Every time a page loads with open ad space, your site may be broadcasting where your visitor is standing, often to hundreds of companies you've never heard of and never agreed to share with. That's how real-time bidding works: to auction an ad impression, the site sends out a bid request, and that request can carry precise location data to every participant in the auction, whether they win or not. Most site owners don't know it's happening. Neither do their users.
Configuring how advertising is served on your site can have a direct impact on whether your site is exposing precise location data often unbeknownst to your users.
Real-Time Bidding (RTB): A quick overview
When a user visits a site, any ad space a publisher makes available for bidding triggers what’s called a bid request. This bid request can include unique identifiers tied to the user (such as cookie IDs or mobile advertising IDs), information about the page itself, device data, and, in many cases, precise location data, such as GPS or WiFi signal-derived latitude and longitude.
This bid request initiates an auction in which buyers bid to place their advertisers' ads in that space. This all happens in hundreds of milliseconds as the site is loading.
In this ad exchange RTB structure, a single bid request containing a user’s data could potentially be sent to dozens of advertisers, regardless of whether the advertiser was the winning bidder.
Government enforcement actions
Over the last couple of years, the FTC has brought five cases against location data brokers:
Kochava
InMarket
X-Mode
Gravy Analytics
Mobilewalla
These cases broadly relate to how each of these companies collected, used, and sold sensitive location data.
In particular, the FTC matter against Mobilewalla highlights the risks of disclosing a users’ precise location data.
FTC’s case against Mobilewalla
As the FTC alleged in its complaint, Mobilewalla is a data broker that collects data to create comprehensive profiles of individuals. The company did not directly collect location data, rather obtained it from data suppliers as well through the visibility they had as an advertiser on RTB exchanges.
“When Mobilewalla bid to place an advertisement for its clients through an RTB exchange, it collected and retained the information contained in the bid request, even when it did not have a winning bid, and even though the terms of the RTB exchanges disallowed such collection and retention” (FTC complaint at paragraph 10).
For a couple of years, Mobilewalla estimated that around 60% of consumer data came from RTB exchanges amounting to around 619 million unique identifiers paired with location information (complaint para 11-12).
The FTC alleged that Mobilewalla’s collection of personal information, including location information, from RTB exchanges when Mobilewalla had no bid was an unfair practice in violation of the FTC Act (complaint paras 70-71).
Mobilewalla settled with the FTC. In the 20-year order, Mobilewalla is prohibited from collecting and retaining information about consumers from ad exchanges for purposes other than participating in that auction.
While ad exchanges can contractually prohibit advertisers from collecting and retaining individuals’ info, the technical architecture of how RTB exchanges work makes it difficult to limit data exposures like Mobilewalla’s unfair practices.
What to check
Sharing precise location information of a user can result in an unobservable risk of further collection & use. Specifically, do the following:
Audit bid requests. Check whether precise latitude/longitude is being sent, and identify what's collecting it (a header-bidding geolocation module, an SDK, or a third-party script).
Stop it at the source. Disable geolocation modules, and suppress or truncate lat/long in SSP and SDK settings.
Tighten oversight. Require SSPs and exchanges to restrict bidders' retention and use of bid data, with audit rights.
Monitor continuously. Ad partners and configurations often change without notice, so a clean check today might not be accurate in the future.
Given the sensitive nature of precise location data, site owners/publishers should ensure their ad tech stack can’t collect or pass along such sensitive data. Ongoing monitoring is important given the dynamic nature of advertising.
This publication is intended for informational purposes only and is not legal advice. Information in this publication is not intended to create, and receipt does not constitute, an attorney-client relationship. Readers should not act upon this information without seeking professional counsel.