Mobile Device Location Data: Additional Federal Actions Could Help Protect Consumer Privacy
Published: 2012-09-11T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Smartphones can provide services based on consumers' location, raising potential privacy risks if companies use or share location data without consumers' knowledge. FTC enforces prohibitions against unfair and deceptive practices, and NTIA sets national telecommunications policy. GAO was asked to examine this issue. GAO reviewed (1) how mobile industry companies collect location data, why they share these data, and how this affects consumers; (2) actions private sector entities have taken to protect consumers' privacy and ensure security of location data; and (3) actions federal agencies have taken to protect consumer privacy and what additional federal efforts, if any, are needed. GAO analyzed policies and interviewed representatives of mobile industry companies, reviewed documents and interviewed officials from federal agencies, and interviewed representatives from industry associations and privacy advocates.
section_title: What GAO Found
paragraphs: Using several methods of varying precision, mobile industry companies collect location data and use or share that data to provide users with location-based services, offer improved services, and increase revenue through targeted advertising. Location-based services provide consumers access to applications such as real-time navigation aids, access to free or reduced-cost mobile applications, and faster response from emergency services, among other potential benefits. However, the collection and sharing of location data also pose privacy risks. Specifically, privacy advocates said that consumers: (1) are generally unaware of how their location data are shared with and used by third parties; (2) could be subject to increased surveillance when location data are shared with law enforcement; and (3) could be at higher risk of identity theft or threats to personal safety when companies retain location data for long periods or share data with third parties that do not adequately protect them.
Industry associations and privacy advocates have developed recommended practices for companies to protect consumers' privacy while using mobile location data, but companies have not consistently implemented such practices. Recommended practices include clearly disclosing to consumers that a company is collecting location data and how it will use them, as well as identifying third parties that companies share location data with and the reasons for doing so. Companies GAO examined disclosed in their privacy policies that the companies were collecting consumers' location data, but did not clearly state how the companies were using these data or what third parties they may share them with. For example, some companies' policies stated they collected location data and listed uses for personal information, but did not state clearly whether companies considered location to be personal information. Furthermore, although policies stated that companies shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data. Lacking clear information, consumers faced with making a decision about whether to allow companies to collect, use, and share data on their location would be unable to effectively judge whether the uses of their location data might violate their privacy.
Federal agencies have held educational outreach events, developed reports with recommendations aimed at protecting consumer privacy, and developed some guidance on certain aspects of mobile privacy. The Department of Commerce's National Telecommunications and Information Administration (NTIA) is implementing an administration-proposed effort to bring industry, advocacy, and government stakeholders together to develop codes of conduct for industry to address Internet consumer privacy issues generally. However, NTIA has not set specific goals, milestones, and performance measures for this effort. Consequently, it is unclear if or when the process would address mobile location privacy. Furthermore, the Federal Trade Commission (FTC) could enforce adherence to the codes if companies adopted them, but since adoption is voluntary, there is no guarantee companies would adopt the resulting codes. While FTC has issued some guidance to address mobile location privacy issues, it has not issued comprehensive guidance that could inform companies of the Commission's views on the appropriate actions companies should take to protect consumers' mobile location data privacy.
section_title: What GAO Recommends
paragraphs: GAO recommends that NTIA work with stakeholders to outline specific goals, milestones, and performance measures for its process to develop industry codes of conduct and that FTC consider issuing guidance on mobile companies' appropriate actions to protect location data privacy. Because the agencies had concerns about certain aspects of GAOs draft recommendations, GAO revised them by including that NTIA should work with stakeholders in the process to develop industry codes and removing from the draft FTC recommendation that the guidance should include how FTC will enforce the prohibition against unfair practices.

section_title: Letter
paragraphs: The number of mobile phone subscriptions in the United States grew from  about 3.5 million in 1989 to approximately 291 million by the end of 2009,  according to the most recent Federal Communications Commission  (FCC) data. The Centers for Disease Control and Prevention reported  that one-third of U.S. households had mobile phones but no landline  phones as of December 2011. Increasingly, Americans’ mobile phones  are smartphones, which use advanced operating systems to provide  computing functions, including Internet access and a variety of  applications, in addition to basic voice service. According to The Nielsen  Company, as of June 2012, smartphones accounted for just over half of  all mobile phones in the United States, up from less than one-quarter in  early 2010.
Smartphones allow users access to location-based services that can  provide them with navigation tools and information relevant to their  surroundings based on increasingly precise information about the user’s  current location determined by Global Positioning System (GPS) and  other methods. Location-based services have proved popular with users;  the Pew Research Center reported that three-quarters of smartphone  users were using such services as of February 2012. In providing such  services, smartphones and the companies that support their functions are  able to collect and retain precise data about users’ locations. Concerns  have been raised about how mobile industry companies that provide or  enable location-based services use and share consumers’ location data,  raising the potential that consumers’ privacy could be violated if their  location data are used in ways they did not intend or authorize.
Several agencies have responsibility to address mobile phone  consumers’ privacy and create related guidance. The Federal Trade  Commission (FTC) has authority to take enforcement actions against  unfair or deceptive acts or practices of companies; FCC has regulatory  and enforcement authority over mobile carriers, such as AT&T and  Verizon; and the Department of Commerce’s (Commerce) National  Telecommunications and Information Administration (NTIA) advises the  President on telecommunications and information policy issues.  Additionally, the Department of Justice (Justice) disseminates guidance  on procedures for law enforcement to request electronic evidence, such  as a person’s current or historical location data.  (1)  how mobile industry companies collect location data, why they use  and share these data, and how this affects consumers;  (2)  the types of actions private sector entities have taken to protect  consumers’ privacy and ensure security of location data; and  (3)  the actions federal agencies have taken to protect consumer  privacy and what additional federal efforts, if any, are needed.
To address these issues, we examined privacy policies and interviewed  representatives from carriers, operating system developers, and  smartphone manufacturers that are the largest in the United States by  market share and representatives from the developers of the most  popular mobile applications on the Apple and Google operating systems.  We reviewed documents and interviewed officials from FTC, FCC, NTIA,  and Justice. We also interviewed privacy advocates and industry  association representatives on their views. In considering ways to  address location data privacy issues, we are reporting actions federal  agencies could take, rather than potential legislative options. Recent  proposals in Congress have sought to amend how the law treats mobile  device location data, which is among the technology issues that have  recently emerged. See appendix I for a more detailed description of our  scope and methodology.
We conducted this performance audit from December 2011 to September  2012 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Smartphones combine the telecommunications functions of a mobile  phone with the processing power of a computer, creating an Internet- connected mobile device capable of running a variety of software  applications for productivity or leisure. The functioning of a mobile phone  involves locating the user, and FCC’s rules enabling enhanced 911  (E911) services require phones to provide GPS-quality location precision  for emergency responders. This capability to determine a user’s location  has led to smartphones that can provide applications and services that  take advantage of location data generated by GPS and other location  technologies. Advances in the technology for pinpointing a mobile  phone’s location have led to applications that identify a user’s location  quickly and with a high-level of precision.
