The family safety app Life360 announced on Wednesday that it would stop selling precise location data, cutting off one of the multibillion-dollar location data industry’s largest sources. The decision comes after The Markup revealed that Life360 was supplying up to a dozen data brokers with the whereabouts of millions of its users.
In a quarterly activities report released to its investors on the Australian Securities Exchange, Life360’s founder and CEO Chris Hulls announced that Life360 will phase out all of its location data deals, except with Allstate’s Arity. Life360 is a San Francisco–based company publicly traded on the Australian exchange, but it has plans to go public in the U.S. this year.
Privacy
The Popular Family Safety App Life360 Is Selling Precise Location Data on Its Tens of Millions of Users
The app is a major source of raw location data for a multibillion-dollar industry that buys, packages, and sells people’s movements
The app, which boasts more than 35 million users worldwide, will still be selling location data to the firm Placer.ai but in aggregate rather than raw, precise form, Hulls said.
Life360’s report described the arrangement as a “new data partnership” that “significantly advances privacy initiatives.”
“Life360 recognises that aggregated data analytics (for example, 150 people drove by the supermarket) is the wave of the future and that businesses will increasingly place a premium on data insights that do not rely on device-level or other individual user-level identifiers,” Hulls said in the announcement.
He said that selling aggregate location data would mean “reducing business risk” for the company. Hulls did not elaborate on what those risks were. The deal with Placer.ai does not include data from the companies Tile and Jiobit, both of which Life360 announced acquisitions of last year.
Hulls and Life360 did not respond to The Markup’s requests for comment.
In a call with investors on Wednesday, Hulls said that the transition from selling to about a dozen location data partners to just Placer.ai and Arity should not affect the company’s revenue. He did not share how much the deal with Placer.ai was worth.
“We’re essentially replacing a very large number of partners with a single partner with the exception of Arity, which is going to continue on the driver side,” Hulls said on the call.
In 2020, location data sales made up nearly 20 percent of Life360’s revenue, netting the company $16 million, according to its financial records. It made an additional $6 million through its deal with Arity, a “mobility data and analytics” firm owned by Allstate, which is disclosed as a data partner in Life360’s privacy policy.
Arity’s code, which is embedded in the app, enables “driving event history and crash detection” features. The data that Arity receives contains precise location data when a trip in a moving vehicle has been detected, according to a former Arity employee who spoke with The Markup on the condition that we not use their name, as they are still employed in the data industry.
In Hulls’s November responses to The Markup, he said that Arity “powers a significant portion” of Life360’s driving features like crash detection and that the service was “deeply integrated into” its product.
“Yes, Arity collects and utilizes precise location data from Life360 to provide their users Driving Safety features such as Crash Detection, Family Driving Summary, and Emergency Dispatch,” Stacy Silver, a spokesperson for Arity said in an email.
“The terms of our partnership with Life360 remain the same and we will continue to work with them to provide the enhanced safety features their users have come to trust and rely on.”
Hulls said that Life360 doesn’t share users’ private information with insurers in ways that could affect insurance rates.
Placer.ai didn’t respond to a request for comment.
In December, The Markup revealed that Life360 was one of the largest sources of raw location data for the industry. Its customers included X-Mode, a location data broker that sold data to U.S. military contractors; SafeGraph, a company that Sen. Ron Wyden has flagged as a “data broker of concern”; and Cuebiq, one of the largest location data brokers in the industry.
Hulls told The Markup in an emailed statement in November that Life360 limited its data partners from sharing data in certain ways through contractual restrictions.
Cuebiq was contractually prohibited by Life360 from reselling raw location data, Hulls said, and Life360 also implemented a policy in 2020 to prevent its customers from selling location data for “law enforcement purposes.” In a follow-up email in December, Hulls acknowledged that it is “always a challenge to monitor the activities of any third party business vendor or partner.”
X-Mode, Safegraph, and Cuebiq did not respond to requests for comment about the announcement.
I’m glad that Life360 has stopped selling location records to data brokers, but it should not have taken public shaming by journalists.
Sen. Ron Wyden
“Companies should not be selling individual consumers’ raw location data. It is too easy to abuse, and even if firms are careful about not selling it to the government, the firms they sell it to can then resell it without their knowledge,” Wyden said in a statement to The Markup on Thursday. “I’m glad that Life360 has stopped selling location records to data brokers, but it should not have taken public shaming by journalists. Congress needs to finally pass tough consumer privacy legislation.”
A former X-Mode engineer told The Markup that Life360’s location data was among the data broker’s most valuable assets because of how precise and vast the data was. Life360 would provide location data to its customers through server-to-server transfers and provided the data as frequently as every 20 minutes in some cases, a former Life360 employee told The Markup.
For some data partners, Life360 would send location data without any hashing or fuzzing to obfuscate the user, Hulls told The Markup in December.
In November, Hulls told The Markup that the direct server transfers for location data only applied to “certain partnerships but not all.” He also acknowledged that some data partners received hashed data while others, like Cuebiq, received raw, precise location data. Despite the data’s accuracy, Hulls said the company was “not aware of any instance where our data has been traced back to individuals via our data partners.”
He also told The Markup that the company had “no means to confirm or deny” that Life360 was one of the largest suppliers of location data for the industry.
Hulls didn’t answer The Markup’s question on Thursday about whether Life360 will aggregate the data before sending it to Placer.ai or if Placer.ai will aggregate the data it receives.
The Life360 announcement did not offer any specific details about how the aggregation will work.
Companies throw around terms like ‘anonymous’ and ‘aggregated’ all the time without actually specifying, technically, what they mean.
Justin Sherman, Duke Tech Policy Lab
“Companies throw around terms like ‘anonymous’ and ‘aggregated’ all the time without actually specifying, technically, what they mean,” said Justin Sherman, a cyber policy fellow at the Duke Tech Policy Lab. “Most often, the data is not really ‘anonymous’ or ‘aggregated’—because it’s all too easy, with so much data out there, to link random data points back to specific people,” Sherman said.
Sherman noted that aggregated location data can still lead to harm when the locations that are observed for insights are of a sensitive nature.
“If that data concerns people gathered outside a police station in protest, or women visiting abortion clinics after work hours, or young people going to a treatment facility for HIV, it’s even more prone to be harmfully used and reveal highly sensitive information about people. And on top of all that, there’s still a company that’s collecting (and possibly sharing) your raw location data in the first place,” Sherman said.
Users can opt out of location data sales from the Life360 app through the privacy and security settings.
Placer.ai is also a major figure in the location data industry, having recently raised $100 million in funding with $1 billion in valuation, the company announced on Jan. 12. The company provides aggregated location data for traffic analysis and plans to expand with data including vehicle traffic, web traffic, and purchase data, Noam Ben-Zvi, the company’s CEO and co-founder, said in a press statement.
Its customers include Sony, Wayfair, Wegmans, and Planet Fitness, according to the company. Placer.ai boasts that it receives location data from more than 20 million devices and more than 500 apps.
