The Data Broker That Could Track Your Trip to a Reproductive Health Clinic

Data broker X-Mode Social and its successor firm Outlogic will be prohibited from sharing or selling any sensitive location data, settling Federal Trade Commission allegations that the company sold precise location information capable of tracking people's visits to medical and reproductive health clinics, places of religious worship, and domestic abuse shelters.DOCUMENTED

The case marks the FTC's first settlement with a data broker specifically concerning the collection and sale of sensitive location information.DOCUMENTED

How the data was collected and sold

X-Mode/Outlogic, based in Virginia, collects and sells precise location data gathered from third-party apps that incorporate its software development kit, from its own mobile apps, and by purchasing location data from other data brokers and aggregators.DOCUMENTED The company sells and licenses this data to hundreds of clients across industries ranging from real estate to finance, as well as to private government contractors, according to the FTC.DOCUMENTED

The raw location data X-Mode/Outlogic sold was associated with mobile advertising IDs — unique identifiers tied to each mobile device — and was not anonymized, meaning it was capable of matching an individual consumer's device to the specific locations that person visited.DOCUMENTED Some companies, the FTC noted, specifically offer services designed to match this kind of raw data back to individual consumers.DOCUMENTED

No safeguards against sensitive locations

According to the complaint, X-Mode/Outlogic failed, until May 2023, to implement any process for removing sensitive locations — such as reproductive health clinics, places of worship, and domestic violence shelters — from the raw location data it sold to clients.DOCUMENTED The company also did not implement reasonable or appropriate safeguards against downstream use of the precise location data it sold, according to the FTC, putting consumers' sensitive personal information at risk of being used in ways they never anticipated or consented to.DOCUMENTED

In one specific gap identified by the FTC, X-Mode/Outlogic had no technology in place to ensure it honored requests from Android users who had opted out of ad tracking, meaning consumers who took available steps to limit tracking on their own devices may still have had their location data collected and sold regardless.REVIEWED

What the final order requires

The order permanently prohibits X-Mode/Outlogic from sharing or selling any sensitive location data.DOCUMENTED It also requires the company to create a comprehensive privacy program, including maintaining a list of sensitive locations to ensure the company is not transmitting related data, and to delete all location data and any data products developed from information it previously collected without consumer consent.DOCUMENTED

The company's raw location data was tied to unique device identifiers and was never anonymized — meaning, according to the FTC, it could be matched back to an individual's actual movements.

Why privacy advocates called it a milestone — and a warning

"This is both a milestone settlement and the tip of the iceberg," said John Davisson, director of litigation at the Electronic Privacy Information Center, following the announcement. He noted the FTC's order imposes real consequences on X-Mode specifically, but that X-Mode/Outlogic is only one of thousands of companies that traffic in similar location data, underscoring the need for broader rules across the data-broker industry rather than case-by-case enforcement alone.REVIEWED

Why this case set a template for later actions

The FTC's approach in the X-Mode/Outlogic matter — banning the sale of a defined category of "sensitive location" data, rather than banning location-data sales altogether — reflects the agency's effort to draw a legally defensible line between ordinary commercial location tracking, which remains widespread across the advertising industry, and tracking that reveals a person's health care decisions, religious practice, or status as a domestic violence survivor.REVIEWED That distinction has since served as a reference point for subsequent FTC actions against other location and data-broker companies, making the X-Mode/Outlogic settlement a foundational case in how the agency defines "sensitive" location information going forward.REVIEWED

What the case reveals about the broader data-broker market

X-Mode/Outlogic's business model — embedding a software development kit into third-party apps to passively collect location data, then reselling that data to hundreds of downstream clients — is common across the location-data industry, meaning a single consumer's location history can pass through several intermediary companies before reaching its final commercial destination, often without the consumer ever directly interacting with X-Mode or Outlogic at all.REVIEWED That layered structure is part of why enforcement in this space has proven difficult: consumers frequently have no visibility into which apps on their phone are collecting location data, let alone which downstream brokers eventually receive and resell it.REVIEWED The FTC's order requiring X-Mode/Outlogic to delete previously collected data, rather than simply stop future sales, is aimed at addressing that visibility gap by removing the historical data from circulation entirely.REVIEWED

For consumers concerned about location tracking, the case is a reminder that opting out of ad tracking at the device level does not automatically guarantee that every app or data broker in the chain will honor that choice — the FTC's complaint specifically alleged X-Mode/Outlogic lacked the technical means to verify and respect such opt-outs consistently. Reviewing which apps have location permissions enabled, and disabling background location access for apps that don't need it to function, remains one of the few controls consumers can exercise directly, independent of how any individual data broker chooses to handle opt-out requests.REVIEWED

The settlement also required X-Mode/Outlogic to obtain a consumer's affirmative express consent before collecting or using their precise location data going forward, a higher bar than the industry-standard practice of relying on buried disclosures inside lengthy app privacy policies that few users ever read in full.REVIEWED

Have documents relevant to this story? Reach us through our tips channel.