The Location Data Broker Industry

A location data broker may collect, aggregate, license, or sell information about where a person or device is or has been, including signals supplied through mobile apps or other data sources. Depending on precision, identifiers, consent, and use, location data can reveal or help infer visits to health, religious, reproductive-health, military, or other sensitive places; not every record has those properties. Examples discussed in the selected FTC cases include X-Mode/Outlogic, Mobilewalla, InMarket, and Gravy Analytics/Venntel.

One documented route is an SDK (software development kit) embedded in a mobile app. If the app and its SDK receive location access or another permitted signal, data may be sent to the SDK provider or another recipient under the relevant app and privacy disclosures. The exact source, precision, retention, and sharing path vary by app, device, provider, and jurisdiction.

Legality depends on the data, source, consent, purpose, provider, and jurisdiction. The selected FTC cases on this page involved allegations and orders addressing particular practices involving precise or sensitive location data; they are not a complete enforcement census. Washington’s My Health My Data Act includes consumer-health-data disclosure and consent requirements, sale-authorization rules, and geofence restrictions around health-care facilities. California’s CCPA gives covered residents rights that can include opting out of sale or sharing and limiting certain uses of sensitive personal information. Under the GDPR, precise location is not automatically an Article 9 special category by itself, but Article 9 may apply when processing reveals or concerns a listed category such as health or religious data. This page is general information, not legal advice.

Three layers. (1) iOS/Android: revoke location permissions for apps that don’t need them; use "only while using the app" everywhere; enable "Ask next time" regularly. (2) Advertising identifier: reset and limit ad tracking (iOS: Settings > Privacy > Tracking; Android: Settings > Privacy > Ads). (3) Direct opt-out: send deletion requests to each broker. OfflistMe covers major location brokers in the $9 run.

Usually not by themselves. Incognito mode mainly changes local browser-history behavior, and a VPN can change the apparent network address without changing app permissions or every device-level location signal. Revoking unnecessary location access, reviewing advertising-identifier settings, and using provider-specific privacy requests can reduce particular collection or retention paths, but no single step guarantees that all copies or inferences have been removed.

A private claim depends on the facts, the data involved, the defendant, and the law that applies. Illinois BIPA provides a private right of action for a person aggrieved by a BIPA violation, with statutory damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation, subject to the statute and case law; location data alone is not automatically biometric data. Washington’s My Health My Data Act makes violations subject to the state Consumer Protection Act, but whether a particular person has a viable claim requires a fact-specific legal analysis. Other issues may be pursued through a state attorney general, regulator, or the FTC. This is not legal advice.