Research: TRACKING DEVICES

HOW MUCH DO CONSUMERS FULLY UNDERSTAND ABOUT PERSONAL LOCATION DATA PRIVACY

The National Security Agency issued a warning to its employees Aug. 4, 2020, that cellphone location data could pose a national security risk.

The data, which is collected and sold for advertising and marketing purposes, “can reveal details about the number of users in a location, user and supply movements, daily routines and can expose otherwise unknown associations between users and locations,” according to the warning.

While the NSA views such tracking as a potential security threat, consumers have a less straightforward outlook on personal location data tracking, according to Kirsten Martin, the William P. and Hazel B. White Center Professor of Technology Ethics.

Martin’s study, “What Is It About Location?” published in the July 2020 issue of the Berkeley Technology Law Journal and co-authored by Helen Nissenbaum from Cornell Tech, showed that people are nuanced about how their location is tracked. They don’t appreciate it if, for instance, their location data is used to identify if they are voting or attending a protest, but do approve if the data is used by a family member to figure out if they are home. Also, overwhelmingly, people are not comfortable with third-party location data brokers, or data aggregators, collecting location data for any reason.

Martin, who joined Notre Dame in spring 2020, is a nationally recognized expert in privacy, technology and corporate responsibility. In addition to serving as a tenured professor at Mendoza, she also is part of the Notre Dame Technology Ethics Center (NDTEC), which develops and supports multi- and interdisciplinary research on questions related to the impact of technology on humanity.

A highly regarded expert speaker on tech ethics, especially surrounding the use of big data, Martin serves as technology and business ethics editor for the Journal of Business Ethics, a member of the advisory board for the Future Privacy Forum and a faculty affiliate at the Northeastern Center for Law, Innovation and Creativity. She previously was the Lindner-Gambal Professor of Business Ethics and chair of the Strategic Management and Public Policy Department at the George Washington University’s School of Business. She also is the incoming president of the Society of Business Ethics.

Martin’s study starts with the assertion that despite a lot of public debate, research and regulations about location data privacy, “not enough is known about how people understand location data, and what specifically about it affects people’s judgments about others’ access to their whereabouts.” Further, collection of this data is rampant, despite attempts to regulate or curtail it, primarily because those collecting it are fairly wily in exploiting ambiguity in how location is interpreted.

It’s common knowledge that tech companies mine users’ personal information. Apps often collect and share location data with aggregators, who then sell it to corporate and government customers. Privacy issues involving TikTok, Facebook and others have repeatedly been documented in national news stories.

Respondents in Martin’s study were OK with some aspects of location data collection and not OK with others. “Two things stood out,” Martin said. “Respondents clearly differentiated the collection of location data to track if they voted or attended a rally as different from locating them at, say, a restaurant or store. They definitely were not OK with location data being used to locate them voting or protesting. And this study was run two years ago before the recent major protests, so I would imagine it would be vastly more pronounced if conducted today.

“Also, just including the place where the person would be located — at a restaurant, mall, school or work — was enough to skew the rating as less OK. In other words, asking respondents just about collecting location data without explaining what you want to know about them is meaningless. Where they were located and what the company could infer about them — who their friends were or if they attended a rally — were much more important.”

Respondents also consistently rated the collection of location data by aggregators for any reason as not OK — and by a large margin.

Interestingly, the study showed that regardless of whether or not people were comfortable with the data being collected, it never really mattered to them what type of technology was used to collect it.

“Collection technologies we used in our study included phone, mapping app, license plate reader, Fitbit, CCTV and social media posts,” Martin said. “The impact was minimal or nonexistent when we varied the technology. This is important because we often focus on techniques to collect location data.

“For example, collecting from a Fitbit might be OK but not from a phone. Respondents do not see any difference in their expectation of privacy across types of technology. So if users say they don’t want location data gathered from their phone, getting location from their Bluetooth signal, an app or social media posts is problematic overall. They don’t want you to have it no matter what source is used.”

Take the intense media scrutiny of TikTok in July 2020, for example. Martin said its tactics are no different from standard social media data collection practices and that banning or selling that company would do nothing to diminish the privacy violations occurring on people’s smartphones every day.

The study asked a national sample of people to rate a vignette as to the degree that a particular type of collection was acceptable. It included varied specifics about who collected the data — family, data aggregator, employer, FBI, online company, etc. — and what the collector could learn about the individual as a result.

“This information is important for regulators in protecting location data, as well as the companies collecting the data,” Martin said. “For regulators, respondents did not care about technology, yet we tend to regulate by a type of collecting technology or ask for consent for only one type of technology. This would suggest that individuals do not think that way and assume location data is generally protected if they have requested it for one type.

“Perhaps most importantly, data aggregators who collect location data should be worried if individuals ever get any say as to the collection of their data. Consumers clearly do not trust them,” Martin said.

Photo by Barbara Johnston, Illustration by Errata Carmona

KIRSTEN MARTIN, the faculty director of the Notre Dame Technology Ethics Center and the William P. and Hazel B. White Center Professor of Technology Ethics, is a nationally recognized expert in privacy, technology and corporate responsibility. Her research focuses on the ethics of technology and she teaches the ethics of business analytics.

PUBLISHED
“What Is It About Location?” Berkeley Technology Law Journal (July 2020), Kirsten Martin, Helen Nissenbaum