Class Action Claims Digital Ad Platform InMarket Unlawfully Tracks, Sells Users’ Location Data via ‘Spyware’

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims digital advertising agency InMarket Media has unlawfully tracked and profited from the sale of consumer data through the use of “spyware” incorporated into more than 300 third-party mobile apps.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 20-page lawsuit alleges the marketing platform has run afoul of California privacy laws by tracking app users’ geolocation and other information through its software development kit (SDK)—a collection of software tools that can be embedded into a third-party app to collect analytics data. Once InMarket’s SDK is incorporated into an app, the spyware technology automatically transmits an app user’s precise location back to the company in real time, the suit shares.

According to the case, a third-party app that utilizes the SDK requests from the user access to the location data generated by their mobile device.

“Critically, if the user allows access, the InMarket SDK receives the device’s precise latitude and longitude, along with a timestamp and unique mobile device identifier, as often as the mobile device’s operating system provides it—ranging from almost no collection when the device is idle, to every few seconds when the device is actively moving—and transmits it directly to [InMarket’s] servers,” the complaint relays.

The hundreds of apps that have incorporated the InMarket spyware tool have been downloaded to and used by more than 390 million unique devices since 2017, the filing stresses, meaning InMarket has been able to collect a significant cache of user data during that time.

The lawsuit claims the company has unlawfully profited from this data by selling it to third parties and using it for targeted advertising purposes.

In addition, InMarket “does little” to confirm that apps that use its SDK obtain consent from consumers before allowing the defendant access to their geolocation and other data, the suit contends.

What’s more, InMarket retains user information for five years before deleting it—an “unreasonably long retention period” that “significantly increases the risk that this sensitive data could be disclosed, misused, and linked back to the consumer,” the case argues.

Per the complaint, the Federal Trade Commission (FTC) took action against InMarket in January of this year over allegations that the company failed to make proper disclosures to consumers and acquire consent from app users before collecting their location data. As part of the proposed settlement, InMarket will be prohibited from selling or licensing any precise location data, and from selling, licensing, transferring or sharing any product or service that categorizes or targets consumers based on their location data, the FTC announced.

The lawsuit looks to represent anyone in the United States whose data, including but not limited to their geolocation data, was sold by InMarket Media without their consent.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.