Tell me your location! Geo-tagging on the rise

20 April 2015 | Michael Morris, Phil O'Sullivan and Byron Frost, Allens Linklaters

In 2014, global beer brand Heineken launched its Twitter-based service which helps consumers explore new experiences in their cities. The service aggregates real-time, location-based social activity and uses it to show where proximate hot locations are for "urbanites" to visit. To use the service, a user posts a geo-tagged tweet to @wherenext to receive recommendations for trending restaurants, events or clubs in their area. The recommendations are generated by a unique algorithm.

The @wherenext service is a great social example of an exchange of information (geo-tagged content) providing an individual benefit (the trendy club is two blocks away!). Clearly though there are individual and business risks involved with using geo-tagged content on social media -- after all this is all about providing location data, generally to a public audience.

In this article, we shine a light on current uses of geo-tagged information (focusing on social media channels), identify the regulatory setting and wrap up with a look at current business practice in this space.

What's a geo-tag?

Geo-tagging information is the process of attaching location-specific information such as geographical coordinates to pictures, videos and even SMS messages. On social media, users may grant permission to a social media channel to geo-tag content posted on that channel. Other social media users may unknowingly upload content that already carries geolocation data (such as a photo, where geolocation data has been attached by digital camera functionality) or they may post content to social media unaware that geo-tagging is enabled for a particular upload.

With the proliferation of GPS-enabled smartphones and other devices, geo-tagged information is on the rise and is increasingly embedded into content posted on social media. Operating software on smartphones may enable geolocation as a default setting (and then override any manual settings to enable geolocation by default during software upgrades). It is therefore unsurprising that in Australia, 72% of those accessing the internet via their mobile phones use a location service at least once a week. Worldwide, Facebook sees 2 billion actions and pieces of geo-tagged information each month, by approximately 200 million of its users.

It's probably public

The most geo-tagged location on Instagram in 2014 was Disneyland in Anaheim, California. How do we know this? Because many social media channels, including Instagram, permit use of their approved application program interfaces (APIs) to aggregate geolocation information.

Much public focus to date on geo-tagging has centred on how law enforcement/intelligence agencies make use of this information, fortuitously (jihadists accidentally tweeting safe house locations in Syria, Federal Bureau of Investigation (FBI) stings following criminals posting drug warehouse locations via Instagram), or otherwise. Police in Australia recently proactively urged people to switch on geo-tagging for mobile phones to help track them down if they went missing during a significant weather event.

Business use of geo-tagged information has a range of potential applications. As we discuss below when using the location information of individuals, a constant focus should always be on transparency of use. Necessarily, privacy considerations arise.

Ben Jackson and Larry Pesce, the creators of the fairly worryingly titled I Can Stalk U website, wrote in 2010 on the Center for Democracy and Technology's blog that:

... a significant difference [exists] between posting a geo-tagged photo of a person's favorite coffee shop online and "checking in" to the same location on a location-based service; although these services are similar in theory, they have different privacy implications.

The difference lies in transparency of use and individuals' awareness of the use of their data. Across social media, individuals may not be aware when uploading photos that their content contains geolocation data, and depending on that individual's settings, once uploaded that content may be (or later become) available publicly.

Websites such as the equally worryingly titled I Know Where Your Cat Lives aim to illustrate this point. I Know Where Your Cat Lives by Owen Mundy, an Associate Professor in the Department of Art at Florida State University, visualises on a Google Map a sample of 1 million public pictures of cats, locating them by the latitude and longitude coordinates embedded in the photo. Photos used on this site were originally uploaded to social media and are subsequently captured by using the approved APIs of relevant social media channels. According to Mundy, there are 15 million images tagged with the word "cat" on public image hosting sites. Other publicly available tools allow users to shade an area of a map (for example, an office building, or a particular street) to show all public geo-tagged social media posts from the selected area for a specified time.

Geo-tagging is currently used in a range of public and non-public ways, and as shown above, for serious and not so serious applications. Given the availability of geo-tagged information and access to social media APIs to aggregate and use such information, it is reasonable to expect that these uses will continue to increase.

Regulatory changes afoot in the US

In the United States, in response to the concerns relating to transparency when collecting location information without active knowledge (see Brightest Flashlight App's recent settlement with the Federal Trade Commission (FTC)), lawmakers are now debating whether legislation should be introduced to regulate the collection and use of geolocation information tag metadata.

The draft Location Privacy Protection Act of 2014, if passed, will prohibit non-governmental entities and individuals from knowingly collecting or disclosing to another entity the geolocation information from an electronic communications device without the consent of the individual using the device. Certain exceptions will exist for public safety/security reasons (§ 2713(b)(2)). Geolocation information is defined for the purposes of the Location Privacy Protection Act of 2014 as information generated by the device sufficient to identify the street and city or town in which the device is located (§ 2713(a)(4)).

Meanwhile, in Australia...

In Australia geo-tagged information is not the subject of any specific legislation but the use of geo-tagged information may be subject to the Privacy Act 1988 (Cth) (Privacy Act).

The Privacy Act regulates the collection and use of an individual's personal information. What constitutes personal information will of course depend on the circumstances. Generally speaking, it is "information or an opinion about an identified individual, or an individual who is reasonably identifiable" (Privacy Act 1988 (Cth), s 6(1)).

The Office of the Australian Information Commissioner (OAIC) has noted that location information may be personal information because it can reveal a user's activity patterns and habits. An entity collecting, using and disclosing geo-tag metadata in Australia may be subject to obligations under the Privacy Act if that geo-tag metadata comprises personal information (as defined in the Privacy Act).

Current business use

Social media channels aside, business use of geo-tagged information should always consider the protection of an individual's privacy. In particular, the OAIC's Mobile Privacy guide recommends that if an app allows users to take photos or videos, the first time that the user activates the photo or video function it should clearly state if the app will tag the images with location data, and if so allow the user to opt-out of this feature. Generally, prudent business practice will include ensuring:

• transparency in use -- consider obtaining a user's consent, or providing the appropriate privacy notifications, before collecting, using or disclosing geo-tagged information, for example as an opt-in, rather than an opt-out proposition; and
• the relevant privacy policy or terms of use explain how such geo-tagged information will be collected and used.

Properly applied, geo-tagged information can be an extremely useful tool for individuals and businesses alike. IBM recently used geo-tag metadata at the Australian Open tennis event (obtained via Wi-Fi enabled device signals) so that fans could see where the biggest crowds were and quickly find the most popular spots at the event. In the Philippines, the implementation of the World Bank-backed Second Mindanao Rural Development Program is being monitored through the geo-tagging of photos at about 500 rural infrastructure sub projects.

However, as the Brightest Flashlight App case in the United States illustrates, there is a growing trend worldwide that users want and should be given an informed choice so "they can decide for themselves whether the benefit of a service is worth the information they must share to use it".

What's next

Facebook's project manager, Josh Williams, told the Where Conference in 2012 that "data density has always been a challenge, especially in the location space where getting meaningful activity around geography is a struggle for young developers."

An area that can present technical, regulatory and business perception challenges, it seems there are new ways being developed everyday to collect, use and disclose geo-tagged information from consumer connected devices, and this is especially prevalent in social media as exemplified by Heineken's @wherenext service. As use of geo-tagged information increases, regulatory change may also present new issues for businesses to consider. In any event, businesses should remain focused on transparency of its collection, use and disclosure of an individual's information and the protection of its customers' privacy in this "app" age.

Originally published in Australian Media, Technology and Communications Law Bulletin, April 2015, Volume 2 No 1