InMobi ad network, which reaches more than 1 billion devices, settles FTC charges.
A mobile advertising company that tracked the locations of hundreds of millions of consumers without consent has agreed to pay $950,000 (£640,000) in civil penalties and implement a privacy program to settle charges that it violated federal law.
The US Federal Trade Commission alleged in a complaint filed Wednesday that Singapore-basedInMobi undermined phone users’ ability to make informed decisions about the collection of their location information. While InMobi claimed that its software collected geographical whereabouts only when end users provided opt-in consent, the software in fact used nearby Wi-Fi signals to infer locations when permission wasn’t given, FTC officials alleged. InMobi then archived the location information and used it to push targeted advertisements to individual phone users.
Specifically, the FTC alleged, InMobi collected nearby basic service set identification addresses, which act as unique serial numbers for wireless access points. The company, which thousands of Android and iOS app makers use to deliver ads to end users, then fed each BSSID into a “geocorder” database to infer the phone user’s latitude and longitude, even when an end user hadn’t provided permission for location to be tracked through the phone’s dedicated location feature.
“Defendant represented in disclosures… that it tracked the consumer’s location and served geo-targeted ads only if the application developer and the consumer provided access to the location APIs, and the consumer provided opt-in consent,” Wednesday’s complaint, which was filed in San Francisco federal court, stated. “In fact, defendant collected and used BSSID and other Wi-Fi network information to track the consumer’s location and serve geo-targeted ads regardless of the application developer’s intent to include geo-targeted ads, and regardless of the consumer’s location settings.”
According to the FTC, the InMobi advertising network has reached more than one billion devices worldwide through thousands of popular apps that integrate InMobi code. Many of the third-party app makers indicated that their wares were designed for children, many under the age of 13, making the collection a violation of the Children’s Online Privacy Protection Act, the FTC alleged.
“Collectively, hundreds of millions of consumers have downloaded the thousands of child-directed applications from which defendant collected and used personal information,” the complaint stated. “Defendant collected such personal information each time an application made an ad request to their network—typically every 30 seconds when an application is in use.”
Under terms of the settlement, InMobi will pay a civil penalty of $950,000 and delete all information it collected from children and all information collected from adults who didn’t provide their consent. The settlement also requires InMobi to implement a comprehensive privacy program that will be independently audited every two years for the next two decades. InMobi was subject to a $4 million civil penalty, which was lowered to $950,000 “based on the company’s financial condition,” the FTC said in a statement issued Wednesday, without elaborating.
The episode is another reminder of the benefits of turning off mobile device Wi-Fi when a connection isn’t needed. By leaving it on, users often unknowingly leave breadcrumbs that can be used by bothaccess point operators and ad networks to track the comings and goings of the mobile device.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
