Companies Collect, Use, and Share Location Data That Provide Consumer Benefits, but Also Pose Privacy Risks

Collecting, using, and sharing location data provides benefits for both  mobile industry companies and for consumers. Furthermore, as stated previously, the sharing of location data  facilitates a faster response from emergency services through E911 and  allows companies to identify network service problems. Users generally do not know when law enforcement agencies access  their location data. Private Sector Entities Have Not Consistently Implemented Recommended Practices to Protect Consumers’ Location Privacy

Mobile industry associations and privacy advocacy organizations have  recommended practices for industry to better protect consumers’ privacy  while making use of customers’ personal information. Companies we  examined have developed privacy policies to disclose information to  consumers about the collection of location data and other personal  information, but have not consistently or clearly disclosed to consumers  what the companies are doing with these data or which third parties they  may share them with. However, some policies  were not clear about how the companies used location data. Companies’ policies on whether location data were considered personal  information varied. Most policies we examined stated the types of  third-party companies location data may be shared with, such as  application developers and advertisers; however, some policies described  third parties with vague terms such as “trusted businesses” or “others.”  Although some policies stated that the company takes steps to protect  this information, such as requiring the third party to follow the company’s  privacy policy, others made no such statement, and one company’s policy  said it would not be liable if the third party it shares data with fails to  protect it. For example,  although privacy policies generally discussed that users’ data could be  shared with third parties, they sometimes included vague statements like  “trusted business partners” rather than specifying the types of companies  they shared the data with and the reasons for doing so. Agencies Have Taken Actions to Promote Awareness of Privacy Issues

Several federal agencies that interact with the mobile industry or have  responsibilities for consumer privacy protection have provided  educational outreach to the public, developed reports with  recommendations aimed at protecting consumer privacy, developed  regulatory standards that address mobile-location data privacy, and  developed guidance for law enforcement on obtaining mobile location  data. Specific topics discussed included how location-based services work; what parents should know about location tracking when their children  trends, benefits, and risks of location-based services;  industry recommended practices; and  use mobile devices. The report also included recommendations to  companies that make use of precise mobile location data, including that  they should obtain affirmative express consent from consumers before  collecting precise location data; limit collection to data needed for a  requested service or transaction; establish standards that address data  collection, transfer, use, and disposal, particularly for location data; and,  to the extent that location data are collected and shared with third parties,  work to provide consumers with more prominent notice and choices about  such practices. Commission last solicited public input on this question 5 years ago and  technologies and business practices in this area have changed, the  Commission sought comments on a variety of issues including:  the applicability and significance of telecommunications carriers’ duty  under section 222(a) of the Communications Act to protect customer  information stored on their users’ mobile communications devices; whether the definition of CPNI could apply to information collected at  a carrier’s direction even before it has been transmitted to the carrier; what factors are relevant to assessing a wireless provider’s  obligations under section 222 of the Communications Act, as  amended, and the Commission’s implementing rules, or other  provisions of law within the Commission’s jurisdiction, and in what  ways; what privacy and security obligations should apply to customer  information that service providers cause to be collected by and stored  on mobile communications devices; and what should be the obligations when service providers use a third  party to collect, store, host, or analyze such data. Lacking defined performance goals, milestones, and deliverables, it  is unclear whether NTIA’s multistakeholder process will establish an  effective means for addressing mobile location data privacy issues. Such guidance could also clarify for companies  circumstances under which FTC might take enforcement action against  unfair acts. A key federal effort to address these privacy risks is NTIA’s planned  multistakeholder process, which seeks to develop industry codes of  conduct. However, NTIA has not defined the effort’s performance goals,  milestones, or deliverables. However, FTC  has not issued comprehensive industry guidance establishing its views on  the appropriate actions that mobile companies should take to protect  consumers’ mobile location data privacy. Recommendations for Executive Action

To address privacy risks associated with the use and sharing of mobile  location data, we recommend that the Secretary of Commerce direct  NTIA, in consultation with stakeholders in the multistakeholder process, to  develop specific goals, time frames, and performance measures for the  multistakeholder process to create industry codes of conduct. Appendix I: Objectives, Scope, and Methodology

