InMobi, a mobile ad network, has agreed to settle charges with the US Federal Trade Commission (FTC) regarding accusations of illegally tracking users via the identifiers of nearby WiFi routers.
The company, which is based in Singapore, is specialized in serving ads to mobile devices. Developers use its SDK to serve ads inside their apps. The businesses that buy ad time in InMobi’s network want some of their ads to show only to people in certain countries.
To get a user’s location, InMobi relies on IP, but to be more accurate, it also asks users for permission to track their location via the phone’s built-in geo-location features.
InMobi misrepresented tracking features
According to the FTC’s complaint, officials accused InMobi of misrepresenting to their users the fact that they would be tracked even if they didn’t agree to direct tracking via their phone’s geo-location feature.
The FTC said that InMobi was asking for permissions to track users, but failed to specify that this agreement only applied to the phone’s built-in APIs.
FTC officials say that InMobi was collecting data about the user’s WiFi network, and extracting signal strength, ESSID (network name) and BSSID (unique identifier) values.
InMobi logged this information and built a database of WiFi networks around the globe, to which it slowly started appending geo-location data, based on users that agreed to have their location tracked. InMobi created a system to indirectly track a user’s location using the strength and details of nearby WiFi networks.
InMobi agrees to fines and audits
Because the InMobi SDK was included in mobile apps targeted at children, the company was also accused of breaking the Children’s Online Privacy Protection Act.
InMobi has agreed to pay $950,000 in civil penalties, and to create a user privacy program that will be subjected to independent audits every two years for the next 20 years.
The company will also have to delete its existing database of geo-location data, and will have to honor a user’s choice of not being tracked.
“InMobi tracked the locations of hundreds of millions of consumers, including children, without their consent, in many cases totally ignoring consumers’ express privacy preferences,” said Jessica Rich, Director of the FTC’s Bureau of Consumer Protection. “This settlement ensures that InMobi will honor consumers’ privacy choices in the future, and will be held accountable for keeping their privacy promises.”