212-3038 

UNITED STATES OF A.MERICA 

BEFORE THE FEDERAL TRADE COMfflSSION 

COMMISSIONERS: Lina M. Khan, Chair 

Rebecca Kelly Slaughter 

Alvaro M. Bedoya 

l1t tl},e Matter of 

DECISION AND ORDER 

X-Mode Social, Inc., a corporation, 

DOCKET NO. C-_ 

and 

Outlogic, LLC, a limited liability company. 

DECISION 

The Federal Trade Commission ("Commission") initiated an investigation of certain acts 

and practices ofRespondents named in the caption. The Commission's Bureau ofConsumer 

Protection ("BCP") prepared and furnished Respondents a draft Complaint. BCP proposed to 

present the draft Complaint to the Commission for its consideration. Ifissued by the 

Commission, the draft Complaint would charge Respondents with violations ofthe Federal 

Trade Commission Act. 

Respondents and BCP thereafter executed an Agreement Containing Consent Order 

("Consent Agreement''). The Consent Agreement includes: l) statements by Respondents that 

they neither admit nor deny any ofthe allegations in the Complaint, except as specifically stated 

in this Decision and Order, and that only for purposes ofthis action, they admit the facts 

necessary to establish jurisdiction; and 2) waivers and other provisions as required by the 

Commission's Rules. 

The Corn.mission considered the matter and determined that it had reason to believe 

Respondents bad violated the Federal Trade Commission Act, and that a Complaint should issue 

stating its charges in that respect. The Commission accepted the executed Consent Agreement 

and placed it on the public record for a period of30 days for the receipt and consideration of 

public comments. The Commission duly considered any comments received from interested 

persons pursuant to Section 2.34 of its RuJes, 16 C.P.R § 2.34. Now, in further confonnity with 

the procedure prescribed in RuJe 2.34, the Commission issues its Complaint, makes the 

following Findings, and issues the following Order: 

Findings 

1. The Respondents are: 

4 

1-2591469.2 
a. X-Mode Social, Inc., ("X-Mode") a Delaware corporation with its principal office 

or place ofbusiness at 938 Park Ave, Herndon, VA 20170. 

b. Outlogic, LLC ("Outlogic") is a Virginia Limited Liability Company with its 

principal office or pJace of business at 150 Granby St, Norfolk, VA 23510. 

Outlogic is the successor in interest ofX-Mode. 

2. The Commission has jurisdiction over the subject matter ofthis proceeding and over the 

Respondents, and the proceeding is in the public interest. 

ORDER 

Definitions 

For the purpose ofthis Order, the following definitions apply: 

A. "Affirmative Express Consent" means any freely given, specific, informed, and 

unambiguous indication of an individual consumer' s wishes demonstrating agreement by the 

individual, such as by an affirmative action, following a Clear and Conspicuous Disclosure to the 

individual of: (1) the categories ofinformation that will be collected; (2) the purpose(s) for 

which the information is being colJ ected, used, or disclosed; (3) the hyperlink to a document that 

describes the types of entities to whom the Covered Information is disclosed; and ( 4) the 

hyperlink to a simple, easily-located means by which the consumer can withdraw consent and 

that Clearly and Conspicuously describes any limitations on the consumer's ability to withdraw 

consent. The Clear and Conspicuous Disclosure must be separate from any "privacy policy," 

" terms ofservice," «terms ofuse," or other similar document. 

The following does not constitute Affirmative Express Consent: 

I . Inferring conseot from the hovering over, muting, pausing, or closing of a given 

piece of content by the consumer; or 

2. Obtaining consent through a user interface that has the effect of subverting or 

impairing user autonomy, decision-making, or choice. 

B. "Clear(ly) aud Conspicuous(ly)" means that a required disclosure is difficult to miss 

(i.e., easily noticeable) and easily understandable by ordinary consumers, including in all ofthe 

following ways: 

1. In any communication that is solely visual or solely audible, the disclosure must 

be made through the same means through which the communication is presented. 

In any communication made through both visual and audible means, such as a 

television advertisement, the disclosure must be presented simultaneously in both 

the visual and audible portions ofthe communication even ifthe representation 

requiring the disclosure ("triggering representation") is made through only one 

means. 

5 

1-2591469.2 
2. A visual disclosure, by its size, contrast, location, the length oftime it appears, 

and other characteristics, must stand out from any accompanying text or other 

visual elements so that it is easily noticed, read, and understood. 

3. An audible disclosure, including by telephone or streaming video, must be 

delivered in a volume, speed, and cadence sufficient for ordinary consumers to 

easily hear and understand it. 

4. In any communication using an interactive electronic medium, such as the 

Internet or software, the disclosure must be unavoidable. 

5. The disclosure must use diction and syntax understandable to ordinary consumers 

and must appear in each language in which the triggeringrnpresentation appears. 

