X-Mode Social Sells Geolocation Data to 'Whoever Wants It," Alleges Plaintiff

In January 2021, plaintiff Norma Egan of Somerville, Massachusetts, downloaded a third-party phone app designed to allow users to know the location of their children or other family members, said the complaint. Egan believed the data generated by the app would be used by the third-party app publisher only for functionality related to that app, said the complaint.

But the publisher “later confirmed that it sold location data” to X-Mode Social when Egan used the app, alleged the complaint. The app tracked the geolocation of plaintiff Egan and her family in Massachusetts, then “sold that data for profit” to other third parties without her consent, it said. Even if individuals were aware of X-Mode Social’s tracking code, “they would have no ability to disable the transmissions,” the complaint said. If Egan had been aware that X-Mode Social would receive and sell her geolocation data to third parties, she wouldn't have used the app, the complaint said.

In June 2019, X-Mode began to offer consumers' sensitive location data to the public on the Amazon Web Services Marketplace, said the complaint. Anyone can buy the company’s software development kit (SDK), called XDK, through the marketplace, through which they can reach over 60 million monthly active users, over 400 app publishers and “25% of the adult U.S. population monthly,” said the complaint. The data can be used to measure the effectiveness of ad campaigns or for targeting, among other uses.

X-Mode Social pays app developers to integrate XDK spyware and then sells the data the spyware collects, said the complaint. The function of the XDK is to collect the location data of all Android and iOS users who have XDK embedded in their mobile apps, and X-Mode receives the data whenever a user runs the app, it said. The complaint cited marketing information from X-Mode telling app developers its location collection software allows them to “earn passive revenue from your users.”

X-Mode touts that by using its data its customers can send ads “in near-real time to folks who have walked by [a] kiosk or billboard to retarget them online based on when they walked by the kiosk.” The company’s tracking spyware “always transmits the IP address of the user, which is used to derive location information for purposes of analytics and reporting,” the complaint said.

The complaint referenced recent court filings in which X-Mode said it collects and sells “precise latitude and longitude coordinates” of XDK-enabled mobile application users in “raw form,” which it said is “geolocation correlated directly to the mobile application users’ personal identifiers.” The collected data could be used to identify consumers who have visited an abortion clinic and trace the mobile device of that user “to a single-family residence,” said the complaint. The data could also be used to track consumers’ places of worship, revealing their religious beliefs, or to track consumers who visited a homeless or domestic violence shelter or an addiction recovery center, said the complaint.

Identification of sensitive and private details of consumers from the location data sold and offered by X-Mode “injures or is likely to injure consumers through exposure to stigma, discrimination, physical violence, emotional distress, and other harms,” said the complaint. The injuries are exacerbated by X-Mode’s lack of “meaningful controls over who accesses its location data feed” once the company sells the data, it said. Once information is collected about consumers from their mobile devices, “the information can be sold multiple times to companies that consumers have never heard of and never interacted with,” it said.

X-Mode faced controversy over how it handles data and privacy, said the complaint, saying the tracking technology “was banned from most app stores" after it was discovered that the company was selling location data from Muslim prayer apps to U.S. government contractors associated with national security. The complaint referenced public records showing X-Mode received at least $423,000 from the U.S. Air Force and the Defense Intelligence Agency for location data.

Egan asserts claims of unjust enrichment and violation of the Massachusetts Unfair and Deceptive Business Practices Act. She seeks for herself and the class compensatory, statutory and punitive damages, prejudgment interest on awarded amounts and attorneys’ fees and legal costs. She also seeks an order of restitution and another enjoining X-Mode from continuing “illegal practices.” X-Mode didn't comment.