California is gearing up to be a privacy battleground in 2019.
On Thursday, the city attorney for Los Angeles filed a lawsuit accusing The Weather Channel app and its parent company IBM, of duping users into providing permission to collect geolocation data without explaining exactly how that data would be used, aka, not just for weather-related forecasts and alerts.
According to the suit, which cites an early December 2018 New York Times exposé on the location data market, The Weather Channel app’s onboarding flow ushers users into the app experience without an initial permissions prompt stating the app shares data with third parties.
It’s mainly a disclosure issue, said Warren Zenna, president of the Americas at location data verification company Location Sciences.
“It doesn’t feel like anything more than being picky about the language, which is an indication of the way things are going, that we’ll probably see more people pouring over terms and conditions,” Zenna said. “But my question is, what do they want? For a pop-up every time the app wants to do something with data?”
Granted, users can go into the app’s privacy settings to control how location data is being used, but it’s an opt-out scenario at that point. From the language of The Weather Channel’s original opt-in pop-up, which asks for permission to track geolocation data “always,” “never” or “only when the app is in use” in exchange for weather-related alerts, users have no reason, the suit argues, to believe that their data is being used for anything other than those stated purposes.
“If I’m a user and I opt in to ‘always’ share location data, I gave you permission so I can see weather alerts no matter where I am,” said Forrester principal analyst Renee Murphy. “Selling that data out the back door is not part of the contract.”
Although the California Consumer Protection Act isn’t officially operative until Jan. 1, 2020, the LA suit is what Murphy calls “a shot across the bow.” Consider it a way to kick the tires on California’s new privacy regime and to set a bit of early legal precedent.
“A tsunami is coming,” Murphy said. “District attorneys feel empowered, companies are going to get caught and there will be fines, because, don’t kid yourself, this is a way to make money – the city will get you, the state will get you and then everyone else will get in line for a class action lawsuit.”
The Weather Channel App has 45 million monthly active users, which, the suit claims, likely includes hundreds of thousands of Californians. At $2,500 for each violation, that could end up being a hefty chunk of change.
It’s usually the Federal Trade Commission that brings lawsuits citing unfair and deceptive practices. The fact that a complaint of this nature is coming from the city level is significant, because it demonstrates an unwillingness to keep pandering to the status quo or to wait for Congress to take action on a national law.
“The DA’s office is doing this even though it doesn’t have federal jurisdiction,” said Murphy, who noted that LA’s argument seems strong enough to win the case. The FTC has been successful with similar enforcement actions looking into unfair and deceptive practices in the past.
A cloud hangs
Today, most of the advertising use cases for location data are fairly benign.
Agencies and brands primarily use the data they get from apps like The Weather Channel app for targeting media based on the context of weather patterns and trends, like pushing ads for movies or streaming services when it’s raining out or hitting people with ads for pizza delivery when it’s snowing.
In a section within the suit describing how The Weather Channel transmits geolocation data to third parties for purposes unrelated to weather is the example of using location data to target millennials who frequent “breakfast-style diners” with McDonald’s ads.
“I, of course, wouldn’t want personal information about me that could damage my reputation promulgated without my permission, like my political viewpoints, medical issues,” Zenna said. “But where I shop, where I walk, where I eat? I don’t care.”
However, there could be a darker side to knowing where people spend their time. “What if I’m a credit card company and you owe me $10,000 and I know where you’re eating and what you’re spending your money on?” Murphy said. “Maybe I use that information to take you to court.”
But at least The Weather Channel app has a legitimate reason to collect geolocation data. That’s way better than a shady, opportunistic flashlight app that has no earthly reason to ask for access to location data, right? Not necessarily, Murphy said.
“If a flashlight app asks for access to my location data or my contacts, I’d just say no, because that’s ridiculous,” she said. “But if a weather app asks, I’d agree and then never even think they’re also using it for other stuff. Even if that’s legal, it’s ethically very dubious.”
