FTC chair races to finish crackdown on creepy location-data brokers

In a pair of statements today, the Federal Trade Commission announced settlements with two more data brokers over their sale of sensitive location data: Mobilewalla and Gravy Analytics (and its subsidiary Venntel). These latest settlements come after several FTC enforcement actions against location-data brokers including Kochava, X-Mode, and InMarket.

The FTC crackdown on location data has focused on companies that collect or aggregate consumers’ location data without explicit consent from sensitive locations, including medical providers’ offices, houses of worship, military installations, and schools.

Time is running out for FTC Chair Lina Khan to wrap up the agency’s pending work, as her term is coming to an end. President-elect Trump will likely place a more business-friendly leader for the agency, as he moves to roll back regulations across many industries.

Shortly after Election Day, Senator Ted Cruz, the Republican ranking member of the Senate Committee on Commerce, Science, and Transportation, sent a letter to Lina Khan warning her that “any controversial FTC action taken up or continued after November 5th will receive particular scrutiny.”

Gravy Analytics and Venntel

In today’s proposed order, Gravy Analytics and Venntel are prohibited from “selling, disclosing, or using sensitive location data in any product or service, and must establish a sensitive data location program,” according to the FTC’s press release. The companies were sued by the FTC for collecting location data via “geofences,” which are virtual lines drawn around buildings “to identify and sell lists of consumers who attended certain events related to medical conditions and places of worship,” as well as additional lists associating people through other sensitive information.

Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release:

“Surreptitious surveillance by data brokers undermines our civil liberties and puts servicemembers, union workers, religious minorities, and others at risk. This is the FTC’s fourth action taken this year challenging the sale of sensitive location data, and it’s past time for the industry to get serious about protecting Americans’ privacy.”

Sherwood reached out to Gravy Analytics and Unacast (the parent company), but the email bounced back.

Mobilewalla

Mobilewalla will be banned from selling sensitive location data and will be required to only use consumer data for online auctions, according to the proposed order. Mobilewalla does not collect this data directly from consumers, but rather aggregates and “enriches” consumer data with data collected from advertising real-time bidding exchanges, which often include a phone’s precise location.

Real-time bidding data is only supposed to be used for placing mobile ads via split-second auctions, but because there aren’t any rules covering the misuse of this data, many location-data companies harvest this fire hose of data for peoples’ movements. Importantly, this location data is not controlled by your phones’ location settings, but rather inferred from your IP address, which is tied to the network you’re connected to. The FTC notes that this is the first time the agency has flagged this practice as illegal under the law.

“Mobilewalla exploited vulnerabilities in digital ad markets to harvest this data at a stunning scale. The FTC is cracking down on firms that unlawfully exploit people’s sensitive location data and ensuring that we protect Americans from unchecked surveillance,” FTC Chair Lina Khan said in the press release.

Laurie Hood, a spokesperson for Mobilewalla, said in an email:

“Mobilewalla respects consumer privacy and has been evolving our privacy protections throughout our history as a company. While we disagree with many of the FTC’s allegations and implications that Mobilewalla tracks and targets individuals based on sensitive categories, we are satisfied that the resolution will allow us to continue providing valuable insights to businesses in a manner that respects and protects consumer privacy.”

Aside from these enforcement actions, the location data industry — estimated to be a $12 billion market — has operated with little oversight and few restrictions on who can purchase this data, which in many cases can easily be used to identify individuals’ precise movements. The Supreme Court’s 2022 Dobbs v. Jackson decision, which overturned Roe v. Wade, set off alarms in the privacy world, as readily available location data could be used to prosecute people seeking reproductive healthcare. The decision also spurred Congress to investigate the data-collection practices of the industry.

US law-enforcement agencies have repeatedly purchased this data, effectively bypassing the approval of the courts and the need to obtain search warrants, which traditionally would be required.