Life360, a popular family safety app used by 33 million people worldwide, has been marketed as a great way for parents to track their children's movements using their cellphones. The Markup has learned, all the same, that the app is selling data on kids' and families' whereabouts to approximately a dozen data brokers who have sold information to most anyone who wants to buy it.

Through interviews with ii former employees of the visitor, along with two individuals who formerly worked at location data brokers Cuebiq and X-Mode, The Markup discovered that the app acts as a firehose of information for a controversial industry that has operated in the shadows with few safeguards to prevent the misuse of this sensitive information. The one-time employees spoke with The Markup on the condition that nosotros not use their names, as they are all still employed in the information industry. They said they agreed to talk because of concerns with the location data industry's security and privacy and a desire to shed more light on the opaque location data economy. All of them described Life360 as ane of the largest sources of information for the manufacture.

"We have no means to confirm or deny the accuracy" of whether Life360 is among the largest sources of data for the industry, Life360 founder and CEO Chris Hulls said in an emailed response to questions from The Markup. "We see data as an important part of our business concern model that allows us to keep the core Life360 services free for the majority of our users, including features that accept improved driver safety and saved numerous lives."

A former X-Mode engineer said the raw location information the company received from Life360 was among X-Mode's near valuable offerings due to the sheer book and precision of the data. A former Cuebiq employee joked that the company wouldn't be able to run its marketing campaigns without Life360's constant menses of location data.

The Markup was able to confirm with a erstwhile Life360 employee and a erstwhile employee of X-Mode that 10-Mode—in addition to Cuebiq and Allstate'south Arity, which the company discloses in its privacy policy—is among the companies that Life360 sells information to. The old Life360 employee also told us Safegraph was amongst the buyers, which was confirmed by an electronic mail from a Life360 executive that was viewed past The Markup. There are potentially more than companies that benefit from Life360's data based on those partners' customers.

Hulls declined to disembalm a full list of Life360'southward information customers and declined to ostend that Safegraph is among them, citing confidentiality clauses, which he said are in the majority of its business organization contracts. Data partners are only publicly disclosed when partners request transparency or there's "a particular reason to do so," Hulls said. He did confirm that X-Mode buys data from Life360 and that information technology is one of "approximately one dozen information partners." Hulls added that the visitor would exist supportive of legislation that would require public disclosure of such partners.

X-Manner, SafeGraph, and Cuebiq are known location data companies that supply data and insights gleaned from that data to other industry players, likewise as customers similar hedge funds or firms that bargain in targeted advertising.

Cuebiq spokesperson Bill Daddi said in an electronic mail that the company doesn't sell raw location data but provides admission to an aggregated set of data through its "Workbench" tool to customers including the Centers for Illness Control and Prevention. Cuebiq, which receives raw location information from Life360, has publicly disclosed its partnership with the CDC to rails "mobility trends" related to the COVID-19 pandemic.

"The CDC only exports aggregate, privacy-safe analytics for enquiry purposes, which completely anonymizes any individual user data," Daddi said. "Cuebiq does non sell data to police enforcement agencies or provide raw data feeds to government partners (unlike others, such as X-Mode and SafeGraph)."

X-Mode has sold location data to the U.Southward. Department of Defense, and SafeGraph has sold location information to the CDC, according to public records.

X-Fashion and SafeGraph didn't respond to requests for comment.

The Life360 CEO said that the company implemented a policy to prohibit the selling or marketing of Life360's information to whatsoever government agencies to exist used for a police force enforcement purpose in 2020, though the visitor has been selling data since at least 2016.

"From a philosophical standpoint, nosotros do not believe it is appropriate for regime agencies to attempt to obtain data in the commercial market every bit a fashion to bypass an individual'south right to due procedure," Hulls said.

Families would probably not like the slogan, 'You tin can picket where your kids are, so can anyone who buys this data,'

Justin Sherman, Duke Tech Policy Lab fellow

The policy also applies to any companies that Life360'due south customers share data with, he said. Hulls said the company maintains "an open and ongoing dialogue" with its customers to ensure they comply with the policy, though he best-selling that it was a challenge to monitor partners' activities.

Life360 discloses in the fine print of its privacy policy that it sells the data it gleans from app users, just Justin Sherman, a cyber policy fellow at the Duke Tech Policy Lab, said people are probably not aware of how far their data can travel.

