This past week, the operator of the popular Weather Channel (“TWC”) mobile phone app entered into a Stipulation of Settlement with the Los Angeles City Attorney, Mike Feuer (“City Attorney”), closing the books on one of the first litigations to focus on the collection of locational data through mobile phones. (People v. TWC Product and Technology, LLC, No. 19STCV00605 (Cal. Super., L.A. Cty, Stipulation Aug. 14, 2020)). While the settlement appears to allow TWC to continue to use locational information for app-related services and to serve advertising (as long the app includes some agreed-upon notices and screen prompts to consumers), what is glaringly absent from the settlement is a discussion of sharing locational information with third parties for purposes other than serving advertising or performing services in the app. Because applicable law, industry practice and the policies of Apple and Google themselves have narrowed the ability to share locational information for such purposes, the allegations of the case were, in a sense, subsumed in the tsunami of attention that locational information sharing has attracted. While some are viewing this settlement as a roadmap for locational information collection and sharing, in fact the settlement is quite narrow.
As a brief recap, the January 2019 suit was based on an allegation that TWC failed to sufficiently disclose to users of the Weather Channel app that locational data collected through the app was shared with third parties. The case was brought in the wake of a December 2018 New York Times exposé on the collection and subsequent monetization of anonymous location data by multiple app operators (often done without the full knowledge or understanding of the user). The City Attorney filed the complaint against TWC, claiming that locational information collected through the TWC app was being sold to third parties without adequate permission from the user of the app. The permission granted by the user was only to use locational information to provide “personalized local weather data” but there was no disclosure about the packaging of this data for services unrelated to weather reporting. The City Attorney sought injunctive relief and civil penalties under state law for what it alleged was an unfair business practice. Following the initiation of the suit, TWC altered its post-download disclosure screen to specifically disclose what the City Attorney claimed was missing regarding the collection of location data. Despite the changes, the suit continued to move forward.
After extensive discovery, in June 2020 TWC filed for summary judgment on the City Attorney’s unfair competition-related claims. TWC argued that it had disclosed the privacy information surrounding the collection of user location data within the app’s linked Privacy Policy and in other locations within the app. Such disclosures, TWC claimed, complied with applicable California law that was in effect prior to the passage of the California Consumer Privacy Act (the “CCPA”), and thus TWC disputed the City Attorney’s claims that the app’s in-app disclosures were deceptive and “not meaningfully conveyed.” A trial was scheduled for January 2021.
However, since the suit was filed, mobile location data and the privacy issues surrounding its collection have garnered intense attention. There has been a fair amount of coverage of the issue in the media (see, for example, here and here) and fairly intense scrutiny in Washington, including the FCC’s actions with respect to the major wireless providers’ alleged disclosure of users’ location data, questions by Congress over location tracking practices and even interest by the NSA in the subject with its recently-released information sheet on the sharing of sensitive mobile location data. Both Apple and Google have also tightened their policies with respect to allowing apps to collect and share locational data. Certain social media platforms have filed suits against entities that have been accused of harvesting user mobile data without notice and contrary to the terms of such platforms. Given all of those developments, and with GDPR enforcement revving up in the EU and enforcement of the CCPA just beginning in California, the landscape of permitted collection and sharing of locational information was changing so rapidly that the TWC case in many respects seemed out-of-date in the issues it raised.
Under the Stipulation of settlement, TWC agreed to implement certain changes to the app’s existing “just-in-time” disclosures, on or before October 15, 2020. For example, TWC agreed to revise one of the mobile screen prompts users might signal their assent to after downloading the app (the so-called “Blue Screen” disclosure):
Location and Your Weather
Did you know that if you allow access to your device’s location and barometric pressure sensor data, it enables us automatically to provide you with more accurate local forecasts?
As our Privacy Policy describes, if you grant permission, we use your device’s location to deliver forecasts and weather alerts. We also may use and share this information with trusted partners for ads, and to provide and improve our Services. Regardless of whether or not you allow location access, you can always receive accurate local forecasts by manually entering a location. You can change permissions at any time. Learn More.
I Understand
Under the Stipulation, TWC also agreed to changes to its “Learn More” page to give users more expansive notice about the app’s location data collection:
How We Use and Share Location Information
We collect your device’s location information and pressure sensor data through our applications so that we can offer you certain location-based features like forecasts, weather alerts, and ads, and to provide and improve our Services. The way we collect that information is different depending on whether you are accessing the Services through a website or mobile application.
You can still use our application without giving us permission to access your device’s location services by manually entering a location in the search field. However, if you disable your device’s location services, you will not have access to some of our features like real-time weather alerts for an exact location.
If you grant permission, we may use and share your device’s location to deliver you ads relevant to your location, and to provide and improve the Services. If you’ve also enabled personalized advertising, we may use and share your device’s location data with trusted partners to deliver ads that are relevant to you based on places you may have visited (for example, coffee shops). For more information on these trusted partners and the use and sharing of location data, you can review the section on sharing data in our Privacy Policy.
To learn more about how we use and share your device’s data and our commitment to protecting your privacy, visit our Privacy Policy.
Interestingly, while the parties stipulated that these revised disclosures were currently compliant with the CCPA, the Stipulation acknowledges that, going forward, the CCPA (and any future amendments or regulations) would govern such mobile permission prompts, reflecting an awareness that the requirements of the CCPA are, in many ways, yet to be truly defined. The Stipulation also recognizes that changes to the disclosures may be required pursuant to the evolution of technology as well as the evolving nature of the Apple and Android platform requirements, which have become increasingly restrictive of data sharing. While TWC must give the City Attorney notice to any material changes to the app’s privacy disclosures, such oversight will expire in two years (or even sooner if the CCPA or Apple/Android terms or changes in technology make such oversight unnecessary or impractical).
As we previously stated, with mobile location data more valuable than ever, this issue will remain squarely within the crosshairs of regulators for the foreseeable future. It is important to note that this settlement does not provide for the sharing of app-collected locational information for purposes outside of advertising or providing in-app services. App developers who wish to collect mobile location data from users for such other purposes should note that the revised TWC disclosures only allow for sharing of data to improve the services of the app and to serve relevant advertising. Thus, before an app operator integrates a third-party SDK into its app (or develops one itself) to collect user location data for purposes unrelated to the app’s function or advertising, such app developers should closely understand the terms of applicable law as well as Apple and Google policies on the issue. Beyond developers, third parties that receive such data should also be cognizant about how such locational data is collected and whether such collection practices comply with applicable law and policies.