Life360, a popular family condom app used by 33 million people worldwide, has been marketed as a great way for parents to rails their children's movements using their cellphones. The Markup has learned, yet, that the app is selling data on kids' and families' whereabouts to approximately a dozen data brokers who take sold data to virtually anyone who wants to buy it.

Through interviews with ii old employees of the company, along with two individuals who formerly worked at location data brokers Cuebiq and 10-Mode, The Markup discovered that the app acts as a firehose of information for a controversial industry that has operated in the shadows with few safeguards to prevent the misuse of this sensitive information. The quondam employees spoke with The Markup on the condition that we not use their names, every bit they are all still employed in the data industry. They said they agreed to talk because of concerns with the location data manufacture's security and privacy and a desire to shed more lite on the opaque location data economy. All of them described Life360 as ane of the largest sources of data for the industry.

"We have no means to confirm or deny the accuracy" of whether Life360 is amid the largest sources of data for the industry, Life360 founder and CEO Chris Hulls said in an emailed response to questions from The Markup. "We see data as an important part of our business model that allows the states to keep the core Life360 services free for the majority of our users, including features that accept improved driver safety and saved numerous lives."

A erstwhile X-Mode engineer said the raw location data the company received from Life360 was among X-Mode's most valuable offerings due to the sheer volume and precision of the data. A former Cuebiq employee joked that the company wouldn't be able to run its marketing campaigns without Life360's constant flow of location data.

The Markup was able to confirm with a former Life360 employee and a former employee of Ten-Mode that X-Mode—in improver to Cuebiq and Allstate's Arity, which the visitor discloses in its privacy policy—is among the companies that Life360 sells data to. The sometime Life360 employee besides told us Safegraph was among the buyers, which was confirmed by an email from a Life360 executive that was viewed by The Markup. There are potentially more companies that benefit from Life360's information based on those partners' customers.

Hulls declined to disclose a full list of Life360's data customers and declined to ostend that Safegraph is amid them, citing confidentiality clauses, which he said are in the majority of its business contracts. Data partners are only publicly disclosed when partners request transparency or there's "a particular reason to practise and then," Hulls said. He did confirm that X-Manner buys data from Life360 and that it is one of "approximately one dozen data partners." Hulls added that the company would be supportive of legislation that would require public disclosure of such partners.

X-Way, SafeGraph, and Cuebiq are known location data companies that supply data and insights gleaned from that information to other industry players, as well as customers like hedge funds or firms that bargain in targeted advertising.

Cuebiq spokesperson Bill Daddi said in an e-mail that the company doesn't sell raw location data but provides access to an aggregated set of data through its "Workbench" tool to customers including the Centers for Affliction Command and Prevention. Cuebiq, which receives raw location data from Life360, has publicly disclosed its partnership with the CDC to rails "mobility trends" related to the COVID-19 pandemic.

"The CDC simply exports amass, privacy-rubber analytics for research purposes, which completely anonymizes whatever individual user information," Daddi said. "Cuebiq does not sell data to constabulary enforcement agencies or provide raw data feeds to government partners (different others, such as X-Fashion and SafeGraph)."

Ten-Mode has sold location information to the U.South. Department of Defense, and SafeGraph has sold location data to the CDC, according to public records.

X-Manner and SafeGraph didn't answer to requests for comment.

The Life360 CEO said that the company implemented a policy to prohibit the selling or marketing of Life360's data to whatever government agencies to be used for a law enforcement purpose in 2020, though the company has been selling information since at least 2016.

"From a philosophical standpoint, we practise not believe it is appropriate for regime agencies to attempt to obtain data in the commercial market equally a way to featherbed an individual'south right to due process," Hulls said.

Families would probably not like the slogan, 'You tin can watch where your kids are, and so tin can anyone who buys this data,'

Justin Sherman, Duke Tech Policy Lab swain

The policy also applies to any companies that Life360'south customers share data with, he said. Hulls said the company maintains "an open and ongoing dialogue" with its customers to ensure they comply with the policy, though he acknowledged that it was a challenge to monitor partners' activities.

Life360 discloses in the fine print of its privacy policy that information technology sells the data information technology gleans from app users, just Justin Sherman, a cyber policy fellow at the Duke Tech Policy Lab, said people are probably not enlightened of how far their data can travel.

The company's privacy policy notes Life360 "may also share your information with third parties in a course that does not reasonably identify you lot directly. These third parties may utilise the de-identified data for any purpose."