6. The disclosure must comply with these requirements in each medium through 

which it is received, including all electronic devices and face-to-face 

communications. 

7. The disclosure must not be contradicted or mitigated by1 or inconsistent with, 

anything else inthe communication. 

8. When the representation or sales practice targets a specific audience, such as 

children, the elderly, or the terminally ill, "ordinary consumers" includes 

reasonable members of that group. 

C. "Covered Information" means information from or about an individual consumer 

including, but not limited to: (1) a first and last name; (2) Location Data; (3) an email address or 

other online contact information; ( 4) a telephone number; (5) a Social Security number; (6) a 

driver' s license or other government-issued identification number; (7) a financial institution 

account number; (8) credit or debit card information; (9) a persistent identifier, such as a 

customer number held in a "cookie," a static Internet Protocol ("JP") address, a mobile device 

ID, or processor serial number; or (10) socio-economic or demographic data. Deidentified 

information is not Covered Information. 

D. "Data Product" means any model, algorithm or derived data, in Respondents' custody or 

control developed, in whole or part, using Historic Location Data. Data Product includes butis 

not limited to any derived data produced via inference (manual or automated) or predictions such 

as audience segments. 

E. ''Deidentified" or "Deidentifiable" means information that cannot reasonably identify, 

relate to, describe, be capable ofbeing associated with, orbe linked, directly or indirectly, to a 

particular person, in that Respondents must, at a minimum : 

1. Have implemented technical safeguards that prohibit reidentification ofthe person 

to whom the information may pertain; 

6 

l-2591469.2 
2. Have implemented business processes that specifically prohibit reidentification of 

the information, including by buyers, customers, or other entities to whom 

Respondents provide the information; 

3. Have implemented business processes to prevent inadvertent release of 

Deidentified information; and 

4. Make no attempt to reidentify the infonnation. 

F. "Historic Location Dat.a" means any Location Data that Respondents collected from 

consumers without consumers' Affirmative Express Consent. 

G. "Location Data" means any data that may reve{il a mobile device' s or consumer's 

precise location, including but not limited to Global Positioning System (GPS) coordinates, cell 

tower information, or precise location information inferred from basic service set identifiers 

(BSSIDs), WiFi Service Set Identifiers (SSID) information, or Bluetooth receiver information, 

and any unique persistent identifier combined with any such data, such as a mobile advertising 

identifier (MAID) or identifier for advertisers (IDFA). Data that reveals only a mobile device or 

consumer's coarse location (e.g., zip code or census block location with a radius of at least 1,850 

feet) or that is collected outside the United States and used for (a) Security Purposes or (b) 

National Security purposes conducted by federal agencies or other federal entities is not Location 

Data. 

H. "National Security" means the national defense, foreign intelligence and 

counterintelligence, international and internal security, and foreign relations. This includes 

countering terrorism; combating espionage and economic espionage conducted for the benefit of 

any foreign government, foreign instrumentality, or foreign agent; enforcing export controls and 

sanctions; and disrupting cyber threats that are perpetrated by nation states, terrorists, or their 

agents or proxies. 

I. "Raw Format" means the format in which Location Data is originally supplied, prior to 

any fonn ofprocessing, extraction, or analysis taking place. 

J. "Respondents" means X-Mode, Inc. ("X-Mode") and Outlogic, LLC ("Outlogic"), and 

their successors and assigns. 

K. "Respondents App" means a mobile application Respondents own and operate. 

L. "Security Purposes" means preventing, detecting, protecting against or responding to 

security incidents, including cybersecu,ity incidents, identity theft, fraud, phishing, harassment, 

malicious or deceptive activities, or preserving the integrity or security ofsystems. 

M. "Sensitive Locations" means locations within the United States associated with: (1) 

medical facilities (e.g., family planning centers, general medical and surgical hospitals, offices of 

physicians, offices ofmental health physicians and practitioners, residential mental health and 

substance abuse facilities, outpatient mental health and substance abuse centers, outpatient care 

centers, psychiatiic and substance abuse hospitals, and specialty hospitals); (2) religious 

organizations; (3) correctional facilities; (4) labor union offices; (5) locations of entities held out 

7 

1-2591469.2 
to the public as predominantly providing education or childcare services to minors; (6) 

associations held out to the public as predominantly providing services based on racial or ethnic 

origin; or (7) locations held out to the public as provicling temporary shelter or social services to 

homeless, survivors of domestic violence, refugees, or immigrants. 

N. "Sensitive Location Data" means any consumer Location Data associated with a 

Sensitive Location. 

0. "Software development kit" or "SDK" means the code necessary to integrate 

Respondents' advertisements or Location Data collection tools in a mobile application ("app"). 

P. "Third-Party Incident" means the sharing by a third party ofRespondents' Location 

Data. in violation ofa contractual requirement between Respondents and the third party. 

