Location Privacy

A month ago, I was at the MetaPlaces conferences on a panel on Privacy. Dev, the moderator, asked a really interesting question: “what are you most scared about”. It is a very interesting question. Sitting next to me was the head lawyer of the CDT, someone who has giving me tons of grief about the w3c’s approach of geolocation on the web. He joke that my biggest fear should be not listening to his advise on this. However, I am a lot more scared of something else.

The previous day at MetaPlaces, I heard a lot about mobile advertising and the targeting operators can provide. What was most scary for me was the amount of information operators have and their use of this information to place you into a very detailed market segmentation… all of this without your expressed permission…

One company was able to take a two week data drop from an undisclosed operator and tell you the sort of lifestyle, socioeconomic status, age range, and other demographics of the phone owner. The data drop merely consisted of longitudes and latitudes of where the phone was at given times. Following a single phone you are able to known where the person lives, what kind of coffee he drinks, what area the person works, what stores he shops at, what their work hours are like, are they hitting clubs at night or are going home, and do they spend time at the library. And the user is aware that this sort of tracking is happening!

This is wrong. Operators should always be up front about this. The location data is yours. Where you take your phone, like who you call, is personal information.

Recently, a group of privacy advocates are calling on Congress to address some of these concerns. Some of the more interesting requests are:

* Sensitive information should not be collected or used for behavioral tracking or targeting.

* Individuals should be protected even if the information collected about them in behavioral tracking cannot be linked to their names, addresses, or other traditional “personally identifiable information,” as long as they can be distinguished as a particular computer user based on their profile.

* Individuals should have the right to confirm whether a data controller has their personal or behavioral
data, request such data, and delete it.

For more information about this effort, please check out the CDD press release.