A recent lawsuit that the Los Angeles City Attorney filed over data collection by the Weather Channel mobile application emphasizes the importance of privacy disclosures and may represent a new front in data privacy litigation. The suit, which names the IBM-owned The Weather Channel Product and Technology, LLC (“TWC”) as the defendant, alleges that the Weather Channel mobile app “tracks users’ movements in minute detail, even when they are not actively using it.” According to the complaint, this data is also shared with IBM affiliates and sold to third parties for TWC’s own business purposes, such as targeted marketing and analysis of user behavior by hedge funds.
Notably, the app does request users’ consent to the tracking of their location data. But according to the City Attorney, the app does not disclose to users that their location data will be shared with third parties and doesn’t inform them that their data will be shared for purposes distinct from the use of the app itself. These practices are disclosed in a separate section of the app and in TWC’s privacy policy, but when the app seeks users’ consent to tracking, it does not reference or provide a link to these documents. When requesting consent, the complaint alleges, the app “misleadingly suggests that such data will be used only to provide users with ‘personalized local weather data, alerts and forecasts.'” It is only after a user agrees to location tracking that he or she has access to the privacy policy and privacy settings through the app. The complaint also alleges that TWC “obscures” its sharing of user location data by scattering disclosures about it throughout the nearly 10,000 words of its privacy policy.
The City Attorney alleges that the app’s tracking and sharing of location data amounts to a fraudulent, deceptive, and unfair practice under California’s Unfair Competition Law. According to the complaint, users believe that their data will only be used to help tailor the forecast information they receive through the app, but in reality, “maximizing the amount of geolocation data the Weather Channel App tracks is at the core of TWC’s business model.” The suit seeks an injunction restricting TWC’s tracking and sharing of location data as well as civil penalties.
This suit by the City Attorney may be an early example of a new avenue of privacy enforcement within the United States. Unlike the European Union, which has adopted a single data privacy scheme to apply across sectors and jurisdictions, the United States regulates certain types of data on the federal level and leaves additional privacy regulation to the states. Most states do not have a detailed statutory scheme concerning data privacy (although California has adopted a comprehensive law that is scheduled to go into effect at the start of 2020). But every state does have a statute prohibiting unfair or fraudulent trade practices. If state and local authorities, or private citizens, use these statutes as a vehicle for allegations of insufficient privacy disclosures, companies could face the possibility of multitudes of suits in numerous jurisdictions based on their collection and use of users’ data.
The suit also highlights how important it is for companies to take steps to make their privacy policies accessible and understandable to users. The more transparent a company’s disclosures are, the better defense it will have against allegations of unfair or fraudulent trade practices. And it is also critical for companies to update their privacy policies to reflect changes in their technology and business practices. A variance between the language of a privacy policy and a company’s actual practices could form the basis for a complaint under a state unfair trade practices statute.
Patrick Hromisin (LAW ’09) is an associate at the law firm of Saul Ewing Arnstein & Lehr LLP where he focuses his practice on white collar, compliance, and complex commercial litigation matters.