Provisions 

I. Prohibition Against Misrept·esentations 

IT IS ORDERED that Respondents and Respondents' officers, agents, employees, and 

all other persons in active conceti or participation with any ofthem, who receive actual notice of 

this Order, whether acting directly or indirectly, in connection with the advertising, promotion, 

offering for sale, sale, or distribution of any product or service., mustnot misrepresent, in any 

manner, expressly or by implication: 

A. The extent to which Respondents collect, use, maintain, disclose, or delete any Covered 

Information; and 

B. The extent to which the Location Data that Respondents collect, use, maintain, or 

disclose is Deidentified. 

II. Prohibitions on the Use, Sale, or Disclosure of Sensitive Location Data 

IT IS FURTHER ORDERED that Respondents and Respondents' officers, agents, 

employees, whether acting directly or indirectly, must not sell, license, transfer, share, disclose, 

or otherwise use in any products or services Sensitive Location Data associated with the 

SensitiveLocationsthatRespondents have identified within 180 days ofthe issuance ofthis 

Order as part ofthe Sensitive Locations Data Program established and maintained pursuant to 

Provision ID below. 

Provided, however, that the prohibitions in this Provision IT do not apply if Respondents: 

(i) use Sensitive Location Data to convert such data into data that (a) is not Sensitive Location 

Data or (b) is not Location Data; or (ii) have a direct relationship with the consumer related to 

the Sensitive Location Data, the consumer has provided Affinnative Express Consent, and the 

Sensitive Location Data is used to provide a service directly requested by the consumer. 

8 

1-2591469.2 
ID. Sensitive Location Data Program 

IT IS FURTHER ORDERED that Respondents, within 180 days ofthe issuance ofthis 

Order, must establish and implement, and thereafter maintain, a Sensitive Location Data 

Program to develop a comprehensive list ofSensitive Locations and to prevent the use, sale, 

licensing, transfer, or disclosure of Sensitive Location Data as provided in Provision TI above. 

To satisfy this requirement, Respondents must, at a minimum: 

A. Document in writing the components ofthe Sensitive Location Data Program as well as 

the plan for implementing and maintaining the Sensitive Location Data Program; 

B. Identify a senior officer, such as a Chief Privacy Officer or Chief Compliance Officer, to 

be responsible for the Sensitive Location Data Program. The senior officer will be 

approved by and report directly to the board ofdirectors or a committee thereof or, if no 

such board or equivalent body exists, to the p1incipal executive officer ofRespondents; 

C. Provide the written program and any evaluations thereof or updates thereto to 

Respondents' board of directors or governing body or, if no such board or equivalent 

body exists, to the p1incipal executive officer ofRespondents at least every twelve 

months; 

D. Develop and implement procedures to identify Sensitive Locations to be used by 

Respondent in preventing the sale, license, transfer, use, or other sharing or disclosure of 

SensitiveLocation Data as provided in Provision II above. If a building or place is 

identified as including both a Sensitive Location and a non-Sensitive Location, 

Respondent may associate Location Data with the non-Sensitive Location only; 

E. Assess, update and document, at least once every six months, the accuracy and 

completeness ofRespondents' list of Sensitive Locations. Respondents' assessments 

must include: 

1. Verifying that Respondents' list includes Sensitive Locations known to 

Respondent; 

2. Identifying and assessing methods, sources, products, and services developed 

by Respondents or offered by third parties that identify Sensitive Locations; 

3. Updating its list of Sensitive Locations by selecting and using the methods, 

sources, products, or services developed by Respondents or offered by third 

part1es that are accurate and comprehensive in identifying Sensitive 

Locations; 

4. Considering new categories ofSensitive Locations, not enumerated in the 

definition ofSensitive Locations, such as those based on an announcement by 

a self-regulatory association. Respondents must detennine whether to add the 

newly identified categories to Respondents' Ii st ofSensitive Locations and, as 

applicable, complete these additions within the time frames specified in 

Section III.G; and 

9 

l-2591469.2 
5. Documenting each step ofthis assessment, including the reasons Respondents 

selected the methods, sources, products, or services used in updating 

Respondent's list ofSensitive Locations. 

F. Implement poli cies, procedures, and technical measures designed to prevent Respondents 

from using, selling, licensing, transferring, or otherwise sharing or disclosing Sensitive 

Location Data as provided in Provision II above, and monitor and test the effectiveness of 

these policies, procedures, and technical measures at least once evety six months. Such 

testing must be designed to verify that Respondents are not using, selling, 1icensing, 

transferring, or otherwise sharing or disclosing Sensitive Location Data. 

