UNITED STATES OF AMERICA 

Federal Trade Commission 

WASHINGTON, D.C. 20580 

Office of the Chair 

Statement of Chair Lina M. Khan 

Joined by Commissioner Rebecca Kelly Slaughter and 

Commissioner Alvaro M. Bedoya 

In the Matter of X-Mode Social, Inc. and Outlogic, LLC 

Commission File No. 212-3038 

January 9, 2024 

Location data can reveal where someone lives, whom they spend time with, what medical 

treatments they seek, and where they worship. Of the many types of personal data, location data 

is among the most sensitive. Noting that “location records hold for many Americans the 

‘privacies of life,’” 1 the Supreme Court held that constitutional safeguards against unchecked 

government surveillance extend to digital location tracking—even when the data is originally 

collected by private companies. 2 

Americans deserve similar protection from unchecked corporate surveillance. Indeed, the 

explosion of business models that monetize people’s personal information has resulted in routine 

trafficking and marketing of Americans’ location data. As the FTC has stated, openly selling a 

person’s location data to the highest bidder can expose people to harassment, stigma, 

discrimination, or even physical violence.

3

 And, as a federal court recently recognized, an 

invasion of privacy alone can constitute “substantial injury” in violation of the law, even if that 

privacy invasion does not lead to further or secondary harm. 4 

With today’s action against X-Mode and its successor Outlogic, the FTC continues to hold 

location data brokers to account. X-Mode is a data broker that tracks people’s location data 

through its own apps, through software development kits (SDKs) installed on third-party apps, 

and through buying data from aggregators. As noted in the FTC’s complaint, X-Mode sells this 

1 Carpenter v. United States, 585 U.S. ___, 138 S. Ct. 2206, 2217 (2018) (quoting Riley v. California, 573 U.S. 373, 

403 (2014)). 2 Id. (“Mapping a cell phone’s location over the course of 127 days provides an all-encompassing record of the 

holder’s whereabouts. As with GPS information, the timestamped data provides an intimate window into a person’s 

life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, 

and sexual associations.’” (quoting United States v. Jones, 565 U.S. 400, at 415 (2012) (Sotomayor, J., 

concurring))).

3 See Press Release, Fed. Trade Comm’n, FTC Sues Kochava for Selling Data that Tracks People at Reproductive 

Health Clinics, Places of Worship, and Other Sensitive Locations (Aug. 29, 2022), https://www.ftc.gov/newsevents/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-placesworship-other. See also Complaint, Goldenshores Technologies, LLC, and Erik M. Geidl, Docket No. 4446 (Apr. 

99, 2014), https://www ftc.gov/system/files/documents/cases/140409goldenshorescmpt.pdf (the “flashlight app”). 4 Order on Motion to Dismiss, Fed. Trade Comm’n v. Kochava Inc., 2:22-cv-00377-BLW (D. Idaho May 4, 2023) 

(“Thus, under the plain language of the FTC Act, a defendant whose acts or practices violate consumer privacy may 

be said to inflict an ‘injury’ upon consumers within the meaning of Section 5(n).”). 
 

 

 

 

raw location data with persistent identifiers that can be used to connect specific individuals to 

specific locations. It also sells access to “audience segments,” or groups of people that likely 

share characteristics based on their demographics, their interests, or the locations they visit. For 

example, for at least one contract, X-Mode has created audience segments by tracking Ohio 

residents who visited specific doctors, including cardiologists, gastroenterologists, or 

endocrinologists, and then pharmacies or specialty infusion centers. It also offered audience 

segments for “Size Inclusive Clothing Stores,” “Military Bases,” and “Veterans of Foreign 

Wars.” 

As the complaint notes, X-Mode sells this location data to marketers, retailers, 

researchers, and government contractors without fully disclosing these practices to users or 

obtaining their permission. Even where people opted out of having their location data used for 

marketing, X-Mode sometimes failed to honor their requests. And although X-Mode’s business 

practices exposed people’s sensitive locations, the complaint notes that X-Mode until recently 

had no policies or procedures in place to blacklist or remove sensitive locations. The complaint 

charges X-Mode with engaging in a series of unfair and deceptive practices in violation of 

Section 5 of the FTC Act. 

The order secures notable relief, including a first-time ban on the use, sale, or disclosure 

of sensitive location data.

5

 The order also requires X-Mode to delete all the sensitive location 

data it has unlawfully collected, as well as any model, algorithm, or any other product derived in 

whole or in part from this unlawfully collected location data. X-Mode cannot collect, use, or 

disclose location data unless consumers have agreed to that. Finally, X-Mode must notify its 

customers of its deletion obligations under this order. 

With this action, the Commission rejects the premise so widespread in the data broker 

industry that vaguely worded disclosures can give a company free license to use or sell people’s 

sensitive location data. 

The FTC will continue to use all our tools to protect Americans from abusive data 

practices, including the unlawful tracking and use of their sensitive information. As the 

proliferation of AI models and algorithmic decision-making further incentivizes businesses to 

endlessly vacuum up people’s personal data, placing substantive limits on how firms can track 

and use sensitive information is paramount. 

I am grateful to staff in the Division of Privacy and Identity Protection for their excellent 

work on this matter and for driving forward our efforts to safeguard Americans’ location data 

from unchecked corporate surveillance. 

*** 

5 Decision and Order, X-Mode Social, Inc., Docket No. C-____ (Jan. 9, 2024) at Part II. The order also requires XMode to set up a Sensitive Location Data Program which, among other things, requires X-Mode to continually 

review its data sets for potentially sensitive locations, and implement procedures to prevent the disclosure of such 

sensitive locations. Id. at Part III. 

2