Four types of companies are primarily responsible for smartphone  products and services in the United States:  . Carriers provide smartphone users with access to  wireless networks for voice and data uses, generally with a  subscription plan. In the United States, four carriers primarily serve  customers nationwide: AT&T, Sprint-Nextel, T-Mobile, and Verizon. . Underlying the various functions of a smartphone  is an operating system that acts as a mobile computing platform to run  the phone’s hardware and software. Three operating systems are  most prevalent in the United States: Apple’s iPhone iOS, Google’s  Android, and Research in Motion’s BlackBerry. . Smartphones are made by a variety of electronics  companies. Apple and Research in Motion manufacture phones  based on their own proprietary operating systems. In contrast, a  number of other companies, such as HTC, Motorola, and Samsung,  make phones based on the Android operating system. . As the popularity of smartphones has grown,  so too has the number of developers offering applications for them.  New mobile applications are developed every day, with some  estimates indicating there are more than a million available as of mid- 2012. These developers range from start-up ventures to large,  established Internet companies like Yahoo!, offering products like the  Angry Birds game by Rovio Entertainment Ltd., social networking  applications like Facebook, navigation tools like Google Maps, and  music players such as Pandora Radio.
Together, the products and services developed by these various  companies allow users to take advantage of the various functions  smartphones provide (see figure 1).
Smartphones connect with mobile carrier networks for making calls and  providing data services. Some smartphones also have the capability to  connect with wireless fidelity (Wi-Fi) networks to provide data services.
subsections: section_title: Fair Information Practices
paragraphs: Fair Information Practices (FIP), are widely accepted principles for  protecting the privacy and security of personal information. They were  first proposed in 1973 by a U.S. government advisory committee. In  response to concerns about the potential consequences that  computerized data systems could have on the privacy of personal  information, the committee was tasked to examine the extent to which  limitations should be placed on using computer technology for record   These principles, with some variation, have been  keeping about people.used by organizations to address privacy considerations in their business  practices and are also the basis of privacy laws and related policies in  many countries, including the United States. FIPs are not precise legal  requirements. Rather, they provide a framework of principles for  balancing the need for privacy with other interests. Striking that balance  varies among countries and among types of information (e.g., medical  and employment information).
The Organisation for Economic Co-operation and Development (OECD),  an international organization, developed a revised version of the FIPs in  1980 that has been widely adopted (see table 1).
The Federal Trade Commission Act prohibits unfair or deceptive acts or practices affecting commerce and authorizes FTC enforcement action.This authority allows FTC to take remedial action against a company that  engages in a practice that FTC has found is unfair or deceives customers.  For example, FTC could take action against a company if it found the  company was not adhering to the practices to protect a consumer’s  personal information that the company claimed to abide by in its privacy  policy. FTC also enforces the Children’s Online Privacy Protection Act of  1998, which required FTC to promulgate rules governing the online  collection of information from children under age 13.
The Communications Act of 1934 (Communications Act), as amended,  imposes a duty on mobile carriers to secure information and imposes  particular requirements for protecting information identified as customer  proprietary network information (CPNI), including the location of  customers when they make calls. express authorization for access to or disclosure of call location  information concerning the user of commercial mobile services, subject to  certain exceptions. Carriers must also comply with FCC rules  implementing the E911 requirements of the Wireless Communications  and Public Safety Act of 1999, including providing location information  to emergency responders when mobile phone users dial 911.
CPNI includes information that relates to the quantity, technical configuration, type,  destination, location, and amount of use of a telecommunications service as well as  information contained in the bills pertaining to telephone service. As the Communications  Act requirements for CPNI apply only to carriers, they would not apply to other types of  companies that collect and use mobile phone location data, such as application  developers. 47 U.S.C. § 222(f), (h).
The Electronic Communications Privacy Act of 1986 (ECPA) sets out  requirements under which the government can access information about  a user’s mobile phone and Internet communications. This includes legal  procedures for obtaining court orders to acquire information relevant to a  law enforcement inquiry.
section_title: Companies Collect, Use, and Share Location Data That Provide Consumer Benefits, but Also Pose Privacy Risks
paragraphs: Collecting, using, and sharing location data provides benefits for both  mobile industry companies and for consumers. For the companies, the  main purposes for using and sharing location data are to provide and  improve services, to increase advertising revenue, and to comply with  legal requirements. Consumers, in turn, can benefit from these new and  improved services and from targeted location-based advertising.  Nonetheless, allowing companies to access location data exposes  consumers to privacy risks, including disclosing data to unknown third  parties for unspecified uses, consumer tracking, identity theft, threats to  personal safety, and surveillance.
subsections: section_title: Companies Collect Location Data in Various Ways
paragraphs: Mobile industry companies determine location information through various  methods, such as cell tower signal-based technologies, Wi-Fi Internet  access point technology, crowd-sourced positioning, and GPS  technology. Assisted-GPS (A-GPS), a hybrid technology that uses more  than one data collection methodology, is also widely used. Figure 2 below  illustrates these technologies.
Since the advent of consumer cellular technology, making and receiving  mobile telephone calls has depended on the ability to determine a  device’s location from the constant radio communication between the  device and the mobile carrier’s cell towers that are spread throughout the  carrier’s service area. The ranges of the individual cell towers divide the  service area into separate sectors. As the towers are in fixed positions,  determining a device’s current cell tower sector tells the carrier the  device’s approximate location. The precision of this method depends on  how much space a particular tower covers. In general, urban areas have  smaller sectors than rural areas because each sector can only manage a  certain amount of cell traffic at any one time. Because of increasing cell  traffic, the number of cell towers has proliferated to the point that there  are now over three times more than there were 10 years ago. As a result,  cell sector-based location data are increasingly accurate. Companies can  further improve accuracy by using triangulation methods, which determine  location through the mathematical comparison of a device’s signals that  reach more than one cell tower. Cell tower triangulation can now yield  results within 50 meters of accuracy.
Mobile carriers that provide Wi-Fi access points to their customers can  use these access points to determine location. Like cell towers, Wi-Fi  access points are fixed locations and send out signals over a limited  range. Specifically, Wi-Fi signals are radio waves that provide Internet  access to devices equipped with compatible wireless hardware. Each Wi- Fi access point is identified by a unique hardware address. Nearby  compatible devices are able to receive this information and use it to  request Internet access. Since a Wi-Fi access point’s range is limited to a  few hundred meters, accurate location data can be determined if a device  communicates with the access point.
Companies such as Google, Apple, and Skyhook use information  gathered from users’ mobile devices about cell tower and Wi-Fi access  point signals, as well as the Wi-Fi signals of other companies and  households, to determine location. These companies compile the precise  locations of these signals into large databases, which the companies may  then license to other entities such as application developers. An  application installed on a mobile device can obtain location information by  querying one of these databases, which will use its knowledge about  those signals’ locations to return the device’s location. The database can  also use location information sent by the device to update its records. If  there are any new signals in the device’s vicinity or any old signals that  are no longer broadcasting, the database can incorporate those changes  in its records. While the exact degree of accuracy ultimately depends on  how many signal points are near the device when it queries a database,  companies use crowd-sourced positioning because it provides accurate  location data quickly, and because it does not rely on GPS technology,  which is not available in all mobile devices.