G. Initiate the process of deleting or rendering non-sensitive, Sensitive Location Data 

associated with locations included in the list developed pursuant to Subparts D and E, 

within 5 days of adding the location to the list ofSensitive Locations, and complete the 

process within 90 days ofinitiation, except where retention is needed to fulfil1 an allowed 

purpose as provided in Provision Il above. The time period to complete this process may 

be extended by additional 45 days periods (not to exceed 180 total days) when reasonably 

necessary, provided the Respondents document at each interval, the reasons for the 

extension and the progress made, and Respondents must not use, provide access to, or 

disclose Sensitive Location Data during the process of deleting or rendering nonsensitive, for any other purpose; and 

H. Evaluate and adjust the Sensitive Location Data Program in light of any changes to 

Respondents' operations or business arrangements, or any other circumstance that 

Respondents know or have reason to know may have an impact on the Sensitive Location 

Data Program's effectiveness. At a minimum, Respondents must evaluate the Sensitive 

Location Data Program every twelve months and implement modifications based on the 

results. 

IV. Other Location Data Obligations 

IT IS FURTHER ORDERED that Respondents, within 180 days ofthe issuance of th.is 

Order, must establish and implement, and thereafter maintain policies, procedures, and technical 

measures designed to prevent recipients of Respondents' Location Data, for any such Location 

Data received after the issuance ofthis Order, from (i) associating such data with (a) locations held 

out to the public as predominantly providing services to LGBTQ+ individuals such as service 

organizations, bars and nightlife, (b) locations ofpublic gatherings ofindividuals during political 

or social demonstrations, marches and protests, or (ii) using such Location Data to determine the 

identity or the location of an individual's home, i.e., the location of any individuaJ's private 

residences (e.g., single family homes, apartments, condominiums, town.homes) (together, 

"Prohibited Uses''), Respondents must identify a senior officer, such as a Chief Privacy Officer 

or Chief Compliance Officer, to be responsible for these policies, procedures, and technical 

measures. Such policies, procedures, and technical measures shall include: 

10 

1-2-591469.2 
1. contractual prohibitions against recipients ofRespondents' Location Data from 

reselling, transferring, or disclosing Respondents' Location Data in its Raw 

Fonnat to a third party ("Reselling"), and from using Respondents' Location 

Data in whole or in part to associate a specific individual wlth the locations 

identified above. 

Provided, however, Reselling does not include a recipient receiving Location 

Data on behalf of a designated end user, for which end user Respondents have 

implemented policies, procedures, and technical measures required by this 

Provision IV, and the end user has (a) contractually agreed to the prohibitions 

against Reselling; and (b) contractually agreed notto engage inProhibited Uses; 

2_ marking techniques, such as seeding, or salting, designed to detect recipients' 

non-compliance with contractual prohibitions against resale or re-license of 

Respondents' Location Data; 

3. assessing and docwnenting recipients' compliance at least once every twelve 

months~ and 

4. terminating relationships with recipients for non-compliance. 

V. Third-Party Incident Reports 

ITIS FURTHER ORDERED that within 30 days ofRespondents' determination that a 

Third-Party Incident has occurred, Respondents must submit a report to the Commission. The 

report must include, to the extent possible: 

A. The estimated date range when the Third-Party Incident occurred; 

R A description ofthe facts relating to the Third-Party Incident, including the causes of the 

Third-Party Incident, if known, and participants; 

C. A description ofeach type ofinfonnation that was affected by the Third-Party Incident; 

D. The numbers of consumers whose information was affected by the Third-Party Incident; 

E. The acts Respondents has taken to date to remediate the Third-Party Incident and 

protect Covered Information from further exposure or access; and 

F. Unless otherwise directed by a Commission representative in writing, Respondents must 

submit alJ Third-Party Incident reports to the Commission under penalty ofperjury as specified 

in the Section ofthis Order titled "Compliance Report and Notices." 

VI. Limitations on Collection, Use, Maintenance, and Disclosure of Location Data 

IT IS FURTHER ORDERED that Respondents and Respondents' officers, agents, 

employees, and all other persons in active concert or participation with any ofthem, who receive 

actual notice ofthis Order. whether acting directly or indirectly, must not 

11 

l-2591Mi9.2 
A. Collect, use, maintain, or disclose Location Data from devices where a consumer has 

enabled the mobile operating system privacy settings to opt out of, limit, or otherwise decline 

targeted advertising or trackrng, without a record satisfying the requirements in Provision VII.B, 

documenting the consumer' s consent. 

B. Within 90 days of the effective date ofthis Order, collect, use, maintain or disclose an 

individual's Location Data without a record satisfying the requirements in Provision VU.B, 

documenting the consumer' s consent obtained prior to Respondents' collection or use of 

Location Data. 

C. In connection with any Respondents' App, collect, use, maintain, or disclose a 

consumer's Location Data, unJess the consumer receives a Clear and Conspicuous reminder, at 

least quarterly, that the consumer' s Location Data is being collected and, if applicable, disclosed, 

along with instructions for a simple control to turn offLocation Data collection. Any such 

reminder must be done through a consumer-enabled push notification or to an e-mail address 

provided by the consumer or, ifthe consumer has not opted into push notifications and an email 

address is unavailable, through a notice in the application. 

