO examined in its 2012 and 2013 reports—including mobile carriers and auto manufacturers with the largest market share and popular application developers—collect location data and use or share them to provide consumers with location-based services and improve consumer services. For example, mobile carriers and application developers use location data to provide social networking services that are linked to consumers' locations. In-car navigation services use location data to provide services such as turn-by-turn directions or roadside assistance. Location data can also be used and shared to enhance the functionality of other services, such as search engines, to make search results more relevant by, for example, returning results of nearby businesses.
While consumers can benefit from location-based services, their privacy may be at risk when companies collect and share location data. For example, in both reports, GAO found that when consumers are unaware their location data are shared and for what purpose data might be shared, they may be unable to judge whether location data are shared with trustworthy third parties. Furthermore, when location data are amassed over time, they can create a detailed profile of individual behavior, including habits, preferences, and routes traveled—private information that could be exploited. Additionally, consumers could be at higher risk of identity theft or threats to personal safety when companies retain location data for long periods or in a way that links the data to individual consumers. Companies can anonymize location data that they use or share, in part, by removing personally identifying information; however, in its 2013 report, GAO found that in-car navigation providers that GAO examined use different de-identification methods that may lead to varying levels of protection for consumers.
Companies GAO examined in both reports have not consistently implemented practices to protect consumers' location privacy. The companies have taken some steps that align with recommended practices for better protecting consumers' privacy. For example, all of the companies examined in both reports used privacy policies or other disclosures to inform consumers about the collection of location data and other information. However, companies did not consistently or clearly disclose to consumers what the companies do with these data or the third parties with which they might share the data, leaving consumers unable to effectively judge whether such uses of their location data might violate their privacy. In its 2012 report, GAO found that federal agencies have taken steps to address location data privacy through educational outreach events, reports with recommendations to protect consumer privacy, and guidance for industry. For example, the Department of Commerce's National Telecommunications and Information Administration (NTIA) brought stakeholders together to develop codes of conduct for industry, but GAO found this effort lacked specific goals, milestones, and performance measures, making it unclear whether the effort would address location privacy. Additionally, in response to a recommendation in GAO's 2012 report, the Federal Trade Commission (FTC) issued guidance in 2013 to inform companies of the Commission's views on the appropriate actions mobile industry companies should take to disclose their privacy practices and obtain consumers' consent.

What GAO Recommends

GAO made recommendations to enhance consumer protections in its 2012 report. GAO recommended, for example, that NTIA develop goals, milestones, and measures for its stakeholder initiative. NTIA stated that taking such actions is the role of the stakeholders and that its stakeholders had made progress in setting goals, milestones, and performance measures. GAO will continue to monitor this effort.