GPS is used by both carriers and non-carriers to determine a device’s  location. GPS technology is based upon satellite signals, which are  picked up and interpreted by devices equipped with GPS receiver chips.  The device then measures the time it takes for it to receive various  satellite signals and triangulates its location. Triangulating GPS satellite  signals can yield data accurate to within 10 meters.
A-GPS is a hybrid approach used to overcome certain limitations in GPS  technology: namely, that GPS usually only works outside buildings, may  take several minutes to determine location, and uses more battery power  than other location determination methods. By using GPS in conjunction  with any of the previously described methods of collecting location data,  the assisting technology can report an approximate location to the  application or service while GPS works to obtain a more precise location.  For instance, operating system and application developers may use  crowd-sourced positioning databases to provide approximate locations to  their users until GPS signals are successfully triangulated. The precision  of A-GPS in these circumstances depends on the accuracy of the  assisting method.
section_title: Mobile Industry Companies Use and Share Location Data for Various Reasons
paragraphs: There are three main reasons that mobile industry companies collect and  share location data: 1) to provide and improve services, 2) to increase  advertising revenue, and 3) to comply with court orders.
Mobile industry companies use location data to provide and improve  services. As stated above, a carrier needs to know a device’s location to  provide basic mobile telephone services. In addition, carriers and  application developers offer a diverse array of services that make use of  location information, such as services providing navigation, the ability to  keep track of family members, local weather forecasts, the ability to  identify and locate nearby businesses, and social networking services  that are linked to users’ locations. To provide these services, carriers and  developers need the ability to quickly and accurately determine location.  Location data can also be used to enhance the functionality of other  services that do not need to know the user’s location to operate. Search  engines, for example, can use location data as a frame of reference to  return results that might be more relevant. For instance, if a user were to  search for a pizza restaurant using a location-aware search engine, the  top result may be a map of nearby pizza restaurants instead of the  homepage of a national chain.
Companies also collect and examine location information in conjunction  with other diagnostic usage data to analyze and improve their interactions  with customers. By examining the location patterns of dropped calls, for  example, carriers can identify network problems and address cell  connectivity issues without having to rely on customer complaints.
Furthermore, companies may use location data to provide public services.  For example, carriers are responsible for providing law enforcement and  other first responders with the location data of people who dial 911 from  their mobile devices. This service is referred to as E911 and it is  mandated by law. In addition, companies may provide location  information to municipalities to improve city traffic management or  facilitate city planning. Location data can also be used to help find  missing children through mobile America’s Missing: Broadcast  Emergency Response (AMBER) alerts, which can be sent to devices  that have requested AMBER alerts, when the devices are located within a  specified radius of a reported incident.
Companies can use location data to target the advertising that users  receive through mobile devices. Doing so may make an advertisement  more relevant to a user than a non-targeted advertisement, boosting  advertising revenue. Advertising is particularly important to application  developers, as many developers give their products away free and rely on  advertising for revenue. Advertisements for a certain business may be  triggered if a user’s device is located within a predetermined distance  from that business. Any application, regardless of its function, may collect  and use location data for advertising purposes.
Furthermore, application developers, operating system developers, and  mobile carriers may aggregate and store individual user data to create  user profiles. Profiles can be used to tailor marketing or service  performance to an individual’s preferences. In addition to capturing and  using the location data of individual users, companies such as application  developers and mobile carriers sell large amounts of de-identified location  data to third parties. When data are de-identified, they are stripped of  personally identifiable information.data are often aggregated, which means that the data of many users are  combined. Aggregation also makes it more difficult to distinguish the data  of individuals. De-identified and aggregated data can be used for a variety  of purposes, including marketing and research.
In addition to de-identification, user  Mobile industry companies are legally required to share user location data  in response to a court order if a court finds that the information is  warranted for law enforcement purposes. Because users generally carry  their mobile devices with them, law enforcement can use device location  data to determine the user’s location. Because of this correlation, location  data are valuable to law enforcement for tracking the movements of  criminal suspects. Of particular use are the location data either housed in  mobile carrier databases or obtained through GPS technology. Mobile  carriers are required to comply with court orders directing the disclosure  of historical location data (i.e., where the device was in the past) and in  certain circumstances, real-time location data (i.e., where the device is  now).
section_title: Location Data Use and Sharing Can Benefit Consumers, but Also Pose Privacy Risks
paragraphs: Many services that use location data were designed to make tasks easier  or quicker for the customer, and the sharing of location data can improve  customer experiences, reduce consumer costs, and help provide  improved public services. Nonetheless, location data use and sharing  may pose privacy risks, which include unknown third-party use, consumer  tracking, identity theft, threats to personal safety, and surveillance.
Consumers can benefit from mobile industry use of their location data  because many location-based services are designed to make their lives  easier and safer. For instance, navigation services enable users to easily  find directions and take the guesswork out of finding the best or quickest  routes, while applications designed to track family members enable  parents to be aware of their children’s whereabouts. An application may  also use location data to personalize its usual services; for example, by  using a location-aware business directory, a user may be able to rank  search results by distance to save time and quickly reach the nearest  location. Furthermore, as stated previously, the sharing of location data  facilitates a faster response from emergency services through E911 and  allows companies to identify network service problems.
Additionally, consumers may derive economic benefits from the sharing of  their location data. For example, because many application developers  depend on location-based advertising for revenue, users may be able to  download applications for free or at a low cost. Furthermore, location- based advertising allows for targeted advertisements and offers to be  sent to consumers, who may find them useful. For example, a user at  lunchtime may receive and use a coupon for a local restaurant.
By allowing companies to access their location data, users expose  themselves to privacy risks. These risks include, but are not limited to,  disclosure to unknown third parties for unspecified uses, consumer  tracking, identity theft, threats to physical safety, and surveillance.
According to privacy advocates, when a user agrees to use a service that  accesses location data, the user is unlikely to know how his or her  location data may be used in ways beyond enabling the service itself. The  secondary uses of location data are generally not transparent to the   Therefore, location data may be shared with third parties  consumer.unknown to the consumer. Generally speaking, once location data are  shared with a non-carrier, consumers have a limited ability to know about  or influence the data’s use.
Third parties that receive shared location information may vary in the  levels of security protection they provide. If any of these entities has weak  system protections, there is an increased likelihood that the information  may be compromised. According to the congressional testimony of a  privacy researcher, privacy notices rarely differentiate between first- and third-party data uses and generally do not reveal specific business  partners such as advertising networks, thus making it difficult for  consumers to understand privacy risks. Because consumers do not know  who these entities are or how they are using consumers’ data, consumers  may be unable to make meaningful choices and judge whether they are  disclosing their data to trustworthy entities.
When mobile location data are collected and shared, users may be  tracked for marketing purposes without their consent. Since users often  carry their mobile devices with them and can use them for various  purposes, location data along with data collected on the device may be  used to form a comprehensive record of an individual’s activities.  Amassing such data over time allows for the creation of a richly detailed  profile of individual behavior, including habits, preferences, and  routines—private information that could be exploited. Furthermore, since  non-carriers’ use of location data is unregulated, these companies do not  have to disclose how they are using and sharing these profiles.  Consumers may believe that using these personal profiles for purposes  other than providing a location-based service constitutes an invasion of  privacy, particularly if the use is seen as contrary to consumers’  expectations and results in unwanted solicitations or other nuisances.
