Mobile App Makers and Consumers Get Smart About Privacy

Catherine Dunn

Corporate Counsel

09-10-2012

A recent study by the Future of Privacy Forum found that developers of top-selling mobile apps were increasingly using privacy policies to cover how they use customer data. Now the Federal Trade Commission is out with new guidance on what such policies should make clear to smartphone and tablet consumers.

Think of the FTC document’s nine bullet points on truthful advertising and privacy as “kind of a friendly reminder,” says Arent Fox partner Ross Buntrock, who leads the firm’s telecommunications practice in Washington, D.C. For starters the agency recommends that businesses “tell the truth about what your app can do” and "disclose key information clearly and conspicuously."

The succinct guidance doesn’t contain any new requirements. Rather, Buntrock says, it’s the FTC’s way of telling app developers, “You’re within our bailiwick, and you should know it.”

From the perspective of nervous tech consumers, the guidance also appears to be well timed. A new survey by the Pew Research Center finds that 88 percent of American adults use mobile phones, and 43 percent of them download apps to their phones -- up from 31 percent of mobile phone owners who did so in 2011. Many of those app users definitely have privacy on the brain. According to the report [PDF]:

57 percent of all app users have either uninstalled an app over concerns about having to share their personal information, or declined to install an app in the first place for similar reasons.

19 percent of cell owners have turned off the location tracking feature on their cell phone because they were concerned that other individuals or companies could access that information.

The FTC guidance, "Marketing Your Mobile App: Get It Right from the Start," makes seven recommendations related to privacy. Among them:

Build privacy considerations in from the start. The FTC calls this "privacy by design." What does it mean? Incorporating privacy protections into your practices, limiting the information you collect, securely storing what you hold on to, and safely disposing of what you no longer need.

Be transparent about your data practices. For example, if you share information with another company, tell your users and give them information about that company's data practices.

The guidance references several enforcement actions the FTC has taken with regard to company policies. In recommending that app makers issue disclosures that are "clear and conspicuous," the agency notes:

Generally, the law doesn’t dictate a specific font or type size, but the FTC has taken action against companies that have buried important terms and conditions in long licensing agreements, in dense blocks of legal mumbo jumbo, or behind vague hyperlinks.

The agency also warns companies against breaking their "privacy promises." It has gone after businesses "that made broad statements about their privacy practices, but then failed to disclose the extent to which they collected or shared information with others -- like advertisers or other app developers," according to the guidance.

In February, the FTC issued a report on the lack of privacy policies among apps aimed at children. Though the agency isn't the only entity keeping an eye on the mobile app-privacy sphere. Earlier this year, California Attorney General Kamela Harris reached an agreement with seven companies -- Apple Inc., Google Inc., Amazon, Microsoft Corp., Research In Motion, Hewlett-Packard Development Corp., and Facebook -- over compliance with the state's Online Privacy Protection Act.

The National Telecommunications and Information Administration, which operates within the U.S. Department of Commerce, is also in the process of meeting with industry representatives and other stakeholders to develop a code of conduct on mobile app transparency. The group is currently scheduled to meet through December.

See also: "Mobile App Companies Posting More Privacy Policies," Corporate Counsel, July 2012.