The Ad Auctions It Lost Still Handed Over Your Location Data, Regulators Say

Mobilewalla collects precise consumer location data from data suppliers and, notably, from the automated advertising auctions known as real-time bidding — including, according to the Federal Trade Commission, from auctions the company did not actually win.DOCUMENTED That retained data, the agency alleges, was then packaged into audience segments built around where people had physically been, including one reported segment identifying visitors to pregnancy centers.DOCUMENTED

The FTC announced a settlement with Mobilewalla resolving allegations that the company's location data practices were unlawful, part of a broader wave of location-data-broker enforcement the agency brought against several companies in close succession.DOCUMENTED

What the complaint alleges

According to the FTC, Mobilewalla's location data practices extended beyond simply purchasing data from suppliers who claimed to have obtained consumer consent. The company also participated in real-time-bidding advertising auctions, and the complaint alleges it retained location information tied to bid requests even when Mobilewalla did not win the auction for that particular ad impression.DOCUMENTED That retained information was not anonymized, according to the agency, and was subsequently sold to Mobilewalla's own commercial clients.DOCUMENTED

The complaint's specific allegation regarding a marketing segment built around visits to pregnancy centers is among the most pointed examples cited across the FTC's recent location-data-broker enforcement wave. Identifying and packaging visits to a category of facility this sensitive for resale to advertising clients treats an intensely private medical circumstance as an ordinary demographic marketing variable, with no indication in the complaint that the individuals involved were ever informed their location history was being used this way.REVIEWED

How real-time bidding is supposed to work

In a real-time-bidding auction, an ad exchange shares certain information about a potential ad viewer with multiple prospective bidders simultaneously, so each can decide in a fraction of a second whether and how much to bid for the opportunity to show that viewer an ad.REVIEWED Bidders who lose the auction are generally expected, under the terms most exchanges set for participants, to discard the bid request data rather than retain and repurpose it, since the data was shared only to facilitate that specific auction, not as a general grant of access to the underlying consumer's information.

Why retaining failed-bid data is a distinct kind of violation

The FTC's allegation that Mobilewalla kept data from auctions it lost describes a subtler kind of data misappropriation than a broker simply buying consumer information from a willing seller who lacks proper consent — here, the data reached the company at all only because of a temporary, auction-specific data-sharing arrangement that Mobilewalla is alleged to have exploited well beyond its intended, narrow purpose.REVIEWED That distinction matters because it means a consumer's location data can end up circulating through Mobilewalla's systems even in scenarios where no advertiser ever actually reached that consumer with an ad — the mere act of bidding, whether or not the bid succeeded, was enough to generate a retained, sellable data record.

Terms of the settlement

Under the proposed order, Mobilewalla is prohibited from selling, disclosing, or using sensitive location data in its products, with narrow exceptions limited to national security and law enforcement purposes.DOCUMENTED The order requires the company to establish protocols for identifying and excluding sensitive locations — medical facilities, religious institutions, schools, and similar categories — from the data it licenses, shares, or sells going forward, mirroring restrictions the agency imposed in parallel settlements with other location data brokers around the same time.REVIEWED

According to the complaint, Mobilewalla retained and resold location data from ad auctions it never actually won — data an advertiser never even used to reach the consumer involved.

Why the case matters

For consumers, the Mobilewalla case illustrates how far removed the eventual commercial use of location data can be from anything resembling a knowing exchange: a consumer's location was captured and monetized here not through a deliberate transaction with an app the consumer chose to use, but as a byproduct of an invisible, automated advertising auction that the consumer never participated in directly and that, in the specific instances the complaint describes, did not even result in an ad being shown. That gap between how casually the data was captured and how sensitively it was later used — down to a marketing list built around pregnancy center visits — is precisely the kind of harm the FTC's broader location-data enforcement push has been built to address.

Why pregnancy-related location data draws particular concern

Location data tied to visits to reproductive health facilities has drawn heightened attention from privacy advocates and regulators alike in recent years, in part because that information can reveal a medical circumstance a person may not have disclosed even to close family members, and in part because the political and legal landscape surrounding reproductive health varies considerably by state, raising the stakes of that information falling into the wrong hands.REVIEWED A marketing segment built around this category of visit treats a uniquely sensitive medical and personal circumstance as an ordinary targeting variable, with none of the special handling that most other privacy frameworks would apply to comparably sensitive health information.

What this settlement adds to the broader enforcement record

Mobilewalla's settlement arrived alongside a companion case against Gravy Analytics and its subsidiary Venntel, resolved on the same day and addressing substantially similar underlying conduct within the location data broker industry.REVIEWED Announcing the two settlements together allowed the FTC to draw a clearer line across the industry as a whole: regardless of whether a given broker collects data primarily through app SDKs, purchased supplier feeds, or ad-auction bid requests, the agency has signaled it will treat unconsented sensitive location data — wherever in the pipeline it originates — as subject to the same baseline restrictions.

Have documents relevant to this story? Reach us through our tips channel.