The company's privacy policy notes Life360 "may also share your information with third parties in a grade that does non reasonably identify you direct. These third parties may utilize the de-identified information for whatsoever purpose."

"Families probably would not like the slogan, 'You lot tin can watch where your kids are, and so can anyone who buys this information,' " Sherman said.

Two former Life360 employees too told The Markup that the visitor, while it states it anonymizes the data it sells, fails to accept necessary precautions to ensure that location histories cannot exist traced back to individuals. They said that while the company removed the most obvious identifying user information, it did not make efforts to "fuzz," "hash," aggregate, or reduce the precision of the location data to preserve privacy.

Hulls said that all of Life360's contracts prohibit its customers from re-identifying individual users, along with other privacy and safety protective practices. He said that Life360 follows "industry best practices" for privacy and that only certain customers like Cuebiq receive raw location information. The one-time X-Mode engineer said that the company as well received raw data from Life360. The visitor relies on its customers to obfuscate that data based on their specific applications, Hulls added.

"Some of our data partners receive hashed information and some do not based on how the data will be used," the Life360 founder said.

Meanwhile, selling location data has become more and more central to the company's health as it's struggled to attain profitability. In 2016, the company made $693,000 from selling information it collected. In 2020, the visitor made $16 meg—nearly 20 pct of its acquirement that year—from selling location information, plus an additional $vi million from its partnership with Arity.

While all the same reporting a loss of $16.3 million last year, the company is expanding its business to include other "digital condom" products, rolling out data breach alerts, credit monitoring, and identity-theft-protection features. Publicly traded on the Australian Securities Substitution with plans to become public in the U.S., Life360 has also caused companies that expand its tracking—and potentially its data-gathering capacity. In 2019, the visitor purchased ZenScreen, a family screen-time monitoring app. And in April, it purchased the wearable location device company Jiobit, aimed at tracking younger children, pets, and seniors, for $37 one thousand thousand. Hulls said Life360 has no plans to sell data from Jiobit devices or its digital safety services.

On November. 22, Life360 also announced plans to buy Tile, a tracking device company that helps find lost items. Hulls said the company doesn't accept plans to sell information from Tile devices.

"I'm sure there are lots of families who do detect very real comfort in an application like this, and that's valid," Sherman said. "That doesn't mean that there aren't means that other people are harmed with this information. It also doesn't mean that the family couldn't be harmed with the information in ways that they're not aware of, such as that location data being used to target ads [or] used by insurance companies to figure out where they're traveling and increment their rates."

Hulls said that Life360 doesn't share users' private data with insurers in ways that could affect insurance rates.

Life360's app allows the user to run across the precise, real-time location of friends or family members, including the speed at which they are driving and the battery level on their devices.

Marketed as a safety app, Life360 is popular among parents who want to rails and supervise their kids from afar. The app offers much of the functionality of Apple tree's built-in location-sharing features, but it includes emergency prophylactic features such every bit an SOS push and vehicle crash detection. The company says these features have saved lives.

But Life360'southward location-based features are too sources of data points for a growing, multibillion-dollar industry that trades in location data gathered from mobile phones. Advertisers, government agencies, and investors are willing to spend hundreds of thousands of dollars for location data and the insights that can be derived from it.

While children tin can use the app (with parental consent), Life360's policy states that the company doesn't sell data on any users under thirteen. The Children's Online Privacy Protection Rule (amend known equally "COPPA") creates restrictions on digital services used by children under 13, and Life360 has detection methods similar requiring a scan of a parent's ID for underage users. Life360 does "disclose" younger children'southward information to third parties "equally needed to analyze and notice driving beliefs data, perform analytics or otherwise ,[sic] support the features and functionality of our Service," according to its privacy policy, but not "for marketing or advertizing purposes."

Marketers utilize location data to target ads to people most businesses, while investors buy data to determine popularity based on human foot traffic. Government agencies accept bought location data to rail movement patterns and in 1 case to support "Special Operations Forces mission requirements overseas."

"It sounds like the company'southward pointing to a couple of cases where, sure, they helped somebody, they were able to do something good," Sherman said. "But then they will not talk about all of the other cases where the ownership and selling of this data is potentially very harmful."

In July, a high-ranking Catholic priest resigned after a Cosmic news outlet outed him by using location data from the gay dating app Grindr linked to his device. The information was obtained past an unknown vendor, and the report claimed to testify that the priest frequented gay bars. In that location is no indication that Life360 was involved in this incident.

