FTC bans two data brokers from collecting and selling Americans’ sensitive location data

Two U.S. data brokers have agreed not to collect private location data on Americans as part of a pair of settlements with the U.S. Federal Trade Commission, which accused the companies of unlawfully tracking millions of people near to sensitive locations like healthcare facilities and military bases.

The two settlements, announced Tuesday, will prohibit Virginia-based Gravy Analytics and Georgia-based Mobilewalla from collecting and retaining people’s sensitive granular location data. This agreement was reached after the FTC accused the two data brokers — companies that profit from collecting huge amounts of people’s personal information and selling it to others — of selling millions of identifiable location data points, including where people visited clinics and places of worship.

The FTC alleges that Gravy Analytics, along with its subsidiary Venntel, collected and used consumers’ location data for commercial and government uses without obtaining consent from the individuals. The organization allegedly continued to use this data even after learning that consumers hadn’t provided informed consent for their data to be sold.

Gravy Analytics also unfairly sold sensitive information about individuals, such as health or medical decisions, political activities and religious viewpoints, that had been derived and determined based on a person’s location data, according to the FTC’s complaint.

Mobilewalla is also accused of selling sensitive location data, including data that could reveal the identity of an individual’s private home, the U.S. federal regulator said.

The FTC alleges that Mobilewalla obtained much of this data from real-time bidding exchanges and third-party aggregators, which meant consumers did not know that the organization had obtained their personal information. This data was not anonymized, according to the complaint, and Mobilewalla is accused of having no policies in place to remove sensitive locations from the data before it sold the information to third parties.

The FTC says that Mobilewalla also used sensitive location data to develop audience segments to target consumers for advertising. For example, the company created a June 2020 report analyzing people who protested the death of George Floyd and determined the protesters’ racial backgrounds and whether they lived in the cities in which they protested, according to the FTC.

Under the two settlements announced on Monday, Gravy Analytics and Mobilewalla will no longer collect sensitive location data on consumers, and must delete the historic data they have collected on millions of Americans.

Both organizations will also have to maintain a sensitive location data program, whereby they must develop a list of sensitive locations and prevent the use, sale, license, transfer, sharing, or disclosure of consumers’ visits to those locations. These locations include medical facilities, religious organizations, schools, and correctional facilities.

Gravy Analytics and Mobilewalla did not immediately respond to TechCrunch’s questions.

This is the latest action taken by the U.S. government as the Biden administration draws to a close. On Monday, the Consumer Financial Protection Bureau proposed a new rule that would block data brokers from selling personal and financial information on Americans, including their Social Security numbers and phone numbers.