"Families probably would non like the slogan, 'You lot tin can watch where your kids are, and and then can anyone who buys this data,' " Sherman said.

Two former Life360 employees also told The Markup that the company, while it states it anonymizes the data it sells, fails to have necessary precautions to ensure that location histories cannot be traced back to individuals. They said that while the company removed the almost obvious identifying user information, it did not make efforts to "fuzz," "hash," aggregate, or reduce the precision of the location data to preserve privacy.

Hulls said that all of Life360's contracts prohibit its customers from re-identifying individual users, along with other privacy and condom protective practices. He said that Life360 follows "industry best practices" for privacy and that but certain customers like Cuebiq receive raw location data. The onetime Ten-Way engineer said that the visitor also received raw data from Life360. The visitor relies on its customers to obfuscate that information based on their specific applications, Hulls added.

"Some of our data partners receive hashed data and some practice non based on how the information will be used," the Life360 founder said.

Meanwhile, selling location data has become more and more central to the visitor'due south health as it'southward struggled to attain profitability. In 2016, the visitor made $693,000 from selling data it collected. In 2020, the company made $16 million—nearly xx percent of its revenue that year—from selling location data, plus an additional $6 1000000 from its partnership with Arity.

While even so reporting a loss of $16.3 million last year, the company is expanding its business organisation to include other "digital rubber" products, rolling out data alienation alerts, credit monitoring, and identity-theft-protection features. Publicly traded on the Australian Securities Exchange with plans to go public in the U.South., Life360 has also acquired companies that expand its tracking—and potentially its data-gathering capacity. In 2019, the company purchased ZenScreen, a family screen-time monitoring app. And in April, information technology purchased the wearable location device company Jiobit, aimed at tracking younger children, pets, and seniors, for $37 one thousand thousand. Hulls said Life360 has no plans to sell data from Jiobit devices or its digital safety services.

On Nov. 22, Life360 also appear plans to buy Tile, a tracking device company that helps find lost items. Hulls said the company doesn't take plans to sell data from Tile devices.

"I'thousand certain there are lots of families who do find very real comfort in an application similar this, and that's valid," Sherman said. "That doesn't mean that in that location aren't means that other people are harmed with this data. Information technology also doesn't mean that the family couldn't be harmed with the data in ways that they're not aware of, such as that location data being used to target ads [or] used by insurance companies to figure out where they're traveling and increment their rates."

Hulls said that Life360 doesn't share users' individual information with insurers in means that could touch insurance rates.

Life360's app allows the user to run across the precise, existent-time location of friends or family members, including the speed at which they are driving and the bombardment level on their devices.

Marketed as a rubber app, Life360 is pop amongst parents who desire to track and supervise their kids from afar. The app offers much of the functionality of Apple'southward born location-sharing features, but it includes emergency safety features such as an SOS button and vehicle crash detection. The company says these features have saved lives.

But Life360's location-based features are also sources of data points for a growing, multibillion-dollar industry that trades in location data gathered from mobile phones. Advertisers, government agencies, and investors are willing to spend hundreds of thousands of dollars for location information and the insights that tin be derived from it.

While children can employ the app (with parental consent), Life360's policy states that the company doesn't sell information on any users under 13. The Children's Online Privacy Protection Dominion (better known as "COPPA") creates restrictions on digital services used by children nether xiii, and Life360 has detection methods like requiring a browse of a parent'southward ID for underage users. Life360 does "disembalm" younger children's data to 3rd parties "as needed to analyze and detect driving behavior data, perform analytics or otherwise ,[sic] support the features and functionality of our Service," according to its privacy policy, just non "for marketing or advertising purposes."

Marketers use location data to target ads to people well-nigh businesses, while investors buy data to determine popularity based on foot traffic. Government agencies accept bought location data to track movement patterns and in ane instance to support "Special Operations Forces mission requirements overseas."

"It sounds like the company's pointing to a couple of cases where, certain, they helped somebody, they were able to do something skilful," Sherman said. "Just then they will not talk about all of the other cases where the ownership and selling of this data is potentially very harmful."

In July, a high-ranking Catholic priest resigned afterwards a Catholic news outlet outed him by using location data from the gay dating app Grindr linked to his device. The data was obtained by an unknown vendor, and the written report claimed to show that the priest frequented gay bars. There is no indication that Life360 was involved in this incident.

