Evidence status: Documented FTC enforcement action; distinguish the agency’s allegations from adjudicated findings.
A phone tucked into a pocket can become a remarkably detailed diary: the office, the clinic, the place of worship, the late-night drive home. The unsettling part is not that location technology exists. It is that companies can assemble traces into information products about people who never knowingly agreed to such scrutiny.
Follow the paper trail
In January 2025, the Federal Trade Commission finalized an order involving Gravy Analytics and subsidiary Venntel. The regulator alleged that the companies collected and sold sensitive location information without adequate consent, including insights connected to visits to healthcare facilities and places of worship.
The case docket contains the complaint and consent-order documents. The final order restricts the sale, disclosure and use of sensitive location information, subject to specified exceptions, and requires a sensitive location-data program.
Why this matters beyond one case
The familiar promise of “anonymous location data” can be misleading when repeated visits disclose a home, workplace or deeply personal destination. The central investigative question is often not who owns the phone, but who can connect its travel pattern to a particular person. Data aggregation can produce inferences that the individual never entered into a form.
Consent orders are not a basis for inventing additional misconduct or asserting criminal convictions. The public record is powerful without exaggeration: a federal regulator documented serious allegations and imposed restrictions on a real data market.
The question the public should ask
When you allow an app to use your location, you may think you are helping it provide directions or a nearby recommendation. Are you also consenting to a chain of downstream buyers whose names you have never heard?
Sources: FTC announcement; FTC docket.
