The Federal Trade Commission announced two separate settlements with data brokers accused of unlawfully collecting and selling sensitive consumer location data: one with Gravy Analytics and its subsidiary Venntel, the other with Mobilewalla.DOCUMENTED Both companies collect precise consumer location data from other data suppliers, package it, and sell it to private and public sector clients — a business model the FTC alleges crossed into unfair practices once the locations being tracked included medical facilities, religious institutions, and other sensitive sites.
Mobilewalla went a step further, according to the agency's complaint: it used the location data not just to track movement but to build targetable audience segments based on where people had been, including one reported segment built around visitors to pregnancy centers.DOCUMENTED
- Gravy Analytics and its subsidiary Venntel collect precise consumer location data from other data suppliers.
- The FTC alleges Gravy Analytics bought location data from suppliers who provided vague or no confirmation that consumers had given informed consent to its collection.
- Gravy Analytics used the location data to sell products targeting consumers based on sensitive characteristics, including religious attendance and political affiliation.
- Mobilewalla similarly collected precise consumer location data, including data retained from failed real-time-bidding ad auctions.
- Mobilewalla reportedly built and sold an audience segment identifying visitors to pregnancy centers.
- Both settlements prohibit the companies from selling, disclosing, or using sensitive location data outside narrow exceptions for national security or law enforcement.
What the complaints allege
According to the FTC's complaint against Gravy Analytics, the company bought location data from suppliers that provided vague or nonexistent confirmation that consumers had given informed consent to the underlying collection, while its subsidiary Venntel relied entirely on Gravy Analytics to confirm that consent had been obtained — meaning neither company independently verified the consent chain for the data they were selling.DOCUMENTED Gravy Analytics used that location data to sell products targeting consumers based on sensitive characteristics and behaviors, including political affiliation, attendance at places of religious worship, family composition, and medical conditions, according to the complaint.DOCUMENTED
Mobilewalla's alleged conduct includes a practice the FTC specifically flagged as improper under the terms of the real-time-bidding exchanges it operated within: the company allegedly collected and retained location information from failed real-time-bidding auctions — data associated with ad impressions that were never actually won — a practice the complaint alleges is prohibited under the terms those exchanges set for participants.DOCUMENTED That raw, unanonymized location information was then sold to Mobilewalla's own clients, according to the agency.DOCUMENTED
How real-time bidding creates a data collection loophole
Real-time bidding, the automated auction system underlying much of online display advertising, requires ad exchanges to share certain data about a potential ad viewer with bidders so they can decide whether and how much to bid for that impression — data that is supposed to be discarded by bidders who do not win the auction.REVIEWED The FTC's allegation that Mobilewalla retained data from bids it did not win describes exactly the kind of loophole that turns an advertising technology system, designed to facilitate a single transaction, into an ongoing surveillance data pipeline extending well beyond what any advertiser or consumer would reasonably expect from participating in an ad auction.
Terms of the settlements
Under the proposed order, Gravy Analytics and Venntel are prohibited from selling, disclosing, or using sensitive location data in any product, except in limited circumstances involving national security or law enforcement.DOCUMENTED The order requires the companies to establish a sensitive-location program that develops and maintains a list of sensitive locations — medical and religious facilities, schools, and military installations among them — to ensure associated location data is not licensed, shared, or sold going forward.DOCUMENTED Mobilewalla's settlement imposes comparable restrictions tailored to its specific data practices.REVIEWED
One of the two data brokers allegedly built and sold a marketing list of people identified through their visits to pregnancy centers.
Why the case matters
These two settlements, reached together, reflect a consistent FTC position across the location data broker industry: consent obtained by an upstream data supplier does not automatically transfer down a chain of buyers and resellers unless it is meaningfully verified at each step, and precise location data tied to medical, religious, or politically sensitive locations warrants heightened protection regardless of how many intermediaries separate the original data collector from the eventual commercial buyer.
Why the ad-tech supply chain makes accountability difficult
A single consumer's location data point can pass through several intermediaries before reaching a final commercial buyer — an app developer, an advertising SDK embedded in that app, an ad exchange, and a data aggregator like Gravy Analytics or Mobilewalla — with consent disclosures, if made at all, often occurring only at the very first link in that chain.REVIEWED That structure is precisely why the FTC's settlements in both cases focus on requiring the downstream data brokers to independently verify consent rather than relying on assurances from upstream suppliers, since a broken link anywhere in a long supply chain can otherwise leave a consumer's sensitive location history changing hands with no meaningful consent behind it at all. For consumers, the cases are a reminder that the location-sharing permission granted to one app can end up, through data broker supply chains most consumers never see, generating targeted marketing lists built around the most private moments of a person's daily movement.
Why two separate settlements arrived together
Announcing the Gravy Analytics and Mobilewalla resolutions on the same day, rather than pursuing each company's case independently on its own separate timeline, allowed the FTC to present a unified statement about the entire location-data-broker business model rather than framing either settlement as an isolated incident involving one company's specific practices.REVIEWED That coordinated timing reflects a broader FTC strategy visible across other paired or sequenced enforcement actions: when multiple companies in the same specific industry segment engage in substantially similar conduct, resolving those cases together sends a clearer signal to the rest of the industry than a single, isolated settlement would.
Sources behind this report
Have documents relevant to this story? Reach us through our tips channel.