Grindr, like other apps that feed data into this industry, is required to ask for location permissions when a user first opens the app.

"We are not aware of whatsoever example where our data has been traced dorsum to individuals via our data partners," Hulls said. "Furthermore, our contracts incorporate language specifically prohibiting any reidentification, and we would aggressively take action against whatever breach of this term."

In Life360's example, considering of how the app works, it asks for the broadest location permissions possible for functional purposes. Many apps that use location data permit users to grant access simply while information technology's in use. Because Life360 is for tracking whereabouts in existent time, the app asks for location data at all times—and does non office unless that permission is turned on.

A disclaimer appears in smaller print at the lesser of the permissions screen: "Your location data may exist shared with Partners for the purposes of crash detection, enquiry, analytics, attribution and tailored advertising." Users can disable the sale of their location data in the privacy settings, though that setting is non disclosed in or part of the prompt.

Life360's Hulls said that millions of its users have used this characteristic to opt out of their data existence sold.

↩︎ link

How to Disable the Auction of Your Location Data in the Life360 App

  1. Tap on the gear icon for "Settings"

    Screenshot of Life360 app highlighting the gear icon on the top left

  2. Tap on "Privacy & Security"

    Screenshot of Life360 app highlighting the "Privacy & Security" button

  3. Tap on "Exercise Not Sell My Personal Information"

    Screenshot of Life360 app highlighting the "Do Not Sell My Personal Information" button

  4. Toggle the button next to "Personal Data Sales" to the off position

    Screenshot of Life360 app highlighting the button next to "Personal Information Sales"

Source: Life360 app

For those who have non opted out, their Life360 data may be shared with the company's partners within 20 minutes of being recorded, a sometime Life360 employee said.

Hulls said this description was "directionally accurate," saying it but applied to certain partners and apply cases.

"For example, some use cases, similar road traffic probing, which powers travel time estimates in automotive navigation systems and GPS apps, require very fresh data," he said.

Privacy researchers and app store operators often look for data brokers' code in apps for signs of an app sending information off to third parties. But Life360 collects its data directly from the app and provides it to information brokers through its own servers.

Apple's and Google'due south app stores take no way of detecting this transfer of location information to a tertiary party. "It makes sense to send this data directly from the server side from the app vendor so it can never exist traced or observed past anyone," said Wolfie Christl, a researcher who investigates digital tracking.

Hulls said Life360'due south method of providing data through its own servers wasn't an intentional endeavour to evade detection from researchers and app stores.

"This is completely unrelated. We have our own proprietary sensor applied science, which we started edifice in 2008 well before the emergence of the data industry, and we avoid using SDKs that could have a negative battery touch on or other interplay with our own sensor technology," he said.

Google didn't comment on why Life360 was able to sell data this way despite its policy confronting selling location information. Apple spokesperson Adam Dema responded with a link to Life360's privacy policy but didn't comment about the company's information sales to companies like SafeGraph and Ten-Manner.

Hulls said Life360 de-identifies the data it sells, which can include a device'south mobile advertising ID, IP address, and latitude and longitude coordinates nerveless by Life360's app.

Hulls antiseptic that "de-identification" involves removing usernames, emails, phone numbers, and other types of identifiable user information earlier the information is shared with Life360's customers. The data sold still includes a device's mobile advertising ID and latitude and longitude coordinates.

Even without names or phone numbers, researchers have repeatedly demonstrated how "anonymized" location data can hands be connected to the people from whom it came.

And privacy experts note that mobile advert IDs are more than valuable than identifiers like names.

"This code can exist used to runway and follow you lot across many life situations," Christl said. "As such, information technology is a much ameliorate identifier than a name."

↩︎ link

Controversial Partners

The location data manufacture operates largely out of public view and with little oversight or regulation. Some of Life360's partners have faced controversy in the by over how they handle information and privacy.

Started in 2013 equally Drunkard Mode, a novelty app that "prevents users from drunk dialing," X-Mode was reportedly banned from the large app stores after Vice's Motherboard reported that the company was selling location data from Muslim prayer apps like Muslim Pro to U.S. government contractors associated with national security, raising concerns nigh unconstitutional regime surveillance.

