L.A. Joins the Growing Battle Over Location Data

A monitor advertises a new global forecasting system at the IBM booth at CES International, Tuesday, Jan. 8, 2019, in Las Vegas.

A monitor advertises a new global forecasting system at the IBM booth at CES International, Tuesday, Jan. 8, 2019, in Las Vegas. John Locher/AP

Los Angeles is taking the Weather Channel to court over its treatment of app users’ location data. Expect that to be one of many such lawsuits in 2019.

At CES on Tuesday, IBM unveiled what it promises will be the future of weather forecasting: a new, hyperlocal model that aims to be the most accurate yet by predicting the weather at a 1.9-mile resolution across the globe, every hour.

While it’s made possible by advancements in artificial intelligence, the data that feeds the model might prove to be a challenge. It comes from devices whose users have downloaded the company’s popular Weather Channel app.

In her keynote address at the event, IBM CEO Ginni Rometty couldn’t ignore the legal battle brewing in the U.S. over the very source of the system’s capabilities: “As we work on these technologies, all that data that we talked about, that ownership, they belong to the user, and with their permission, we use that.”

That was a reference to a lawsuit filed last week by the city of Los Angeles against an IBM subsidiary, TWC Product and Technology, over what the city claims is the improper disclosure of what the company does with users’ personal information. According to several consumer privacy protection experts, this is likely the first of many such lawsuits this year as consumers and policymakers double down on data privacy protection.

“2018 was a watershed year in terms of the cascade of public scandal from companies that have been caught misleading their users,” says Adam Schwartz, senior staff attorney at the digital rights nonprofit Electronic Frontier Foundation. “I would expect the heat is going to continue, and that will generate more [consumer protection] laws and more lawsuits.”

By TWC’s own calculations, the app has roughly 45 million monthly users, though few may have realized the company was sharing their location data with advertisers. It’s not just general information that the app prompts users to share, according to L.A.’s lawsuit, but also their “movements in minute detail,” collected even when the app isn’t in use.

The lawsuit, citing a New York Times’ investigation from December, claims the company has been profiting off users’ geolocation data without disclosing to them that their data were being sold to third parties. And while TWC argued it has been transparent, the lawsuit alleges that, even so, the information is buried deep within a lengthy privacy policy. Without explicit notice, the app gives users no reason to look for it.

“If the price of getting a weather report is going to be the sacrifice of your most personal information about where you spend your time day and night, you sure as heck ought to be told clearly in advance,” L.A. City Attorney Michael Feuer told the Los Angeles Times. The city deems the lack of disclosure to be “fraudulent and deceptive,” and claims it’s in violation of California’s Unfair Competition Law. It’s seeking an injunction against TWC to have them stop the practices, along with a penalty of $2,500 for each violation.

That the defendant is TWC is not accidental. Feuer told the L.A. Times that the app is used by people of all demographics and places, and its seemingly “benign and innocuous” nature has allowed TWC to mislead consumers. “It’s very intuitive to us why a weather app would want our location, and people are very generally okay with that kind data collection,” says Natasha Duarte, policy analyst at the Center for Democracy and Technology. Yet location data collected over time reveal the most intimate details of our lives.

That’s why the issue at the heart of the case is not unique. “It reveals a major disconnect between business practices that are pretty well understood and even widespread within an industry and the actual understanding that people have when they are using their smartphones,” says Stacey Gray, policy counsel at the Future of Privacy Forum.

She adds that its unique for a city to bring on such a high-profile data privacy case; state attorneys general are usually the ones to file such lawsuits. But L.A. doesn’t shy away from taking large corporations to court on behalf of consumers. In the past, for example, the city hasfiled unfair-competition lawsuits against Uber after it failed to conceal a data breach and Wells Fargo after it opened unauthorized accounts.

In the absence of robust federal regulation over consumer data protection, “state enforcers are using existing [unfair and deceptive acts and practices] laws in creative ways,” Gray says. “It just so happens that California’s UDAP law is more robust than many others, in that it allows not just state AG’s to bring lawsuits, but also city attorney and individuals.” It’s worth noting that individuals have an added burden to prove economic loss, which would be a challenge in this case.

Indeed, while the federal government is still playing catch-up with consumer technology, states and cities are filling in the gap. All 50 states, including the District of Columbia, have passed or expanded their own data-breach notification laws, partly in response to Europe’s General Data Protection Regulation, which set a new standard for data privacy last year. And according to the National Conference of State Legislatures, at least 24 states have some sort of data security law—some weaker and more out of date than others.

On the federal level, Senator Ron Wyden, D-Ore. is renewing his call to ban mobile carriers from selling user data after Vice reporters paid a bounty hunter $300 to geolocate a phone, illustrating that companies like AT&T, T-Mobile, and Sprint were selling location data that could then become available on the black market.

It’s not just location data, either. Illinois holds the U.S.’s toughest law on the collection of biometric data—face scans, fingerprints, and the like—and other states are moving to pass similar legislation. New York state is moving on a bill to add biometric data to existing laws that protect consumers from cyberattacks. A separate bill proposed in New York City goes further, requiring businesses to clearly disclose at physical entrances and online if, and how, they are collecting and using such information. (The bill stops short of regulating the public sector, drawing criticism that it doesn’t go far enough.)

One of the most sweeping consumer privacy laws will come from the California Consumer Privacy Act of 2018, which will go into effect in 2020. It will give consumers four basic rights specifically related to the collection and sale of their data: the right to know how their data will be used, to opt out of having their data shared, to have a business delete their information, and to not be discriminated against for exercising those three other rights. That’s making companies nervous, as Californians make up a significant chunk of their consumer base.

Schwartz, at the Electronic Frontier Foundation, welcomes stronger state laws, as well as a “diffusion” of enforcement power. “It’s not enough for one federal agency and one attorney general officer across the 50 states to have the power. We want to diffuse enforcement, as in the case here, to city and county officials,” he says. “What’s even better is the diffusion of enforcement power to individual tech users to bring their own lawsuits.”

That’s not to say a baseline federal regulation is not needed, but Schwartz cautions that it’s somewhat of a double-edged sword. “There are a lot of demands from companies right now who are scared of state law, that Congress ought pass a new law—which of itself is a good thing,” he says. “But the price that is too high for us as privacy advocates is that the federal law would preempt state laws.”

It’s yet to be seen how L.A.’s lawsuit will play out, but Schwart adds that he’s optimistic that as companies get more sophisticated with their technology and consumers become more conscious of their data, new laws will rebalance the relationship between the two.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.