Provided, however, that reminders mandated by Provision VI.Care not required when 

Respondents confirm that a consumer's device is utilizing an operating system version that 

reminds consumers that their Location Data is being collected or that limits Location Data 

collection by default for infrequently used apps. 

VII. Supplier Assessment Program 

IT IS .FURTHER ORDERED that Respondents, within 90 days ofthe effective date of 

this Order, must implement a program designed to ensure that consu1ners have provided consent 

for the collection and use ofLocation Data obtained by Respondents, including by implementing 

and maintaining a "Supplier Assessment Program." In connection with the Supplier Assessment 

Program, Respondents must, at a minimum: 

A Document in writing the content, implementation, and maintenance ofthe Supplier 

Assessment Program; and 

B . Conduct an initial assessment either within 30 days of a third party entering into data 

sharing agreements with Respondents (or, for parties ·with existing data-sharing agreements, 

within 30 days of the effective date of this Order) or within 30 days ofthe initial date of data 

collection from such a third party, and thereafter annually, designed to confinn that consumers 

provide Affirmative Express Consent iffeasible, or to confirm that consumers specifically 

consent to the collection, use, and sale oftheir Location Data. 

C. Create and maintain records ofthe suppliers' responses obtained by Respondents under 

the Supplier Assessment Program; and 

D. Cease from using, selling, licensing, transferring, or otherwise sharing or disclosing 

Location Data for which consumers have not provided consent, as provided in Provision VII.B 

above. 

12 

1-2591469.2 
VIlI. Disclosures to Consumers 

TT IS FURTHER ORDERED that Respondents and Respondents' officers, agents, 

employees, and all other persons in active concert or participation with any of them, who receive 

actual notice of this Order, whether acting directly or indirectly, must provide a Clear and 

Conspicuous means for consumers to request the identity of any entity, business, orindividual to 

whom their Location Data has been sold, transferred1 licensed, or otherwise disclosed. 

Respondents may require consumers to provide Respondents with information reasonably 

necessary to complete such requests and to verify their identity, but must not u-se, provide access 

to, or disclose any information collected for such a request for any other purpose. 

Provided however, that the Disclosure requirements in this Provision VIII do not apply if 

Respondents provide consumers with a Clear and Conspicuous method to delete their Location 

Data from the commercial databases ofall recipients ofsuch Location Data, expressly instruct 

(or contractually require) such recipients to honor such requests sent or made available to them 

by Respondents, expressly request (or contractually demand) written confirmation ofdeletion of 

the identified Location Data, and provide consumers with written confirmation ofsuch deletion 

requests or instructions sent to recipients and written confinnation of deletion from recipients 

(where confirmed), no later than 90 days of the receipt of consumers requests. 

IX. Withholding and Withdrawing Consent 

IT JS FURTHER ORDERED that Respondents and Respondents' officers, agents, 

employees, and alJ other persons in active concert or participation with any of them who receive 

actual notice ofthis Order, whether acting directly or indirectly, must: 

A. Provide a simple, easily-located means for consumers to withdraw any consent provided 

in accordance with Provision Vll.B (including Affirmative Express Consent) in connection with 

Location Data. Such means may include a Clear and Conspicuous notice or link to an applicable 

operating system, device, app permission or setting, or a consumer app made publicly available 

(including through the app stores, where permissible) that automatically opts out mobile device 

information from use but Respondents must not use, provide access to, or disclose any 

information collected for such a request for any other purpose. 

Provided however, that Respondent may retain such Location Data to prevent, detect; or 

investigate data security incidents, or to protect against malicious, deceptive, fraudulent, or 

illegal activity directed at the Respondents, for the shortest time reasonably necessary to fulfill 

this purpose, but Respondents must not use, provide access to, or disclose such Location Data 

retained for security and anti-fraud purposes, for any other purpose; and 

B. As to Respondents' App, not unreasonably limit a consumer' s ability to withhold or 

withdraw Affirmative Express Consent, such as by degrading the quality or functionality of a 

product or service as a penalty for withholding or withdrawing consent provided in accordance 

with Provision VU.B (including Affirmative Express Consent), unless the collection and use of 

13 

1-2591469.2 
Location Data is technically necessary to provide the quality or functionality ofthe product or 

service without such degradation. 

X. Obligations When Consent is Withdrawn 

IT IS FURTHER ORDERED that Respondents, and Respondents' officers, agents, 

employees, and all other persons in active concert or participation with any ofthem, who receive 

actual notice ofthis Order, whether acting directly or indirectly, must cease collecting all 

Location Data associated with a specific app and device within 15 days after Respondents 

receive notice that the consumer withdraws their consent provided in accordance with Provision 

VIl.B (including Affirn1ative Express Consent) for such collection from that app and device_ 

XI. Location Data Deletion Requests 

IT IS FURTHER ORDERED that Respondents and Respondents' officers, agents, 

employees, and all other persons in active concert or participation with any ofthem, who receive 

actual notice ofthis Order, whether acting directly or indirectly, must implement and maintain a 

simple, easily-located means for consumers to request that Respondents delete Location Data 

that Respondents previously collected from a specific mobile device, and delete Location Data 

within 30 days ofreceipt ofsuch request unless a shorter period for deletion is required by law. 

