InMarket's 5-Year Location Data Retention Period Longer Than Necessary, Say Plaintiffs

Two plaintiffs filed an unjust enrichment class action Wednesday against InMarket Media over its collection of consumers’ location data (docket 1:24-cv-11170). The filing in U.S. District Court for Massachusetts came the same day the FTC finalized a settlement with the data aggregator (see 2405010071).

The complaint, citing the FTC's January proposed settlement with InMarket Media, referenced the agency's allegations of unfair collection and use of consumer location data, unfair collection and use of consumer location data from third-party apps, unfair retention of consumer location data, and deceptive failure to disclose InMarket’s use of consumer location data. Acts and practices are unfair under Section 5 of the FTC Act if they “cause or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid themselves” and that “is not outweighed by countervailing benefits to consumers or competition,” it said.

Massachusetts plaintiffs Bernadette Lionetta of Charlestown and Cheryl Wallace of Sudbury, downloaded and used third-party mobile apps containing an InMarket SDK embedded in its platform, said the complaint. The tracking tool “collected and transmitted” plaintiffs’ personal information, including their geolocation data, to InMarket, it said.

Before an app can access a mobile device’s location data, the device user must grant access in a system prompt generated by the device’s operating system, the complaint said. InMarket doesn’t fully disclose such collection and use in the system prompts seeking user consent to location collection or in in-app screens preceding the prompt, it said. Lionetta and Wallace had no knowledge of, nor did they consent to, the collection, storage, use and/or sharing of their data by InMarket for any other third party, said the complaint.

InMarket obtains “large swaths of personal data on consumers,” including information about their movements over time from their mobile devices, plus their purchase history, demographic data and socioeconomic backgrounds, the complaint alleged. It uses the data to facilitate targeted advertising to consumers on their smartphones for its clients, which include brands and advertising agencies, it said.

The defendant fails to notify consumers that their location data will be used for targeted advertising, the complaint said. After collecting precise location data about consumers’ daily movements, InMarket retains it “longer than reasonably necessary” -- five years -- and thus exposes them to “significant unnecessary risk” that it could be disclosed or misused “and linked back to the consumer,” alleged the complaint.

InMarket justifies the “unreasonably long” data retention as necessary for allowing a consumer to earn shopping points or make shopping lists, the complaint said. CheckPoints is a rewards app that offers users a chance to earn “free gift cards” and “easy money” while they shop by checking into locations, watching videos, scanning products in store and taking surveys and quizzes; they can exchange the points for rewards, it said. Its ListEase product is an electronic shopping list app.

The consent screens for both apps tell consumers their location will be used for the app’s functionality -- to earn points and make lists -- “which are misleading half-truths,” the complaint said. At no point during the consent process did InMarket disclose it was collecting users’ precise location, “often multiple times per hour, along with data collected from multiple other sources -- including through other apps using the InMarket SDK -- to build extensive profiles on users" for targeted advertising, it said. The consent page doesn’t link to the privacy policy, it said.

As a result of InMarket’s business practices, Lionetta and Wallace suffered harm and loss of privacy and will continue to suffer future harm from its unlawful data collection practices, the complaint alleged. Their and class members’ privacy has been invaded and their personal information “is now accessible to unauthorized third parties” that may use this information to their detriment, it alleged.

The plaintiffs seek compensatory, statutory and punitive damages, prejudgment interest, an order of restitution, attorneys’ fees and legal costs, plus an injunction enjoining InMarket from continuing the “illegal practices” alleged. InMarket didn’t comment.