Identity theft occurs when someone uses another person’s personal or  financial information to commit fraud or other crimes. When sensitive  information such as location data is disclosed, particularly when it is  combined with other personal information, criminals can use this  information to steal identities. The risk of identity theft grows whenever  entities begin to collect data profiles, especially if the information is not  maintained securely. By illicitly gaining access to these profiles, criminals  acquire information such as a user’s name, address, interests, and  friends’ and co-workers’ names. In addition, a combination of data  elements—even elements that do not by themselves identify anyone,  such as individual points of location data—could potentially be used in  aggregate to discern the identity of an individual. Furthermore, keeping  data long-term, particularly if it is in an identifiable profile, increases the  likelihood of identity theft.
When mobile location data are collected and shared, users could be put  at risk for personal threats if the data are intercepted by people who mean  them harm. This is a potential concern for those people who do not want  specific individuals to know where they are or how to find them, such as  victims of domestic violence. Location data may be used to form a  comprehensive record of an individual’s movements and activities. If  disclosed or posted, location data may be used by criminals to identify an  individual’s present or probable future location, particularly if the data also  contain other personally identifiable information. This knowledge may  then be used to cause harm to the individual or his property through, for  instance, stalking or theft. Access to location information also raises child  safety concerns as more and more children access mobile devices and  location-based services. According to the American Civil Liberties Union  (ACLU), location updates that users provide through social media have  been linked to robberies, and GPS technology has been involved in  stalking cases.
Law enforcement agencies can obtain location data via court order, and  such data can be used as evidence. However, according to a report by  the ACLU, law enforcement agents could potentially track innocent  people, such as those who happened to be in the vicinity of a crime or  disturbance. For example, the ACLU reported in 2010 that Federal  Bureau of Investigation agents investigating a series of bank robberies  sought the records of every mobile phone that was near each bank when  it was robbed. Furthermore, law enforcement agencies access location  data frequently, access that could add to concerns about the potential for  misuse. For example, in May 2012, Sprint-Nextel reported that it had  received over 196,000 court orders for location information over the last 5  years.
Users generally do not know when law enforcement agencies access  their location data. In addition to information related to a crime, the  location data collected by law enforcement may reveal potentially  sensitive destinations, such as medical clinics, religious institutions,  courts, political rallies, or union meetings.
section_title: Private Sector Entities Have Not Consistently Implemented Recommended Practices to Protect Consumers’ Location Privacy
paragraphs: Mobile industry associations and privacy advocacy organizations have  recommended practices for industry to better protect consumers’ privacy  while making use of customers’ personal information. Companies we  examined have developed privacy policies to disclose information to  consumers about the collection of location data and other personal  information, but have not consistently or clearly disclosed to consumers  what the companies are doing with these data or which third parties they  may share them with.
subsections: section_title: Recommended Practices to Protect Privacy Generally Align with FIPs
paragraphs: Industry associations and privacy advocacy organizations have  recommended practices for the mobile industry to better protect  consumers’ privacy while making use of their personal information. These  recommended practices include actions to notify users about the  collection and use of their location data, ways users can control data  collection, safeguards for user data, and actions to demonstrate  accountability. The recommended practices we identified generally align  with the FIPs discussed earlier. For example, providing users with  controls allowing them to opt in or opt out of having their location data  collected aligns with the FIP principles of collection limitation, use  limitation, and individual participation, since such controls allow users to  limit the collection and use of their personal information while providing  them greater ability to be informed about and control how their data are  used. Specific examples of recommended practices are shown in table 2.
Although companies we examined have taken steps to protect the privacy  and security of location data, they have not done so consistently, and  their actions sometimes fall short of the recommended practices we  identified. The 14 mobile industry companies we examined reported  actions to inform users about the collection, use, and sharing of their location data primarily through disclosures in their privacy policies.Companies also disclosed information about ways consumers could  control location data collection, how long companies retain location data,  how companies safeguard the data, and companies’ measures to  demonstrate accountability, although how companies addressed these  issues varied. While companies’ disclosures routinely informed  consumers that their location data were being collected, companies’  disclosures did not consistently or clearly explain the purposes behind  such collection or identify which third parties these data might be shared  with.
Recommended practices state that companies should clearly disclose to  consumers the collection and use of location data and purpose for doing  so. We found that while companies used privacy policies to inform users  about location data collection, information about use and sharing was  sometimes unclear. All 11 of the mobile carriers, operating system  developers, and application developers we examined had privacy  policies. Ten of the 11 privacy policies we examined disclosed that the  company collected consumers’ location data. However, some policies  were not clear about how the companies used location data. For  example, the privacy policies of 4 of the companies we examined stated  ways the companies used “personal information,” but did not state  whether location data were considered “personal information.” It was  therefore unclear whether these uses applied to location data.  Companies’ policies on whether location data were considered personal  information varied. Apple’s privacy policy, for example, stated that it  considered location data to be nonpersonal information. In contrast, T- Mobile’s policy stated that location is personally identifiable information.  Furthermore, representatives from four of the companies told us that  whether location data is considered personal information depends on  factors such as how precise the data are and whether they are combined   The operating system developers  with other information about the user.reported they collected location data in an anonymous manner or took  steps to de-identify stored data. In contrast, 3 of the application  developers we interviewed stated they stored location data with other  personal information about their users. Carriers told us that their  practices varied, depending on the specific use of the data.
Recommended practices state that companies should inform consumers  about third parties the companies share consumers’ data with and the  purposes for doing so. Most policies we examined stated the types of  third-party companies location data may be shared with, such as  application developers and advertisers; however, some policies described  third parties with vague terms such as “trusted businesses” or “others.”  Although some policies stated that the company takes steps to protect  this information, such as requiring the third party to follow the company’s  privacy policy, others made no such statement, and one company’s policy  said it would not be liable if the third party it shares data with fails to  protect it. According to literature examining mobile applications, some  applications lack privacy policies and consumers often do not know which  companies may receive their personal information after it has been  collected by the applications.
Companies also used other methods in addition to privacy policies to  inform consumers about location data collection and use, including some  methods that informed consumers directly through their phones. For  example, some smartphone screens display an icon to indicate when  location information is actively being used.
Recommended practices state that companies should obtain users’  consent for collecting, using, and sharing personal information, including  location data and explain related controls to users. Companies we  contacted reported providing methods for users to control collection and  use of location data, but the methods and amount of control varied. Most  of these companies indicated that users could control smartphones’ use  of their location data from the phone; however, the ability to control this  varied by operating system, with some providing more options. While all  of the operating system developers we examined allowed a user to have  location access turned on or off for all applications, some gave users the  ability to control whether specific applications could have access to  location data. According to the literature we reviewed that examined  mobile applications, controls within applications, if available, were  sometimes difficult to find. Mobile carriers told us that they do not allow  users to control collection of location data for providing basic phone  service, since having location data is necessary to provide that service.
All the companies we examined that collected data for providing location- based services indicated that users must first provide consent before  location-based services use their location; however, privacy policies we  examined did not always explain how users’ consent is obtained.  Companies told us that a smartphone seeks permission from the user to  use location when the user installs an application that makes use of  location or the first time the user activates such an application. For  example, the iPhone iOS operating system displays a pop-up window the  first time a user activates a new application that includes location-based  services. The pop-up states that the application is seeking to use the  user’s location and allows the user to accept or decline. Similarly, Android  smartphones notify users that an application will use location at the time a  user downloads a new application and seeks user consent through this  process.