Respondents may require consumers to provide Respondents with information necessary to 

complete spcb requests, but must not use, provide access to, or disclose any infortnatiou 

collected for a deletion request for any other purpose. 

Provided however, that such Location Datamay be retained to prevent, detect, or 

investigate data security incidents, or to protect against malicious, deceptive, fraudulent, or 

illegal activity directed at the Respondents, for the shortest t1me reasonably necessary to fulfill 

this purpose, but Respondents must not use, provide access to, or disclose such Location Data 

retained for security and anti-fraud purposes, for any other purpose. 

XI{. Data Retention Limits 

IT IS FURTHER ORDERED that Respondents, in connection with the collection, 

maintenance, use, or disclosure of, or provision ofaccess to, Covered Information, must: 

A. Within 60 days ofthe effective date ofthis Order, document, adhere to, and make 

publicly available through a link on the home page ofthe.ir website(s), in a manner that is Clear 

and Conspicuous, a retention schedule for Covered Infonnation, setting forth: (1) the purpose or 

purposes for which each type ofCovered Information is collected or used; (2) the specific 

business needs for retaining each type of Covered lnforrnation~ and (3) an established timeframe 

for deletion ofeach type ofCovered Information limited to the time reasonably necessary to 

fulfill the purpose for which the Covered Infonnation was collected, and in no instance providing 

for the indefinite retention of any Covered Information; and 

B. Within 60 days ofthe effective date ofthis Order, Respondents shall provide a written 

statement to the Commission, pursuant to the Provision entitled Compliance Report and Notices, 

describing the retention schedule for Covered Information made publicly available on its 

website(s); and 

14 

l-259l469.2 
C. Prior to collecting or using any new type ofinformation related to consumers that was not 

being collected as of the issuance date oftbis Order1 and is not desctibed in retention schedules 

published in accordance with sub-Provision A ofthis Provision entitled Limitation on Retention 

ofLocation Data, Respondents must update its retention schedule setting forth : (1) the purpose 

or purposes for which the new infonnation is collected; (2) the specific business needs for 

retaining the new infonnation; and (3) a set timeframe for deletion ofthe new information that 

precludes indefinite retention. 

XIlL Deletion 

IT IS FURTHER ORDERED that Respondents and Respondents' officers, agents, 

employees, and all other persons in active concert or participation with any ofthem, who receive 

actual notice ofthis Order, whether acting directly or indirectly, must, unless prohibited by law: 

A. Within 60 days after the effective date ofthis Order, delete or destroy all Historic 

Location Data that Respondents collected through apps that it operates or collected through 

Respondents' SDK, and provide a written statement to the Commission, pursuant to Provision 

XVII, confinning that all such information has been deleted or destroyed. Provided however, 

Respondents shall have the option to retain Historic Location Data ifit has obtained Affinnative 

Express Consent from the relevant consumer for the retention ofHistoric Location Data within 

90 days after the effective date ofthis Order, or ifwithin such time period it ensmes such 

Historic Location Data is Deidentified or rendered non-sensitive in accordance with Provision m 

above, and provided that the Historic Location Data is subject to the obligations in Provision N 

above, Provided further, that such Historic Location Data may be retained to prevent, detect, or 

investigate data security incidents, or to protect against malicious, deceptive, fraudulent, or 

illegal activity directed at the Respondents, for the shortest time reasonably necessary to fulfill 

this purpose, but Respondents must not use, provide access to, or disclose such Historic Location 

Data retained for security and anti-fraud purposes, for any other purpose. Respondents will in 

any event delete such Historic Location Data for any consumer who selects the deletion option; 

and 

B. Within 90 days after the effective date ofthis Order, (i) inform Respondents' customers 

that received Historic Location Data within 3 years prior to the issuance date ofthis Order, ofthe 

FTC's requirement in Provision XIII.A that the FTC requires such data to be deleted, 

Deidentified, or rendered non-sensitive, and (ii) Respondents shall promptly submit, within 10 

days ofsending to its customers, all such notices to the Commission under penalty ofperjury as 

specified in the Section ofthis Order titled "Compliance Report and Notices"; and 

C. Within 90 days after the effective date ofthis Order, delete or destroy all Data Products, 

and provide a written statement to the Commission, pursuant to Provision XVII, confirming such 

deletion or destmction. 

