Mobile carriers and app providers do not consistently or clearly disclose to customers how they use location information and other personal data, according to a new report from government auditor the U.S. Government Accountability Office (GAO).
The GAO report shows the need for legislation to address how carriers use location information, said Senator Al Franken, a Minnesota Democrat who asked for the study. Franken's Location Privacy Protection Act would require mobile carriers and app makers to get customer permission before collecting location information and before sharing it with other companies.
"I believe Americans have a fundamental right to privacy: to know what information is being collected about them and to be able to control whether or not that information is shared with third parties," Franken said in a statement. "And this report clearly shows that mobile industry companies often fail to respect that right, giving out consumers' location data without their knowledge or explicit consent."
Mobile customers can benefit from location-based services on smartphones, and mobile companies can use the data to increase advertising revenue and improve service, the GAO report said. And many mobile carriers and app providers have developed privacy policies. But they have "not consistently or clearly disclosed to consumers what the companies are doing with these data or which third parties they may share them with," the report added.
Privacy and industry groups have recommended location privacy practices, but those recommendations aren't consistently followed, the report said.
"We found that there aren't very many rules," Mark Goldstein, the GAO's director of physical infrastructure, said in a podcast about the report. "In many ways, this is still the Wild West of the electronic era. There's a lot of work that still needs to be done."
Representatives of the CTIA, a trade group representing mobile carriers, and the Association for Competitive Technology, a trade group representing mobile app developers, weren't immediately available for comment on the GAO report.
The report recommended that the U.S. Federal Trade Commission issue comprehensive guidance to mobile companies about location data privacy. The U.S. National Telecommunications and Information Administration (NTIA), which launched a series of multistakeholder privacy meetings this year, has not set performance goals for the process and lacks a mechanism to enforce any privacy recommendations created in the process, the report said.
The GAO report's authors looked at the privacy practices of 14 mobile companies, with 11 of the 14 being carriers, operating-system developers or app developers. Ten of the 11 disclosed that they used customers' location data, but many policies were "not clear," the report said.
Four of the companies described ways they used personal data, but did not say whether they consider location data to be personal data, the report said.