Grindr, like other apps that feed information into this industry, is required to ask for location permissions when a user first opens the app.

"We are not aware of any example where our information has been traced dorsum to individuals via our data partners," Hulls said. "Furthermore, our contracts contain linguistic communication specifically prohibiting any reidentification, and we would aggressively take action against whatsoever breach of this term."

In Life360's instance, because of how the app works, information technology asks for the broadest location permissions possible for functional purposes. Many apps that utilise location data let users to grant access only while information technology'south in use. Considering Life360 is for tracking whereabouts in real fourth dimension, the app asks for location information at all times—and does non function unless that permission is turned on.

A disclaimer appears in smaller print at the bottom of the permissions screen: "Your location data may be shared with Partners for the purposes of crash detection, research, analytics, attribution and tailored advertising." Users tin disable the sale of their location data in the privacy settings, though that setting is not disclosed in or role of the prompt.

Life360's Hulls said that millions of its users have used this feature to opt out of their data being sold.

↩︎ link

How to Disable the Sale of Your Location Information in the Life360 App

  1. Tap on the gear icon for "Settings"

    Screenshot of Life360 app highlighting the gear icon on the top left

  2. Tap on "Privacy & Security"

    Screenshot of Life360 app highlighting the "Privacy & Security" button

  3. Tap on "Practice Not Sell My Personal Information"

    Screenshot of Life360 app highlighting the "Do Not Sell My Personal Information" button

  4. Toggle the button next to "Personal Information Sales" to the off position

    Screenshot of Life360 app highlighting the button next to "Personal Information Sales"

Source: Life360 app

For those who have not opted out, their Life360 information may exist shared with the company's partners within twenty minutes of being recorded, a former Life360 employee said.

Hulls said this description was "directionally accurate," maxim it simply applied to certain partners and use cases.

"For example, some use cases, similar road traffic probing, which powers travel fourth dimension estimates in automotive navigation systems and GPS apps, require very fresh information," he said.

Privacy researchers and app store operators often look for data brokers' lawmaking in apps for signs of an app sending data off to third parties. But Life360 collects its data directly from the app and provides it to data brokers through its own servers.

Apple's and Google'south app stores accept no way of detecting this transfer of location information to a third party. "It makes sense to send this data directly from the server side from the app vendor so information technology can never be traced or observed by anyone," said Wolfie Christl, a researcher who investigates digital tracking.

Hulls said Life360'due south method of providing data through its own servers wasn't an intentional attempt to evade detection from researchers and app stores.

"This is completely unrelated. Nosotros have our ain proprietary sensor technology, which we started building in 2008 well earlier the emergence of the data industry, and we avert using SDKs that could accept a negative battery impact or other interplay with our own sensor engineering science," he said.

Google didn't comment on why Life360 was able to sell information this mode despite its policy against selling location data. Apple spokesperson Adam Dema responded with a link to Life360's privacy policy simply didn't annotate virtually the visitor's data sales to companies similar SafeGraph and X-Fashion.

Hulls said Life360 de-identifies the data information technology sells, which can include a device's mobile advertising ID, IP accost, and latitude and longitude coordinates collected by Life360'south app.

Hulls clarified that "de-identification" involves removing usernames, emails, phone numbers, and other types of identifiable user information before the data is shared with Life360'southward customers. The data sold still includes a device'due south mobile advertising ID and latitude and longitude coordinates.

Fifty-fifty without names or telephone numbers, researchers have repeatedly demonstrated how "anonymized" location information can easily be continued to the people from whom it came.

And privacy experts annotation that mobile advertising IDs are more than valuable than identifiers like names.

"This lawmaking tin can be used to rail and follow you across many life situations," Christl said. "Every bit such, it is a much better identifier than a proper name."

↩︎ link

Controversial Partners

The location data industry operates largely out of public view and with little oversight or regulation. Some of Life360'due south partners have faced controversy in the past over how they handle data and privacy.

Started in 2013 equally Drunk Mode, a novelty app that "prevents users from drunk dialing," X-Manner was reportedly banned from the big app stores subsequently Vice'southward Motherboard reported that the company was selling location data from Muslim prayer apps like Muslim Pro to U.S. government contractors associated with national security, raising concerns most unconstitutional regime surveillance.

