Mobile applications allow users to direct ill-tempered birds toward the buildings of evil pigs and can operate as a tool to let you know when is the best point in a movie to excuse yourself to the nearest restroom. They are also, however, an increasingly prevalent way for individuals to access the Internet and a potential gold mine of personal data. On our blog, we have described at length the California Attorney General's efforts to bring mobile applications in line with California's Online Privacy Protection Act, links to past posts are here as well as here and here. The Federal Trade Commission (FTC) has now followed suit by putting forward a set of guidelines for developers of mobile applications that collect, use, sell or transmit the personal information of its users, particularly users who are children. The guidelines include recommendations for platforms, app developers, advertising networks and other third parties and app trade associations, each of which are described below. Generally the recommendations follow three major themes: (1) there is a lack of understanding and awareness on the part of consumers; (2) in order to be effective, a solution or fix should consider and address the small screen size of mobile devices and (3) platforms should be the key drivers of change.
1. Platforms
Platforms possess a large degree of control over the way in which information is presented to consumers and can leverage considerable influence over app developers. The FTC concluded that platforms can and should do more to help address mobile application privacy issues.
First, the FTC advised that the consistency of disclosures to users regarding the collection and use of personally identifiable information should be a primary concern. Since platform developers have developed a uniform interface for mobile applications, platforms can require that consistent disclosures be provided across all mobile applications. The FTC recommended that such disclosures should be in the form of plain-English just-in-time disclosures that alert the user at the point where the mobile application is going to begin to collect particularly sensitive information, such as geolocation data.
However, the FTC noted that just-in-time disclosures would not be effective where information was continuously collected or different types of information were collected at many different points. As such, the FTC recommended the use of a privacy dashboard, where the user can go to see an overview of which apps are collecting personal information, and make an informed decision about which applications should be permitted to do so. The FTC also recommended the use of icons to alert the user when certain types of information are being collected.
Beyond simply requiring the foregoing disclosures, the FTC has asked that platforms take an education and enforcement role with respect to application developers, using the leverage that platforms have over the developers to ensure compliance. The FTC advised that any such oversight or review of mobile applications should be transparent, and the criteria used to review mobile applications should be disclosed to users.
Finally, the FTC advised that platforms develop a Do Not Track (DNT) setting for mobile devices, allowing users to make a one-time decision to allow or prohibit tracking, rather than having to do so on an application-by-application basis.
2. App Developers
The FTC's recommendations for app developers are similar to the requirements set forth by the California Attorney General. Applications should have a privacy policy that is available through the platform before the user makes the decision to download the application. The privacy policy should be easily accessible, even through the application's interface.
As with platforms, the FTC advised that app developers utilize just-in-time notifications, specifically with respect to the collection of financial, health or children's data, or the sharing of sensitive data with third parties. Prior to collecting or sharing such information, the FTC advised app developers to obtain the user's affirmative express consent. However, the FTC warned that notifications built into the application should not merely be a repeat of the notifications provided by platforms. Certain aspects of mobile application development, such as the incorporation of third-party code to facilitate advertising, require further thought and consideration by the mobile application developer, and likely require description and notifications beyond those that would be provided by the platform.
3. Advertising Networks & Other Third Parties
As mentioned above, advertising networks provide code to app developers that is integrated into the application. Such third-party code often changes the scope and type of information that is collected by the application. The FTC advised that advertising networks and other third parties better coordinate with mobile application developers to ensure that appropriate notices are displayed at points where sensitive information is collected. The FTC argued that mobile application developers often do not fully appreciate or understand the function of the third-party code that has been provided, and in many cases advertising networks may be collecting information without the knowledge of the app developer.
The FTC also advised that advertising networks should be required to work with platforms to help implement the DNT function for mobile devices described above.
4. Application Trade Associations
Finally, the FTC highlighted the broader role that should be played by trade associations representing mobile app developers. The FTC argued that trade associations should be responsible for setting industry-wide standards, and helping to implement the foregoing recommendations. For example, trade associations are capable of helping to develop standardized icons and uniform disclosures. Trade associations can also work to develop uniform requirements for privacy policies. The FTC also encouraged trade associations to take on an educational role similar to that of platforms, assisting developers with the process of learning to comply with standards and requirements.
While the recommendations of the FTC are not surprising, the approach taken by the FTC in promulgating the recommendations is noteworthy. In singling out platforms, developers, advertising networks and trade associations, with specific recommendations and roles for each, the FTC has put the focus on individual responsibility. This approach signals an emphasis on the kind of enforcement that can only be achieved by defining clear responsibilities for the parties involved. It is likely not a coincidence that these guidelines were released in conjunction with the FTC's announcement of the resolution of its claims against the Path social networking application. We can expect to see more such actions brought in the near future.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