The recommended practices we reviewed state that companies should  not keep personal information such as location data longer than needed,  and some organizations encouraged companies to state a specific data  retention time frame. However, 7 of the 11 privacy policies we reviewed  did not include a statement about how long the company kept location  data. Officials from most companies told us they kept location data only  as long as needed for a specific purpose; however, in some cases, this  could mean keeping location data indefinitely. The carriers we interviewed  named specific time periods for location data retention, which they said  varied depending on the specific uses of the data, and reported a range  of time from a few days to 3 years after the duration of time a user is a  customer with the company. Three companies indicated they kept  location data indefinitely, and representatives from one company said  they had not established a retention time period. Privacy advocates  raised data retention as a particular concern, since the longer companies  retain location data, the more likely the potential for misuse. Similarly,  FTC’s March 2012 report on protecting consumers’ private information  stated that companies should delete location data as soon as possible,  consistent with the services they provide to consumers.
Recommended practices consistently stated the need for companies to  safeguard collected user data. Companies reported actions to safeguard  users’ location data, but practices for how data are safeguarded varied.  All the companies we examined reported ways they safeguard users’  personal information. For example, all of the privacy policies stated that  companies had general security measures in place to protect personal  information against loss, theft, or misuse. Specific practices reported by  some companies included data encryption, erecting firewalls, and  restricting employee access.whether these protections covered location data. As stated above, some  privacy policies did not state whether location was considered a form of  personal information, and thus it was unclear whether stated safeguards  for personal information applied to location data.
In some cases, however, it was not clear  Most of the recommended practices expressed the need for companies to  demonstrate accountability for their practices. However, companies’  privacy policies reported few, if any, specific measures for accountability.  Five of the 11 privacy policies included general statements that  employees were accountable for following the company’s policies as  outlined in the privacy policy. A few privacy policies also mentioned that  the company followed recommended practices; one carrier’s policy stated  the company followed recommended practices developed by CTIA-The  Wireless Association (CTIA), a nonprofit organization representing mobile  carriers and other wireless companies, and 3 companies’ policies stated  their privacy practices had been certified by TRUSTe, a company that  helps companies address privacy issues. Three of the carriers also told  us they use their contracts with third parties they share users’ personal  data with to require those third parties to adhere to CTIA recommended  practices for location data. Operating system developers reported varying  steps to encourage or require developers of applications that run on their  systems to inform users and obtain consent before using their location  data. For example, in 2011, Apple stated that it would reject applications  from its on-line store that do not obtain consent from the user before  collecting, transmitting, or using a user’s location data and that such use  must be directly relevant to the features and services provided by the  application. In contrast, Google stated that it does not control the behavior  of third-party applications in handling location data, but encourages the  developers to follow common privacy practices, such as giving users a  choice regarding data collection and collecting only necessary  information.
section_title: Inconsistent Practices to Protect Location Privacy Raise Risks
paragraphs: Companies’ inconsistent adherence to recommended practices increases  the likelihood that users could be exposed to the privacy risks we  discussed previously. For example, because companies have not made  clear and consistent disclosures about how they use and share location  data, consumers may be unaware which third parties are using their  location data (or that third parties are using it at all) and that law  enforcement may obtain their location data and use it for surveillance.  Furthermore, because consumers are expected to rely on these  disclosures when judging whether they should give consent to a company  to access their location, consumers may be providing such consent  without complete knowledge of how their data will be used. For example,  although privacy policies generally discussed that users’ data could be  shared with third parties, they sometimes included vague statements like  “trusted business partners” rather than specifying the types of companies  they shared the data with and the reasons for doing so. Consequently,  users lack sufficient information to adequately judge whether they should  trust those companies with their personal information.
Privacy advocates we spoke to acknowledged that companies have taken  some positive steps to protect privacy, but that the current framework of  self-regulation is exposing consumers to unnecessary risks. These  advocates said that companies are generally disclosing to users that they  will collect location data; however, they are not adequately informing  consumers about the uses of the data they collect, including with whom  they are sharing the data. These advocates also expressed concern  about companies retaining location data longer than necessary, which  puts the data at increased risk of inappropriate use. Furthermore, they  told us the current framework of self-regulation is insufficient to address  these concerns because there are no requirements for companies to  consistently implement recommended practices to protect privacy.
Federal agencies that have examined location-based services have also  noted that the benefits from such services come with concerns. For  example, FCC, in its 2012 report on location-based services, noted that  such services are expected to deliver $700 billion in value to consumers  and business users over the next decade. However, in summarizing  views of participants in a 2011 panel discussion, the FCC report noted  that panelists found inconsistency in the privacy notices provided by  companies and incomplete disclosure of the ways location data are used.  Specifically, the report states that while consumers may have clear notice  that an application will collect and use data on their location, these data  may be subsequently used in ways that are not transparent to consumers  or shared with third parties without consumers’ consent. FTC, in its report  on protecting consumer privacy, noted that the unauthorized disclosure to  third parties of sensitive personal information such as precise location  data raises privacy concerns resulting from the unanticipated uses of  these data.
section_title: Federal Agencies Have Taken Actions to Protect Consumer Privacy, but Additional Actions Could Provide Further Protections
paragraphs: Federal agencies that have responsibility for consumer privacy protection  or that interact with the mobile industry have taken steps to promote  public awareness, such as providing educational outreach and  recommending actions aimed at improving consumer privacy. However,  additional actions could be taken to further protect consumers. For  example, NTIA has not defined performance goals for its proposed  multistakeholder process, which consists of different groups involved with  consumer privacy coming together to discuss relevant issues with the  goal of developing codes of conduct for consumer privacy. Additionally,  FTC has not issued comprehensive guidance to mobile industry  companies with regard to actions they should take to protect mobile  location data privacy.
subsections: section_title: Agencies Have Taken Actions to Promote Awareness of Privacy Issues
paragraphs: Several federal agencies that interact with the mobile industry or have  responsibilities for consumer privacy protection have provided  educational outreach to the public, developed reports with  recommendations aimed at protecting consumer privacy, developed  regulatory standards that address mobile-location data privacy, and  developed guidance for law enforcement on obtaining mobile location  data.
FCC and FTC have held educational outreach events, and FTC has  developed a fact sheet to educate the public on various privacy issues  related to location-based services. In June 2011, the agencies  collaborated to hold a public education forum that explored how  consumers can be both knowledgeable and secure when utilizing  location-based services. Participants in the forum included  representatives from mobile carriers, technology companies, consumer  advocacy groups, and academia. Specific topics discussed included how location-based services work; what parents should know about location tracking when their children  trends, benefits, and risks of location-based services;  industry recommended practices; and  use mobile devices.
Also in June 2011, FTC issued an informational fact sheet that provided  basic information on mobile applications and answered questions on  privacy, advertising, and security concerns. Specific topics included the  types of data that applications can access on users’ devices, the reasons  a user’s phone collects location data, and ways that applications can  cause harm to a user’s phone.