XIV. Mandated Privacy Program 

JT IS FURTHER ORDERED that Respondents, and any business that Respondents 

control directly or indirectly, in connection with the collection, maintenance, use, disclosure of, 

or provision ofaccess to Covered Information, must, within 60 days ofthe effective date of this 

15 

1-2591469.2 
Order, establish and implement, and thereafter maintain, a comprehensive privacy program (the 

"Program") that protects the privacy ofsuch Covered Information. To satisfy this requirement, 

Respondents tnust at a minimum do the foliowing: 

A. Document in writing the content, implementation, and maintenance ofthe Program; 

B. Provide the written program, and any evaluations thereof or updates thereto to 

Respondents' board ofdirectors or governing body orl if no such board or equivalent governing 

body exists, to a senior officer ofRespondents responsible for the Program at least once every 12 

months; 

C. Designate a qualified employee or employees to coordinate and be responsible for the 

Program; 

D . Assess and document, at least once every 12 months, internal and external risks to the 

privacy ofCovered Information that could result in the: unauthorized collection, maintenance, 

use, disclosure of, or provision of access to, Covered Information. 

E. Design, implement, maintain, and document safeguards that control for the material 

internal and e:>..1:ernal risks Respondents identify to the privacy ofCovered Infonn.ation identified 

in response to Provision XIV.D. Each safeguard must be based on the volume and sensitivity of 

Covered Information that is at risk, and the likelihood that the risk could be realized and result in 

the unauthorized collection, maintenance, use, disclosure of, or provision of access to Covered 

Information. 

F. On at least an annual basis, provide privacy training programs for all employees and 

independent contractors responsible for handling or who have access to Covered Infonnation, 

updated to address any identified material internal or external risks and safeguards implemented 

pursuant to Hris Order; 

E. Test and monitor the effectiveness ofthe safeguards at least once every 12 months, and 

modify the Program based on the results; and 

F. Evaluate and adjust the Program in light ofany changes to Respondents' operations or 

business arrangements, new ormore efficient technological or operational methods to control for 

the risks identified in Provision XIV.D ofthis Order, or any other circumstances that 

Respondents know or have reason to believe may have an impact on the effectiveness ofthe 

Program or any oftheir inclividual safeguards. At a minimum, Respondents must evaluate the 

Program at least once every 12 months and modify the Program based on the results. 

XV. Acknowledgments ofthe Order 

IT IS FURTHER ORDERED that Respondents obtain acknowledgments ofreceipt of 

this Order: 

A. Respondents, within 10 days after the effective date ofthis Order, must submit to the 

Commission acknowledgments ofreceipt oft.his Order sworn under penalty of perjury. 

16 

I-2591469.2 
B. For 5 years after the issuance date of this Order, Respondents must deliver a copy ofthis 

Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all 

employees having managerial responsibilities for conduct related to the subject matter ofthis 

Order, and all agents and representatives having managerial responsibilities for the conduct 

related to the subject matter ofthis Order; and (3) any business entity resulting from any change 

in structure as set forth in Provision XVI titled Compliance Report and Notices. Delivery must 

occur within 10 days after the effective date ofthis Order for current personnel. For a11 others, 

delivery must occur before they assume their responsibilities. 

C. From each individual or entity to which Respondents delivered a copy ofthis Order, 

Respondents must obtain, within 30 days, a signed and dated acknowledgment ofreceipt ofth.is 

Order. 

XVI. Compliance Report and Notices 

IT IS FURTHER ORDERED that Respondents make timely submissions to the 

Commission: 

A. One year after the issuance date ofthis Order, each ofthe Respondents must submit a 

compliance report, sworn under penalty of perjury, in which the Respondents must: (1) identify 

the primary physical, postal, and email address and telephone number, as designated points of 

contact, which representatives ofthe Commission~ may use to communicate with Respondents~ 

(2) identify all ofthe Respondents' businesses by all oftheir names, telephone numbers, and 

physical, postal, email; and Internet addresses; (3) describe the activities ofeach business, 

including the goods and services offered, the means of advertising, marketing, and sales; ( 4) 

describe in detail whether and how the Respondents are in compliance with each Provision of 

this Order, including a discussion of all of the changes the Respondents made to comply with the 

Order; and (5) provide a copy ofeach Acknowledgment of the Order obtained pursuant to this 

Order, unless previously submitted to the Commission. 

B. The Respondents must submit a compli.ance notice, sworn under penalty of perjury, 

within 14 days of any change in the following: (1) any designated point ofcontact; or (2) the 

structure of the Respondents or any entity that Respondents have any ownership interest in or 

controls directly or .indirectly that may affect compliance obligations arising under this Order, 

including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate 

that engages in any acts or practices subject to this Order. 

C. The Respondents must submit notice of the filing of any bankruptcy petition, insolvency 

proceeding, or similar proceeding by or against either Respondent within 14 days ofits filing. 

