The location data broker X-Mode has agreed not to share sensitive location data as part of a settlement with the Federal Trade Commission, which had accused the company of selling information that potentially revealed people’s visits to medical facilities, houses of worship, and businesses catering to LGTBQ+ communities. 

The settlement, which was announced this week, also requires X-Mode to honor opt-out requests from consumers and more clearly disclose the collection and use of location data. The FTC had accused X-Mode of collecting identifiers and location data even after users had explicitly opted out. 

X-Mode was rebranded as Outlogic as part of a 2021 acquisition.

The FTC action follows a 2022 Markup story listing 107 third-party apps from which X-Mode was collecting location data, including LGBTQ+ dating apps. The Markup also revealed that X-Mode was one of about a dozen location data companies that purchased precise location data from family tracking app Life360, which limited the sale of such data after our reporting.

Prior to that, in 2020, Vice reported that X-Mode was selling location data from Muslim prayer and Muslim dating apps to the U.S. military. Shortly after that report, Apple and Google reportedly banned X-Mode’s software from being used in apps sold on their app stores. 

X-Mode collects the majority of its location data from mobile apps made by other companies.

Under the settlement, which still must be approved by commission members, X-Mode must maintain a list of sensitive locations, which includes medical facilities, religious organizations, correctional facilities or shelters. X-Mode would be banned from selling, licensing, or transferring data about visits to such locations, would have to limit collection of data about such visits, and delete any existing data collected from such locations. 

The FTC complaint includes an example of how X-Mode sold such information in the past: a purchase order from an X-Mode customer detailing the specifications for data collected from consumers who visited infusion centers and specialized medical offices, such as cardiologists, endocrinologists, and gastroenterologists. 

In at least two known instances, X-Mode sold location data to customers who violated contractual restrictions limiting the resale of such data.

Federal Trade Commission

Josh Anton, president of Outlogic, told The Markup in an emailed statement, “We disagree with the implications of the FTC press release. After a lengthy investigation, the FTC found no instance of misuse of any data and made no such allegation. Since its inception, X-Mode has imposed strict contractual terms on all data customers prohibiting them from associating its data with sensitive locations such as healthcare facilities. Adherence to the FTC’s newly introduced policy will be ensured by implementing additional technical processes and will not require any significant changes to business or products.”

In a statement about the action, FTC Chair Lina Khan said “With this action, the Commission rejects the premise so widespread in the data broker industry that vaguely worded disclosures can give a company free license to use or sell people’s sensitive location data.”

The FTC complaint said X-Mode lacked control over what its customers did with sensitive location data. “In at least two known instances,” it stated, “X-Mode sold location data to customers who violated contractual restrictions limiting the resale of such data.” Indeed, as previously reported by The Markup, X-Mode in 2021 filed a lawsuit over such a violation. The suit alleged that X-Mode customer Nybsys resold raw location data without permission, including to LocalBlox, a company that X-Mode previously banned from buying its data. The case was dismissed in 2022. 

The FTC complaint noted that consumers tracked to sensitive locations could face religious discrimination and prejudice due to their visits to women’s reproductive health providers as well as “physical violence, emotional distress, and other harms.”

The FTC signaled that the location data industry will continue to be closely monitored. “By securing a first-ever ban on the use and sale of sensitive location data, the FTC is continuing its critical work to protect Americans from intrusive data brokers and unchecked corporate surveillance,” Khan said in a statement.