Our objectives were to examine  (1)  how mobile industry companies collect location data, why they use  and share these data, and how this affects consumers;  (2)  the types of actions private sector entities have taken to protect  consumers’ privacy and ensure security of location data; and  (3)  the actions federal agencies have taken to protect consumer  privacy and what additional federal efforts, if any, are needed. We also interviewed officials from federal agencies  that interact with the mobile industry or have responsibilities for consumer  privacy protection, including the Federal Communications Commission  (FCC), Federal Trade Commission (FTC), Department of Commerce’s  National Telecommunications and Information Administration (NTIA), and  Department of Justice (Justice), to obtain their views.
Why GAO Did This Study

Smartphones can provide services based on consumers' location, raising potential privacy risks if companies use or share location data without consumers' knowledge. FTC enforces prohibitions against unfair and deceptive practices, and NTIA sets national telecommunications policy. GAO was asked to examine this issue. GAO reviewed (1) how mobile industry companies collect location data, why they share these data, and how this affects consumers; (2) actions private sector entities have taken to protect consumers' privacy and ensure security of location data; and (3) actions federal agencies have taken to protect consumer privacy and what additional federal efforts, if any, are needed. GAO analyzed policies and interviewed representatives of mobile industry companies, reviewed documents and interviewed officials from federal agencies, and interviewed representatives from industry associations and privacy advocates.

What GAO Found

Using several methods of varying precision, mobile industry companies collect location data and use or share that data to provide users with location-based services, offer improved services, and increase revenue through targeted advertising. Location-based services provide consumers access to applications such as real-time navigation aids, access to free or reduced-cost mobile applications, and faster response from emergency services, among other potential benefits. However, the collection and sharing of location data also pose privacy risks. Specifically, privacy advocates said that consumers: (1) are generally unaware of how their location data are shared with and used by third parties; (2) could be subject to increased surveillance when location data are shared with law enforcement; and (3) could be at higher risk of identity theft or threats to personal safety when companies retain location data for long periods or share data with third parties that do not adequately protect them.
Industry associations and privacy advocates have developed recommended practices for companies to protect consumers' privacy while using mobile location data, but companies have not consistently implemented such practices. Recommended practices include clearly disclosing to consumers that a company is collecting location data and how it will use them, as well as identifying third parties that companies share location data with and the reasons for doing so. Companies GAO examined disclosed in their privacy policies that the companies were collecting consumers' location data, but did not clearly state how the companies were using these data or what third parties they may share them with. For example, some companies' policies stated they collected location data and listed uses for personal information, but did not state clearly whether companies considered location to be personal information. Furthermore, although policies stated that companies shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data. Lacking clear information, consumers faced with making a decision about whether to allow companies to collect, use, and share data on their location would be unable to effectively judge whether the uses of their location data might violate their privacy.
Federal agencies have held educational outreach events, developed reports with recommendations aimed at protecting consumer privacy, and developed some guidance on certain aspects of mobile privacy. The Department of Commerce's National Telecommunications and Information Administration (NTIA) is implementing an administration-proposed effort to bring industry, advocacy, and government stakeholders together to develop codes of conduct for industry to address Internet consumer privacy issues generally. However, NTIA has not set specific goals, milestones, and performance measures for this effort. Consequently, it is unclear if or when the process would address mobile location privacy. Furthermore, the Federal Trade Commission (FTC) could enforce adherence to the codes if companies adopted them, but since adoption is voluntary, there is no guarantee companies would adopt the resulting codes. While FTC has issued some guidance to address mobile location privacy issues, it has not issued comprehensive guidance that could inform companies of the Commission's views on the appropriate actions companies should take to protect consumers' mobile location data privacy.

What GAO Recommends

GAO recommends that NTIA work with stakeholders to outline specific goals, milestones, and performance measures for its process to develop industry codes of conduct and that FTC consider issuing guidance on mobile companies' appropriate actions to protect location data privacy. Because the agencies had concerns about certain aspects of GAOs draft recommendations, GAO revised them by including that NTIA should work with stakeholders in the process to develop industry codes and removing from the draft FTC recommendation that the guidance should include how FTC will enforce the prohibition against unfair practices.