Public records show that Ten-Mode received at least $423,000 from the U.South. Air Force and the Defense Intelligence Agency for location data between 2019 and 2020. The company also sold data on Americans in profiled sets, like people who were drivers or likely to shop at section stores, according to Motherboard.

In August, X-Mode was purchased by intellectual property intelligence house Digital Envoy and rebranded every bit Outlogic.

In response to the backlash over X-Mode's selling location data to defense contractors, its new owners said the visitor would finish selling U.Southward. location data to such companies.

"We cannot comment on the practices of another company or what that visitor does with data information technology receives from other sources," Hulls said. "Even so, Life360 has worked closely with Ten-Mode to ensure that X-Style and all of its data customers do not sell data originating from Life360 to law enforcement agencies or to whatsoever government agency to exist used for a police force enforcement purpose."

SafeGraph is ane of the biggest firms in the location data business, and its investors include venture capitalist Peter Thiel; Prince Turki Al Faisal Al Saud, former head of Saudi intelligence; and Life360's chief business officer, Itamar Novick.

The company specializes in information that associates places of involvement with raw coordinates, adding a layer of meaning to the raw location data that the company ingests. SafeGraph was identified every bit not just a customer of Life360'southward data simply as well a major partner in an electronic mail from a Life360 executive that was viewed by The Markup.

In April, as first reported by Motherboard, SafeGraph was awarded a $420,000 contract to sell data to the Centers for Affliction Command described equally "Data Gathering and Reporting." The Washington Postal service likewise reported that SafeGraph shared billions of phone location records with the D.C. Section of Health through its spinoff company Veraset.

The company openly sells location information on Amazon's data marketplace, including a $240,000 yearly subscription to data on people beyond the U.South. Veraset has boasted of selling location data for purposes including marketing, real estate, investing, and city planning.

Sen. Ron Wyden has flagged SafeGraph as a "data broker of concern" to Google, Wyden's chief communications officer, Keith Chu, said in an email. The Democrat from Oregon has made multiple attempts to speak with SafeGraph to learn more about how the company obtains, sells, and shares Americans' location data, simply the visitor never responded, Chu said.

Cuebiq also worked with the Centers for Disease Command, with a $208,000 contract awarded in June for aggregated location data, according to public records.

The CDC didn't respond to requests for comment.

During the beginning of the coronavirus pandemic, Cuebiq became a main source of location data for news outlets looking to report on people'southward movements later on cities and states issued stay-at-habitation orders. Outlets including The New York Times and NBC News received location information from Cuebiq for their analyses.

It's been suggested that location information brokers like Cuebiq are using the pandemic to improve their public reputation by presenting themselves every bit tools for public health rather than as mechanisms for surveillance.

Cuebiq's Daddi said the company'southward data has helped in the backwash of natural disasters and public health crises.

↩︎ link

Safety vs. Privacy

Life360 has positioned itself as "the leading digital safety brand for families." But experts say families who utilize it are not necessarily thinking nearly their digital security.

"An app that claims to exist a family safety service selling exact location data to several other companies, this is a full disaster," Christl said. "Information technology would be a problem if it'southward any other app, and it's fifty-fifty more a problem when it's an app that claims to be a family safety service."

An app that claims to be a family rubber service selling verbal location information to several other companies, this is a total disaster.

Wolfie Christl, researcher

Life360 has faced concerns over privacy in the past. In mid-2020, teens, displeased at the privacy invasion of an app that immune their parents to minutely track their movements, took to TikTok to encourage their peers to flop the app with negative reviews. Over the class of a month, the app received more than a million one-star reviews, driving the average rating downwardly from 4.half dozen to 2.7 stars.

Hulls responded by adding a "bubbles" feature that shows parents a more vague location of their child (but still allows parents to encounter exact locations with an additional pace). He also recruited and paid teens to hawk the app on TikTok, resulting in a "viral surge in downloads," according to the company.

Those teens, however, were probable non aware that their parents were hardly the but ones privy to data on their movements.

Samira Madi, an 18-twelvemonth-old student in Texas, started using Life360 when she was fifteen. She didn't have a problem with the company sharing her location information for marketing and ad purposes, which the visitor readily disclosed.

After learning about who Life360 was selling data to, and the calibration it was sold at, Madi felt that the visitor crossed a line.

"I had no idea it would be passed effectually this way," Madi said in an electronic mail. "This concerns me because I would not want my location data to possibly be sold to people with ill intentions."