Who Is Policing the Location Data Industry?
Google and Apple have tried to crack down, but location data brokers are moving to a new way to collect your whereabouts that’s much harder to detect By Alfred Ng and Jon Keegan
There is an estimated $12 billion market of companies that buy and sell location data collected from your cellphone. And the trade is entirely legal in the U.S.
Without legislation limiting the location data trade, Apple and Google have become the de facto regulators for keeping your whereabouts private—through shifts in transparency requirements and crackdowns on certain data brokers.
Specifically, the app stores have cracked down on data brokers that market software development kits (SDKs) to app developers—like X-Mode (now known as Outlogic), which has come under scrutiny for selling data to military contractors. It’s common for app developers to embed SDKs to add features to their apps without having to build them from scratch, but these SDKs specifically were designed to send app user location data to brokers.
But experts and location data industry workers tell The Markup that the moves have been insufficient; there are plenty of loopholes in Apple’s and Google’s policies that allow location data to still be collected, even without using those SDKs.
“The challenge, and this is a challenge with data brokers in general, is that you’re playing whack-a-mole, where these companies have many different vectors through which they get people’s sensitive information,” Justin Sherman, a cyber policy fellow at the Duke Technology Policy Lab, said.
Apple and Google both have policies for companies selling location data. But it’s not clear if the tech giants enforce those policies—or even how they would do so.
Apple’s policy requires apps to disclose what data they are collecting from people and how it can be used and to get consent from users before sharing their data. However, it doesn’t require apps to disclose exactly who they are selling data to, and many apps simply state that they share data with partners.
For instance, when The Markup uncovered the fact that Life360 was selling location data to nearly a dozen location data brokers in 2021, we relied largely on former employees of the company to tell us to whom and to what extent the company was selling data on its users’ movements.
Only two companies, of about a dozen, were mentioned in the app’s privacy policy. The rest, according to CEO Chris Hulls, were hidden behind confidentiality clauses, which are common in the industry due to the competitive value of the data.
That all appears to be in line with the Apple store policy.
“In order to submit new apps and app updates, you need to provide information about some of your app’s data collection practices on your product page,” Apple says in its privacy policy for developers. “With iOS 14.5, iPadOS 14.5, and tvOS 14.5 and later, you’re required to ask users for their permission to track them across apps and websites owned by other companies.”
For location data specifically, once the user has granted permissions, Apple’s policy notes that people are subject to apps’ privacy policy and practices, which can include selling their data.
Google’s policy goes a step further, stating that developers cannot sell personal and sensitive user data, which includes device location. The company also requires disclosure, telling developers that they “must be transparent in how you handle user data.”
Some policies are easy to audit (though not necessarily enforce), like Apple’s and Google’s ban on X-Mode’s SDKs. But the companies don’t give any indication of how they would enforce these rules around other methods of data collection that the very same banned brokers are using, like buying data directly from app publishers.