In May 2012, FTC held a public workshop on advertising and privacy  disclosures to discuss the need for new guidance for online advertisers  about making disclosures. Participants included consumer advocates,  representatives of industry groups, and academics. The workshop  covered topics including when, where, and how required disclosures should be made;  the techniques to increase or decrease the likelihood that consumers  will actually read a required disclosure;  the challenges and best approaches to making adequate disclosures  given the screen size constraints of mobile devices; and  the steps companies can take to communicate with consumers in a  clear and consistent way about the companies’ privacy practices.
In August 2012, FTC issued guidance for application developers to help  developers comply with truth-in-advertising standards and basic privacy  principles. The guidance discusses the need for developers to be clear to  users about companies’ practices to collect and share data, to offer users  ways to control how their personal information is collected and shared,  and the need to keep users’ data secure, among other issues.
Several agencies have issued or prepared reports that offered  recommendations aimed at improving consumer privacy, including  location-based services. In February 2012, NTIA prepared a report for the  White House on protecting privacy and promoting innovation in the global  digital economy.companies that use personal data. The framework includes a consumer  privacy bill of rights, a multistakeholder process to specify how the  principles in the bill of rights apply in particular business contexts, and  effective enforcement. The report also urged Congress to pass consumer  data privacy legislation that would, among other things, codify the  consumer privacy bill of rights described in the report, grant FTC authority  to enforce the bill of rights, and create a national standard under which  companies must notify consumers of unauthorized disclosures of certain  kinds of personal data.
The report offered a framework and expectations for  Also in February 2012, FTC issued a report on privacy disclosures for  mobile applications aimed at children.information available to parents prior to downloading mobile applications  for their children and called on the mobile industry to provide greater   This report highlighted the lack of  transparency about their data practices. The report recommended,  among other things, that all companies that are involved in developing  children’s applications—the application stores, developers, and third  parties providing services within the applications—should play an active  role in providing key information to parents who download applications  through simple, short disclosures that are easy to find and understand on  the small screen of a mobile device.
In March 2012, FTC issued another report that laid out recommendations  for businesses and policy makers aimed at protecting consumer privacy.The report described recommended practices for companies that collect  and use consumer data to develop and maintain processes and systems  to implement privacy and data security practices. These practices include  promoting consumer privacy at every stage of the development of  products and services, and giving consumers greater control over the  collection and use of their personal data through simplified choices and  increased transparency. The report also included recommendations to  companies that make use of precise mobile location data, including that  they should obtain affirmative express consent from consumers before  collecting precise location data; limit collection to data needed for a  requested service or transaction; establish standards that address data  collection, transfer, use, and disposal, particularly for location data; and,  to the extent that location data are collected and shared with third parties,  work to provide consumers with more prominent notice and choices about  such practices. The report also called on Congress to consider enacting  baseline privacy legislation, reiterated FTC’s call for legislation governing  data security and data broker issues, and urged the industry to accelerate  the pace of self-regulation.
Federal Communications Commission, Location-Based Services: An Overview of  Opportunities and Other Considerations (Washington, D.C.: May 25, 2012). is taking to respond to these challenges, and new issues that continue to  emerge in this area.
There have been three relevant regulatory actions in the area of  protecting mobile location data. In 1998, FCC, implementing requirements  of section 222 of the Communications Act, as amended, developed rules  to protect CPNI; subsequently, the law was amended to clarify that CPNI  includes subscribers’ call location data that carriers use to provide  telecommunications services. As previously discussed, FCC’s  regulations limit instances where CPNI can be used or disclosed without  customer consent. In November 2000, CTIA proposed the adoption of  location information privacy principles that covered the issues of notice,  consent, security and integrity of information, and technology neutrality  and urged FCC to conduct a rulemaking separate from its general CPNI  proceeding, based on CTIA’s assessment that the location privacy  question is uniquely a wireless concern. In July 2002, FCC declined to  initiate a rulemaking because it opined that the amendments to the  Communications Act imposed protections for consumers, such as  requiring express approval before carriers can use consumers’ location  information. The Commission decided that rules would be unnecessary  and potentially counterproductive because of the still-developing market  for location-based services and that CTIA’s proposed privacy principles  could be adopted by mobile industry companies on a voluntary basis.
In September 2011, FTC proposed amending its rule pertaining to the  Children’s Online Privacy Protection Act that would revise the definition of  personal information to explicitly include location data.  According to FTC officials, there is no time frame for the issuance of a final rule in this  proceeding, as the Commission is still in the process of evaluating  comments.
In June 2012, FCC solicited comments regarding the privacy and data  security practices of mobile wireless service providers with respect to  customer information stored on their users’ mobile communications  devices, which could include location information, and the application of  existing privacy and security requirements to that information. Commission last solicited public input on this question 5 years ago and  technologies and business practices in this area have changed, the  Commission sought comments on a variety of issues including:  the applicability and significance of telecommunications carriers’ duty  under section 222(a) of the Communications Act to protect customer  information stored on their users’ mobile communications devices; whether the definition of CPNI could apply to information collected at  a carrier’s direction even before it has been transmitted to the carrier; what factors are relevant to assessing a wireless provider’s  obligations under section 222 of the Communications Act, as  amended, and the Commission’s implementing rules, or other  provisions of law within the Commission’s jurisdiction, and in what  ways; what privacy and security obligations should apply to customer  information that service providers cause to be collected by and stored  on mobile communications devices; and what should be the obligations when service providers use a third  party to collect, store, host, or analyze such data.
77 Fed. Reg. 35336 (June 13, 2012).
subsections: section_title: Guidance for Law Enforcement on Obtaining Mobile Location Data
paragraphs: Justice has developed guidance on how law enforcement may obtain   which is primarily obtained through various court  mobile location data,orders. These methods have been the subject of recent litigation. There  are various methods in which mobile location data can be obtained,  including, but not limited to:
Warrant: A warrant allows law enforcement to obtain prospective  mobile location data generated by GPS or similar technologies (i.e.,  where the device is currently located). To obtain a warrant for these data, the government must establish probable cause to believe that  the data sought will aid in a particular apprehension or conviction.  This method requires the highest standard of evidence of all methods  outlined below.
Section 2703(d) Court Order: A 2703(d) court order allows law  enforcement officials to obtain certain kinds of historical mobile  location data (i.e., where the device was located in the past) that  providers collect for business purposes.government must offer specific and articulable facts showing that  there are reasonable grounds to believe that the data are relevant and  material to an ongoing criminal investigation.
To obtain this order, the
Hybrid Order: Justice has routinely acquired, since at least 2005,  certain categories of prospective mobile location data generated by  cell tower information through the combination of two court orders, the  Pen/Trap court order and the 2703(d) order. The combination order  is known as a “hybrid order.” To obtain this order, law enforcement  officials must affirm that the information likely to be obtained is  relevant to an ongoing criminal investigation and further demonstrate  specific and articulable facts showing that there are reasonable  grounds to believe that the information sought is relevant and material  to an ongoing criminal investigation. This order is used because the  Communications Assistance for Law Enforcement Act of 1994  precludes law enforcement officials from relying solely on the authority  of the Pen/Trap statute to obtain cell tower data for a mobile  customer.