D. Any submission to the Commission required by this Order to be sworn under penalty of 

perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: " T 

declare under penalty ofpe1jury under the laws of the United States of America that the 

foregoing is true and correct. Executed on: __" and supplying the date, signatory's full 

name, title (if applicable), and signature. 

B. Unless otherwise directed by a Commission representative in writing, all submissions to 

17 

1-2591469.2 
the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 

courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 

Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 

DC 20580. The subject line must begin: In re X-Mode Social, Inc. & Outlogic, LLC., FTC File 

No. 212-3038. 

XVII. Recordkeeping 

IT IS FURTHER ORDERED that Respondents must create certain records for 5 years 

after the issuance date ofthe Order, and retain each such record for 5 years. Specifically, 

Respondents must create and retain the following records: 

A. Accounting records showing the revenues from all goods or servfoes sold, the costs 

incurred in generating those revenues, and resulting net profit or loss; 

B. Personnel records showing, for each person providing services, whether as an employee 

or otherwise, that person's: name; addresses; telephone numbers; job title or position; dates of 

service; and (if applicable) the reason for termination; 

C. Copies ofall consumer complaints that relate to the collection, use, maintenance, or 

disclosure ofCovered Information, whether received directly or indirectly, such as through a 

third party, and any response; 

D. For 5 years from the date received, copies of communications from law enforcement, if 

such communications requesti.nformation or docwnents relating to Respondents' compliance 

with this Order; 

E. A copy ofeach widely disseminated representation by either ofthe Respondents that 

describes the extent to which Respondents (i) review data suppbers' compliance and consent 

frameworks, consumer disclosures, sample notices, and opt-in controls; (ii) the extent to which 

Respondents collect, use, maintain, disclose, or delete any Covered Information; and (iii) the 

extent to which the Location Data that Respondents collect, use, maintain, or disclose is 

Deidentified; 

F. Records showing Affirmative Express Consent for any individual consumers or device 

from which Respondents have collected Location Data through a Respondent App, the specific 

notice that individual consumers viewed and consented to, and the time and date of consent; 

G. Records showing the content and verifying the djstribution ofClear and Conspicuous 

reminders to individual consumers under Provision VIC; 

H. Records showing the Respondents' implementation ofSupplier Assessment Program 

required by Provision VII; 

I. Records showing Respondents' implementation ofthe Sensitive Location Data Program 

required by Provision Ill; 

J. Records showing Respondent> s processing ofconsumer deJetion requests as provided in 

18 

[-259 1469.2 
Provision VIll; and 

K. All records necessary to demonstrate full compliance with each provision of this Order, 

including all submissions to the Commission. 

XVITI. Compliance Monitoring 

IT IS FURTHER ORDERED that, for the purpose ofmonitoring Respondents' 

compliance with this Order: 

A. Within 14 days of receipt of a written request from a representative of the Commission, 

the Respondents must submit additional compliance reports or other requested information, 

which must be swom under penalty of perjury, and produce records for inspection and copying. 

B. For matters concerning this Order, representatives of the Commission are authorized to 

communicate directly with Respondents. Respondents must permit representatives of the 

Commission to interview anyone affiliated with Respondents who has agreed to such an 

interview. The interviewee may have counsel present. 

C. The Commission may use all other lawful means, including posing through its 

representatives as consumers, suppliers, or other individuals or entities, to Respondents or any 

individual or entity affiliated with Respondents, without the necessity ofidentification or prior 

notice. Nothing in this Order limits the Commission' s lawful use of compulsory process, 

pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1. 

XIX. Order Effective Dates 

IT IS FURTHER ORDERED that this Order is final and effective upon the date ofits 

publication on the Commission's website (ftc.gov) as a final order. This Order will terminate 20 

years from the date of its issuance ( which date may be stated at the end ofthis Order, near the 

Commission's seal), or 20 years from the most recent date that the United States or the 

Commission files a complaint (with or without an accompanyfog settlement) in federal court 

alleging any violation ofthis Order, whichever comes later; provided, however, that the filing of 

such a complaint will not affect the duration of: 

A. Any Provision in this Order that terminates in less than 20 years; 

B. This Order's application to any Respondents that are not named as a defendant in such 

complaint; and 

C. This Order ifsuch complaint is filed after the Order has terminated pursuant to this 

Provision. 

Provided, further, that if such complaint is dismissed or a federal court rules that the 

Respondents did not violate any provision ofthe Order, and the dismjssal or ruling is either not 

appealed or upheld on appeal, then the Order will terminate according to this Provision as though 

the com.plaint had never been filed, except that the Order will not terminate between the date 

such complaint is filed and the later ofthe deadline for appealing such dismissal or ruling and the 

19 

l-2591469.2 
date such dismissal or ruling is upheld on appeal. 

By the Commission. 

[April J. Tabor] 

Secretary 

SEAL: 

ISSUED: 

l-259 1469.2 

20