Life360 is a family safety app that over 33 million customers around the world use. It has a single purpose — to track your children's location in real-time through their smartphones. A story at The Markup discovered that the company is doing more with that data than just keeping parents informed of where their children are (and have been). Apparently, it is selling this location data to about a dozen companies that broker data to "virtually anyone who wants to buy it."
This isn't anything new, and there is a good chance that your location data has been sold in a very similar way. We've seen carriers and ad networks do something very similar when it comes to the location data collected from us. So many different companies collect user data that it's tough to keep track of where it's going and who can access it. It doesn't matter if you buy one of the best Android phones, or one of the cheapest, or even an iPhone. Someone is still collecting your data. One thing remains true, though — once this data is passed on to a "data broker," just about anyone with enough money can buy it.
What makes this particular story interesting is that Life360 is the company that just bought Tile. If you're not familiar with Tile, they're small Bluetooth devices that can help you track lost things. When you or another device with the Tile app installed gets close enough (dependant on your device settings), the location of the Tile tracker is logged, and if the device owner opens the app, they can track it over time. It's like a two-for-one special with your location data on the menu. Life360 founder and CEO Chris Hulls confirmed to The Markup that the company has no plans to sell data collected from Tile devices. Tile has also stated that its current privacy policy, where no personal data is sold, will remain in effect.
Life360 does mention that it can sell your data to third parties in its privacy policy (The Markup has found an archived version here), but most users of the service probably didn't wade through the legal language to get that far. That's not Life360's fault, though, and Hulls says, "We have no means to confirm or deny the accuracy" of whether Life360 is among the largest sources of data for the industry. It would be great if all of the data were anonymized and encrypted, but according to two former Life360 employees, that just isn't always the case.
Data harvesting is big business because it makes big money.
This is another chapter in the saga of data brokers and their seemingly unchecked business model. Companies like Life360 aren't selling user data directly and instead go through what amounts to data clearinghouses that specialize in buying user data in bulk then reselling it in individual batches. Bounty hunters can buy your location data. Bill collectors can buy your location data. I can buy your location data, or you can buy mine. Most concerning of all, though, government agencies and law enforcement can buy your location data without your consent or judicial oversight.
Life360 did implement a policy that prohibits the reselling of user data to government agencies last year, with Hulls telling The Markup, "From a philosophical standpoint, we do not believe it is appropriate for government agencies to attempt to obtain data in the commercial market as a way to bypass an individual's right to due process." This doesn't address the selling of any user data prior to 2020, which has been ongoing since 2016.
This is very profitable for every company involved. In 2020, Life360 made 20 percent of its revenue from selling location data for the sum of $16 million. Companies that broker your location data are making even more by selling it in small chunks to the highest bidder for as little as $300. A single person's location data can be bought for as little as $8.42 after it all changes hands.
The changing hands part is doubly important when it comes to government agencies or law enforcement in the U.S. While each country has its data protection laws, in the U.S., it is illegal to collect data to sell directly to the government or law enforcement, but not illegal for the government or law enforcement to buy it.
It's illegal to sell customer data to the government but not illegal for the government to buy it.
When a chain is created where the data is collected by one party, sold to another and another, and eventually ends up being sold to a government agency, no laws have been broken. Unfortunately, because of this shady data collection and distribution chain, we can't be sure exactly who bought data collected by Life360. Still, we do know the company sold data to brokers that list the Department of Defense and the CDC as customers.
Life360 isn't breaking any laws and says it is technically abiding by its privacy agreement. Most companies that collect and sell data do the same. This is because there is no need to break any laws or contracts, and an entire industry is dedicated to making money from our personal details. I've said it before, and I'll say it again: data is currency, and we're paying a lot more than we think.