Public records show that 10-Manner received at to the lowest degree $423,000 from the U.S. Air Strength and the Defense Intelligence Bureau for location data between 2019 and 2020. The company also sold data on Americans in profiled sets, like people who were drivers or likely to shop at section stores, co-ordinate to Motherboard.

In August, X-Mode was purchased by intellectual property intelligence firm Digital Envoy and rebranded as Outlogic.

In response to the backfire over X-Mode's selling location data to defense contractors, its new owners said the visitor would stop selling U.S. location data to such companies.

"We cannot comment on the practices of another visitor or what that visitor does with information it receives from other sources," Hulls said. "However, Life360 has worked closely with X-Mode to ensure that X-Mode and all of its data customers do not sell data originating from Life360 to police enforcement agencies or to any regime agency to be used for a law enforcement purpose."

SafeGraph is one of the biggest firms in the location data business organisation, and its investors include venture capitalist Peter Thiel; Prince Turki Al Faisal Al Saud, erstwhile head of Saudi intelligence; and Life360's principal business officer, Itamar Novick.

The company specializes in information that associates places of interest with raw coordinates, calculation a layer of meaning to the raw location information that the visitor ingests. SafeGraph was identified as not just a client of Life360's information but also a major partner in an electronic mail from a Life360 executive that was viewed past The Markup.

In April, as first reported by Motherboard, SafeGraph was awarded a $420,000 contract to sell data to the Centers for Disease Command described as "Data Gathering and Reporting." The Washington Postal service besides reported that SafeGraph shared billions of phone location records with the D.C. Department of Health through its spinoff company Veraset.

The company openly sells location data on Amazon's information marketplace, including a $240,000 yearly subscription to data on people beyond the U.Southward. Veraset has boasted of selling location data for purposes including marketing, real estate, investing, and city planning.

Sen. Ron Wyden has flagged SafeGraph as a "data broker of concern" to Google, Wyden'south main communications officer, Keith Chu, said in an email. The Democrat from Oregon has fabricated multiple attempts to speak with SafeGraph to learn more about how the visitor obtains, sells, and shares Americans' location data, just the company never responded, Chu said.

Cuebiq as well worked with the Centers for Disease Control, with a $208,000 contract awarded in June for aggregated location data, according to public records.

The CDC didn't answer to requests for comment.

During the beginning of the coronavirus pandemic, Cuebiq became a principal source of location data for news outlets looking to written report on people's movements after cities and states issued stay-at-abode orders. Outlets including The New York Times and NBC News received location information from Cuebiq for their analyses.

It's been suggested that location data brokers similar Cuebiq are using the pandemic to amend their public reputation by presenting themselves as tools for public health rather than as mechanisms for surveillance.

Cuebiq's Daddi said the visitor's data has helped in the aftermath of natural disasters and public wellness crises.

↩︎ link

Safety vs. Privacy

Life360 has positioned itself every bit "the leading digital safety brand for families." But experts say families who use it are non necessarily thinking almost their digital security.

"An app that claims to be a family prophylactic service selling verbal location data to several other companies, this is a full disaster," Christl said. "It would be a problem if it's whatsoever other app, and information technology's fifty-fifty more a problem when information technology's an app that claims to exist a family unit safety service."

An app that claims to exist a family prophylactic service selling exact location data to several other companies, this is a total disaster.

Wolfie Christl, researcher

Life360 has faced concerns over privacy in the by. In mid-2020, teens, displeased at the privacy invasion of an app that immune their parents to minutely runway their movements, took to TikTok to encourage their peers to bomb the app with negative reviews. Over the grade of a calendar month, the app received more than a million 1-star reviews, driving the boilerplate rating down from 4.half dozen to ii.7 stars.

Hulls responded by calculation a "bubbles" characteristic that shows parents a more vague location of their child (but notwithstanding allows parents to see exact locations with an additional step). He likewise recruited and paid teens to hawk the app on TikTok, resulting in a "viral surge in downloads," according to the company.

Those teens, however, were likely not aware that their parents were hardly the only ones privy to data on their movements.

Samira Madi, an eighteen-yr-quondam student in Texas, started using Life360 when she was fifteen. She didn't have a problem with the visitor sharing her location information for marketing and advertising purposes, which the visitor readily disclosed.

Subsequently learning about who Life360 was selling information to, and the scale it was sold at, Madi felt that the company crossed a line.

"I had no idea it would be passed effectually this mode," Madi said in an email. "This concerns me considering I would not want my location data to perhaps exist sold to people with ill intentions."