Section 2702 Voluntary Disclosure: Communications providers are  permitted by law to voluntarily disclose information to law enforcement  if the provider, in good faith, believes that an emergency involving  danger of death or serious physical injury to any person requires  disclosure without delay of communications relating to the  emergency.
As already described, law enforcement agencies access location data  frequently using these various authorities. Law enforcement’s use of  location information has spurred courts to review government actions to  compel third parties to disclose location data, as judges question and  examine what legal standards govern law enforcement access to  historical and prospective location information. For example, in 2010, a  federal district court in Texas denied government applications for  historical cell site data, declaring that compelled warrantless disclosure of  cell site data violates the Fourth Amendment. In contrast, in 2012, a  federal district court in Maryland upheld the government’s use of historical  cell site data, concluding that the privacy issues surrounding the  collection of historical cell site location records are best left for Congress  to decide.
Concerns have been raised by privacy advocacy groups about the  methods law enforcement can use to obtain location data. For example,  the ACLU has opined that existing privacy laws fail to provide adequate  legal protections for the increasingly detailed information that is collected  by location-based services about consumers’ physical locations and that  consumers, location-based service providers, and the government are  thus acting in uncertain legal territory. Further, most of the privacy  advocates we spoke to opined that the government should obtain a  warrant based on probable cause of a crime before it tracks,  prospectively or historically, the location of a mobile phone or other  mobile communications device. This approach seeks to treat historical  and prospective location information equally and would require law  enforcement to meet a higher standard before obtaining access to any  location data.
section_title: NTIA’s Proposed Stakeholder Process Lacks Defined Performance Goals and an Adequate Enforcement Mechanism
paragraphs: Our Standards for Internal Control in the Federal Government, in  conjunction with the Government Performance and Results Act of 1993,  state that agencies should set performance goals with specific timelines  and measures for program performance. These documents assert that in  order to better articulate a results orientation, agencies should create a  set of performance goals and measures that addresses important  dimensions of performance. They also assert that agencies should use  intermediate goals and measures to show progress or contribution to  intended results, while including explanatory information on the goals and  measures.
Following the February 2012 report on consumer privacy, NTIA began  implementing a multistakeholder process, which includes, among other  groups, individual companies, industry groups, privacy advocates, and  consumer groups. The purpose of the process is to develop codes of  conduct that implement the general privacy principles presented in the  report and that would be enforceable by FTC if the codes are publicly and  affirmatively adopted by mobile industry companies. NTIA believes that  the proposed process can provide the flexibility, speed, and  decentralization necessary to address policy challenges by facilitating  participants’ working together to find creative solutions. NTIA also stated  that another key advantage of the multistakeholder process is that it can  produce solutions in a more timely fashion than a regulatory process.
NTIA officials stated that because they are in the beginning stages of  defining what the overall process would entail, they could not provide  specific information about procedures, deliverables, or time frames. The  first session was held on July 12, 2012, and addressed how companies  providing applications and interactive services for mobile devices can be  transparent about how the companies handle personal data.
Officials stated that since the sessions will be driven by the stakeholders,  they were unsure if the sessions would cover location data; however, in  its comments responding to a draft of this report, NTIA stated that it  appears likely stakeholders will address transparency of mobile location- based services based on the topic of conversation at the July meeting.  NTIA officials said they planned to hold further discussion sessions,  where stakeholders would meet to address distinct issues, but all of the  topics have not yet been identified and would be based on  recommendations from the stakeholders. Officials stated there is no  defined timeline for the remaining discussion sessions or the  development of the guiding principles, although in August 2012, NTIA  indicated that seven meetings had been scheduled before the end of  2012. Lacking defined performance goals, milestones, and deliverables, it  is unclear whether NTIA’s multistakeholder process will establish an  effective means for addressing mobile location data privacy issues.
NTIA officials stated that individual companies’ compliance with the codes  of conduct produced through the process would be voluntary and that it is  uncertain that the process will yield company self-regulations or a third- party monitored code. If companies do not volunteer to follow any  resulting principles, enforcement would depend on whether a company’s  failure to adhere to the agreed-upon practices could be considered an  unfair practice. As such, the proposed process does not include any  mechanism for enforcing compliance with the guiding principles that may  be developed, and NTIA cannot offer any assurance that the results of  the process will lead to significant adoption of these principles.
FTC has the authority to take legal action against a company that  engages in unfair acts affecting commerce, such as companies engaging  in unfair business practices that are likely to cause substantial injury to  consumers, which are not reasonably avoidable by consumers  themselves. FTC has begun to address mobile location issues by holding  public workshops and by releasing a report that laid out recommendations  aimed at protecting consumer privacy. It has also developed some  guidance for companies that collect, use, and share mobile location data,  such as including recommendations on location data collection in its  March 2012 consumer data privacy report, including recommendations on  improving disclosures to parents about the collection and use of personal  information by applications geared toward children in its February 2012  report on that subject, and issuing guidance for application developers  regarding collection and use of location data in August 2012. While these  various guidelines touch on a number of issues related to mobile location  data privacy, FTC has not published comprehensive industry guidance on  its views of appropriate actions by mobile companies with regard to  privacy. Specifically, by publishing an industry guide for these companies,  FTC could help clarify for mobile companies its views on the appropriate  actions for protecting privacy of consumers’ location data. Doing so  could help set expectations for industry on appropriate steps to protect  consumers’ privacy if the issue has not been adequately addressed  through the development and adoption of industry codes or the  enactment of legislation. Such guidance could also clarify for companies  circumstances under which FTC might take enforcement action against  unfair acts.
section_title: Conclusions
paragraphs: The use and sharing of mobile location data offer benefits to mobile  industry companies and consumers, such as providing and improving  services and increasing advertising revenue. Nonetheless, these activities  can also pose several risks to privacy, including disclosing data to  unknown third parties for unspecified uses, consumer tracking, identity  theft, threats to personal safety, and surveillance. While mobile industry  associations and privacy advocacy organizations have recommended  practices for industry to better protect consumers’ privacy while making  use of customers’ personal information, these practices are not  mandatory for the companies to implement. Mobile industry companies  we examined have inconsistently implemented these practices. In  particular, the lack of clear disclosures to consumers about how their  location data are used and shared means that consumers lack adequate  information to provide informed consent about the use of these data.
Consumers are therefore unable to adequately judge whether the  companies with which their data are shared are putting their privacy at  risk.
A key federal effort to address these privacy risks is NTIA’s planned  multistakeholder process, which seeks to develop industry codes of  conduct. However, NTIA has not defined the effort’s performance goals,  milestones, or deliverables. It is therefore unclear if this process will  address the risks to privacy associated with the use and sharing of mobile  location data. While NTIA recommended that FTC should be granted the  authority to enforce any industry codes of conduct that are developed  from the multistakeholder process, the current process relies on the  industry’s voluntary compliance with resulting codes of conduct before  FTC could enforce the provisions. Regardless of what results from the  multistakeholder process, FTC has authority to take action against  companies that engage in unfair and deceptive practices. However, FTC  has not issued comprehensive industry guidance establishing its views on  the appropriate actions that mobile companies should take to protect  consumers’ mobile location data privacy. Without clearer expectations for  how industry should address location privacy, consumers lack assurance  that the aforementioned privacy risks will be sufficiently mitigated.
section_title: Recommendations for Executive Action
paragraphs: To address privacy risks associated with the use and sharing of mobile  location data, we recommend that the Secretary of Commerce direct  NTIA, in consultation with stakeholders in the multistakeholder process, to  develop specific goals, time frames, and performance measures for the  multistakeholder process to create industry codes of conduct.
