The most important things to know about your location tracking app

 

Chances are, your phone is currently sending location data to some company.

Many apps on your smartphone track your location, often for obvious-sounding reasons. Your weather app wants to tell you local conditions. Branded fast food apps like Chick-Fil-A' will find the location closest to you. Dating and matching apps want to connect you with people in your area. However, along the way, these applications are silently accumulating large amounts of data. According to a 2018 New York Times investigation, as many as 200 million mobile devices report location data to smartphone apps, with some recording a user's location up to 14,000 times in the past year. a day.

Location data is particularly sensitive to certain people, such as someone seeking an abortion in a US state where abortion is criminalized. But no matter who you are, data is undeniably personal, privacy experts say.

“These location scores reveal everything about what we do throughout the day,” explains ACLU attorney and privacy expert Nathan Wessler. He says they can reveal "where we sleep at night - because our phones are near us; where we go during the day, our friends and romantic partners. You leave. away from work and maybe to an AA meeting or a stop at a psychiatrist's office. Your lifestyle patterns will be reflected in this data."

It's an issue that's become increasingly prominent, when the Associated Press reported on September 1 that police used a cell phone tracking tool to "search hundreds of billions of records from 250 million records." mobile devices”. This week, the Federal Trade Commission also sued a broker for selling sensitive location data from hundreds of millions of devices.

And companies are increasingly facing backlash from consumers.

Earlier this month, Facebook's parent company, Meta, settled a class-action lawsuit alleging that the company tracked users' whereabouts even when they had the location settings turned off on their phones. As part of the settlement, Meta agreed to pay $37.5 million to nearly 70 million users without admitting guilt, according to court documents filed.

Coffee chain Tim Horton's has apologized to customers after Canadian privacy regulators found the app was tracking thousands of users "every few minutes" throughout the day, even after the app had already been released. closed. Even prayer and exercise reminder apps have been criticized for collecting data without users realizing it.

The location data industry is a $12 billion market, with companies like X-Mode boasting on their websites that they have collected such data from 25% of US adults in the US. some time. However, companies don't just collect location data — they also share it with potentially brokers, aggregators, and law enforcement. That means, for millions of people who are likely to be unaware, an app used to navigate traffic or save coffee is also keeping track of where they are.

Here's what you should know about apps that collect location data from users.

What the app knows about you

The average person's phone has about 25 frequently used applications. Researchers have found more than a thousand addresses that keep a log of users' location throughout the day. Accuracy varies: GasBuddy, which helps consumers find cheap gas, collects location data that is "accurate enough to determine the location of a particular individual or device," according to the policy. its security. The company says the data is collected on an opt-in basis.

Others only follow your neighborhood or city. None of this data relates to your name or personally identifiable information — all of this data is linked to your phone itself. However, privacy experts have repeatedly pointed out that it is not difficult to match location data with other data points they have on a person, revealing their identity and where they have been.

That's another way to make money. While location data is important to the way some apps work — maps, for example — companies may share this information with third parties, often advertisers. . A local auto dealer can work with an advertising agency to identify and then target ads to suburban left-leaning moms interested in eco-friendly minivans. . The agency pays an advertising agency, who hires brokers and aggregators to combine location data with other parts of your online history (such asyour recent purchases or Facebook likes). That information helps the advertising company show deals and promotions based on what they think you're likely to buy.

“No one expected those apps on our phones to also be mining every location point as we go back to our days and selling them to data brokers,” Wessler said.

Your data is at risk

Location data reveals more than the places you've been. Law enforcement has also used it to infer people's immigration status, religion, and sexual orientation.

A 2020 report by Vice detailed how federal agencies access location data collected by Islamic and Quranic prayer apps as part of counter-terrorism efforts that were disrupted. allegations. Last year, a Catholic priest was fired after a newspaper claimed that it used location data taken from Grindr to show that the priest's phone was at a gay bar.

Earlier this month, the ACLU released thousands of documents showing how ICE and DHS buy app location data from brokers. Tapped from millions of mobile devices across the Southwestern United States, the data is used as part of immigration enforcement. It is not clear from the documents whether this data actually resulted in the deportation.

Health information can also be inferred based on the type of clinic someone visits. This is especially relevant for those seeking an abortion. Since the Supreme Court reversed Roe V. Wade's privacy advocates have urged lawmakers to strengthen protections for digital privacy. Every year, companies like Facebook and Google receive tens of thousands of requests for user information from law enforcement, complying almost 90% of the time. This can include the user's search history, profile information, or sometimes even their location history.

Google parent company Alphabet said it will halt location tracking and reduce the data it keeps about people searching for information about abortion. Facebook CEO Mark Zuckerberg touted the platform's encryption policies, while both companies said they would push back against any overly broad requirements. But privacy experts warn that states will inevitably force tech companies to provide data, including location data, that could reveal whether users are seeking abortions.

Where does the data go?

Apps may say they don't "sell" your location data — but the reality of "selling" data is complicated.

In the physical world, selling a product means that an item leaves the hands of the seller and eventually reaches the buyer. However, for location data, it is more accurate to say brokers sell access to the data, charging a fee for the opportunity to search and download the information collected in a shared database. shall.

Alan Butler, executive director of the Electronic Privacy Information Center, argues that this type of access is “a sale, especially when you are authorized to download the information”.

In some cases, the buyer is a law enforcement agency.

If any law enforcement agency wants to track someone's movements by tracking them around town in a police car, they'll need a warrant. But for years, agencies have skipped this step by contracting with data brokers. Some location data companies market their products specifically to government agencies, boasting of their people-finding capabilities.

Privacy advocates have called on Congress to close the loophole, which they say could lead to an unsecured search. Wessler said.

Lawmakers are currently trying to update privacy rules, forcing companies to notify users about whether they are "sharing," "selling" or "accessing" data. In early August, the FTC said it would do more to regulate companies that collect and share data.

What can you do if you don't like the sound of this

The most obvious countermeasure is also the fastest: delete the app. Both Android and Apple allow users to see which apps you've given location access to. Importantly, you can see which apps track your location only when it's open and which apps track you constantly. If there are any apps you don't normally trust, go ahead and delete them.

If you want to keep the app: feel free to decline the app's location requests. Users are often presented with the wrong binary: hit "Agree" once and be tracked or subjected to frequent nudges to request location permissions. Deny location requests if not needed and turn off notifications so the app doesn't constantly ping you to turn it back on.

Butler says the system is confusing by design, but it's not the user's fault. Apple and Google, the companies that operate the fishc, the most popular app store, has been setting new rules about data collection for years. As of June, both Apple and Android require developers to summarize their privacy policies, stating what data they collect. Android even has a useful section for pausing collections from apps you don't use a lot, while Apple has asked developers to make deleting requests easier.

Lawmakers are also working on more permanent solutions. Butler voiced support for the Not For Sale Act in the Fourth Amendment, which would require a subpoena before law enforcement could purchase location data from brokers. Introduced in 2021, the bill received new support after a hearing in August that involved the FBI, DHS and ICE, among others, taking advantage of the loophole.

Under the California Consumer Privacy Act, users in the state can ask any company to permanently delete the data they have on them, but other states have been slow to adopt the rules. similar rule.

“Even for someone who thinks they really have nothing to hide and they are perfectly comfortable when every detail of their life is an open book for the government,” Wessler said. live there, and in particular what kind of protection we want for the most vulnerable members of that society. "