To further protect consumer privacy, we recommend that the Chairman of  FTC consider issuing industry guidance that establishes FTC’s views of  the appropriate actions by mobile companies with regard to protecting  mobile location data privacy. In developing the guidance, FTC could  consider inputs such as industry codes developed through the NTIA  multistakeholder process, recommended practices from industry and  privacy advocates, and practices implemented by mobile industry  companies.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided drafts of this report to Commerce, FCC, FTC, and Justice for  comment. We also provided relevant portions of the draft to mobile  industry companies for comment. We received technical clarifications  from all of the agencies and some of the companies, which we  incorporated into the report as appropriate. FCC and Justice did not  provide comments on the draft.
Commerce provided written comments on a draft of this report, which  appear in appendix II. The department disagreed with our  recommendation to develop specific goals, time frames, and performance  measures for the multistakeholder process to create industry codes of  conduct to address privacy risks associated with the use and sharing of  mobile phone location data. Specifically, Commerce’s letter stated that  while NTIA worked with stakeholders to establish a framework that  encourages meaningful progress, it is not the agency’s role to dictate  timelines and deliverables, and that to do so could be counterproductive.  We continue to believe that setting goals and time frames for the process  could provide stakeholders and consumers with better assurance that the  process will indeed result in the timely creation of industry codes to  address privacy issues, as called for in the report on consumer privacy  that NTIA prepared and that was released by the White House in  February 2012. Furthermore, in its letter, Commerce acknowledged  NTIA’s role in setting a date and selecting a topic for the first  multistakeholder process convened in July 2012 and a second process  planned to begin in the fall. Thus, we believe it is reasonable to suggest  that within its role to initiate and facilitate these meetings, NTIA could  work with stakeholders to prioritize consideration of mobile phone location  data privacy so that this issue, which, as we previously discussed, has  been identified as a particular area of concern by privacy advocates and  government agencies, is addressed in a timely manner. We have also  revised the wording of the recommendation to state that NTIA’s efforts  should be done in consultation with the appropriate stakeholders involved  in the multistakeholder process to develop industry codes of conduct.
FTC provided written comments on a draft of this report, which appear in  appendix III. In its letter, FTC stated that it agreed that additional  guidance for industry on mobile location data practices would be useful  and stated that the agency will continue efforts to inform and guide the  industry on best practices for mobile location data. However, FTC also  raised concerns with our draft recommendation calling for such guidance  to help inform mobile companies how FTC would enforce the prohibition  against unfair acts pursuant to the Commission’s authority under the  Federal Trade Commission Act to take enforcement action against a  company that engages in unfair acts affecting commerce. FTC stated that  what constitutes unfair facts or practices is determined by statute and the  test for determining what is an unfair practice is inherently fact specific in  an area in which technology is changing rapidly. It concluded, therefore,  that its business guidance efforts may not necessarily be tied to  determinations of what is unfair. Consequently, we modified the wording  of our recommendation to FTC to focus on the need for FTC to clarify for  mobile industry companies its views on appropriate actions companies  should take to protect mobile location data privacy.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the relevant agencies. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Mark L. Goldstein at (202) 512-2834 or goldsteinm@gao.gov, or Gregory  C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to examine  (1)  how mobile industry companies collect location data, why they use  and share these data, and how this affects consumers;  (2)  the types of actions private sector entities have taken to protect  consumers’ privacy and ensure security of location data; and  (3)  the actions federal agencies have taken to protect consumer  privacy and what additional federal efforts, if any, are needed.
To address all of the objectives, we examined the practices of mobile  industry companies involved in the collection and use of location data;  specifically mobile carriers, operating system developers, smartphone  manufacturers, and application developers. We selected the carriers,  operating system developers, and manufacturers with the largest market  shares in the United States and the application developers using data on  the most popular applications for the two operating systems with the  largest market share, Apple iOS and Google Android. See table 3 below  for a list of the companies we examined.
We reviewed and analyzed selected companies’ privacy policies and  other publicly available documents. We also interviewed representatives  of these companies, except Motorola and Samsung, which provided  written answers to our questions, and Apple, which declined to answer  our questions.
To address our first objective, we reviewed and analyzed relevant  literature to determine the various methods companies use to collect  location data, why they use and share these data, the benefits that are  provided to the consumer, and the associated privacy risks. In addition,  we interviewed representatives from mobile industry associations (CTIA –  The Wireless Association and Mobile Marketing Association), privacy  advocacy groups (American Civil Liberties Union, Center for Democracy  and Technology, Electronic Frontier Foundation, Electronic Privacy  Information Center, and Future of Privacy Forum), and two privacy  researchers (Christopher Soghoian and Ashkan Soltani) who had either  testified on the subject before Congress or authored relevant literature on  the subject, to discuss the benefits and privacy risks associated with the  use of location data. We also interviewed officials from federal agencies  that interact with the mobile industry or have responsibilities for consumer  privacy protection, including the Federal Communications Commission  (FCC), Federal Trade Commission (FTC), Department of Commerce’s  National Telecommunications and Information Administration (NTIA), and  Department of Justice (Justice), to obtain their views.
To address our second objective, in addition to examining the companies  as previously discussed, we identified practices recommended by mobile  industry associations and privacy advocacy groups to protect the privacy  of and secure users’ personal information and assessed the extent to  which they are consistent with the Fair Information Practices. In addition,  we reviewed and analyzed the privacy policies of the selected mobile  industry companies to determine their specific practices to protect  consumer privacy and how their stated practices aligned with  recommended practices. We also reviewed relevant studies of mobile  application privacy to obtain further information on how mobile application  developers protect consumer privacy. We also interviewed  representatives of privacy advocacy groups to obtain their views about  how the private sector is protecting users’ location privacy.
To address our third objective, we identified and reviewed relevant laws  applicable to the mobile industry’s use of personal information. To  evaluate how federal agencies have ensured compliance with relevant  laws and what additional efforts they could take to further protect  consumers, we analyzed information and interviewed officials from FCC,  FTC, NTIA, and Justice about their enforcement, regulatory, and  policymaking efforts to protect consumer privacy. We also interviewed  representatives from mobile industry associations and privacy advocacy  groups as well as privacy researchers to obtain their views about whether  more could be done to protect consumer privacy. In considering ways to  address location data privacy issues, we are reporting actions federal  agencies could take, rather than potential legislative options.
We conducted this performance audit from December 2011 to September  2012, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Commerce
section_title: Appendix III: Comments from the Federal Trade Commission
section_title: Appendix IV: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Michael Clements (Assistant  Director), John de Ferrari (Assistant Director), Russell Burnett, Mark  Canter, Marisol Cruz, Colin Fallon, Andrew Huddleston, Josh Ormond,  David Plocher, Meredith Raymond, and Crystal Wesco made key  contributions to this report.