From our base in New York, we represent a diverse range of clients across the country and around the world.

Insights + Events
bookmarkprintPDFShare>

Alert, Maintaining Your Competitive Advantage with Proactive Privacy and Data Protection Strategies -

Where’s Waldo and What’s He Up To? The FTC Cracks Down on Use of Sensitive Location Data

The Bottom Line

  • The FTC is aggressive regarding how sensitive data is handled.
  • In a very unique twist, the FTC is prohibiting the collection of data from losing bids in RTB exchanges.
  • Even in the absence of a new federal privacy law, the FTC continues to be an active privacy regulator.

Last week, the Federal Trade Commission (FTC) issued orders against Mobilewalla, Inc. and Gravy Analytics Inc., as well as Gravy Analytics’ subsidiary, Venntel Inc., in connection with the collection, tracking and/or sale of sensitive location data.

The Complaint

The FTC alleged that Mobilewalla collects, aggregates and indefinitely retains large volumes of consumer information from real-time bidding exchanges (RTB exchanges) and other data brokers and aggregators, including information that could reveal sensitive details about consumers. The FTC further alleged that Mobilewalla, although prohibited by the terms of the RTB exchanges, collected and retained information including precise latitude and longitude coordinates of the consumer’s device, combined with a time stamp and the device’s unique advertising identifier, from a bid request. This practice purportedly occurred even if Mobilewalla did not win the bid and used that information for non-advertising purposes. Mobilewalla also allegedly collects information, including mobile advertising identifiers (MAID) paired with precise geolocation information, from data brokers and data aggregators without obtaining informed consent from consumers or ensuring that their suppliers obtain consent on their behalf.

In addition to collecting data, the FTC alleged that Mobilewalla licenses non-anonymized raw location data to third parties. Since Mobilewalla allegedly does not remove or anonymize sensitive locations from the raw location data sets that they sell, the data can be used to identify or infer sensitive locations that consumers have visited, including medical facilities, places of religious worship and domestic abuse shelters. It is further alleged that Mobilewalla uses the data to create and license “audience segments” based on interests or characteristics of the consumer which appear to be revealed by the locations and events they visit. As part of this practice, Mobilewalla has allegedly helped its clients target pregnant women, Hispanic churchgoers and members of the LGBTQIA+ community.

Similarly, the FTC alleged that Gravy Analytics and Venntel amass and sell raw location data that tracks consumers’ movements and can subsequently be used to glean insights into consumers’ lives as well as certain sensitive and personal attributes. As part of their offerings, Gravy Analytics and Venntel sell tools that can give their customers access to additional information about consumers. This includes a tool that allows a marketer to geo-fence a location and obtain a list of MAIDs that were present at that location during a given time and enables customers to “continuously” track a single device and obtain search location signals associated with specific IP addresses. The FTC alleged that the data collected, used, and sold by Gravy Analytics and Venntel is not anonymized and that neither Gravy Analytics nor Venntel take reasonable steps to confirm that consumers have consented to the collection, use or sale of their data. According to the FTC’s complaint, in some instances, Gravy Analytics and Venntel have continued to use consumers’ location data even after learning that such consumers have not provided informed consent (as is now required under many state comprehensive consumer privacy laws).

FTC Response

The FTC deemed the above activities to constitute an unfair trade practice, alleging in part that the collection and sale of consumer data, particularly data based on sensitive characteristics, “causes or is likely to cause substantial injury in the form of stigma, discrimination, physical violence, emotional distress, and other harms,” and is not outweighed by a countervailing benefit to consumers or competition.

Unsurprisingly, given the similarities in the alleged unfair practices of Mobilewalla, Gravy Analytics and Venntel, the FTC’s respective settlement orders have comparable requirements. In part, the FTC orders require the following:

  • Under both orders, the parties are prohibited from misrepresenting the extent to which they collect, use, maintain, disclose, or delete certain covered information and the extent to which location data they collect, use, maintain or disclose is de-identified. Gravy Analytics and Venntel are also prohibited from misrepresenting the extent to which they review suppliers’ compliance and consent frameworks, consumer disclosures, sample notices and opt-in controls.
  • Mobilewalla may not collect, purchase, acquire or retain certain covered information while participating in online advertising auctions for purposes other than a genuine intent to purchase advertising inventory through such auctions. This marks the first time that the FTC has targeted the practice of collecting consumer data from online advertising auctions for non-advertising purposes.  
  • Subject to a few exceptions, Mobilewalla, Gravy Analytics and Venntel are each prohibited from selling, licensing, transferring, sharing, disclosing, or using sensitive location data in products or services that identify sensitive locations.
  • Mobilewalla, Gravy Analytics and Venntel must all create and maintain a sensitive location data program to prevent the use, sale, licensing, transfer, sharing or disclosure of sensitive location data. The FTC set forth minimum requirements for this program.
  • Mobilewalla, Gravy Analytics and Venntel are prohibited from selling, licensing, or disclosing location data that may determine the identity or the location of an individual’s private residence. Gravy Analytics and Venntel are also required to establish and implement policies and measures to prevent location data from being used to associate the consumer with locations predominantly providing services to the LGBTQIA+ community and locations of public gatherings during political or social demonstrations, marches, and protests.
  • If Gravy Analytics and Venntel learn that a third party has shared sensitive location data in violation of a contractual requirement between themselves and the third party, Gravy Analytics and Venntel are required to submit a report to the FTC within 30 days. Additionally, Gravy Analytics and Venntel must not collect, use, maintain, or disclose location data from devices if a consumer has enabled mobile operating system privacy settings to opt out of, limit, or otherwise decline targeted advertising or tracking without consent.
  • Each of Mobilewalla, Gravy Analytics and Venntel must implement a program to ensure that consumers have provided consent for the collection and use of data that may reveal a precise location, including by implementing a supplier assessment program.
  • Except for certain instances in the case of Gravy Analytics and Venntel only, consumers must be provided with clear and conspicuous means to request the identity of any entity, business, or individual that the company knows a consumer’s location data was sold, transferred, licensed or disclosed to.
  • Consumers must be provided a means to withdraw consent for the use, disclosure or deletion of location data. Mobilewalla must also ensure that a consumer’s ability to withhold or withdraw consent is not unreasonably limited.
  • Each company must document, adhere to, and make a publicly available link to their data retention schedule, and provide a written statement to the FTC describing their retention schedule. Such documentation must be updated as and when new types of covered information are collected.
  • Mobilewalla, Gravy Analytics, and Venntel are required to delete or destroy historic location data and consumer phone numbers (hashed and unhashed) and delete or destroy all data products.
  • Each company must establish, implement and maintain a comprehensive privacy program.

Many of the requirements above go beyond the requirements in the comprehensive consumer privacy laws enacted by 19 states. Viewed alongside the FTC’s recent settlements with Kochava, InMarket and X-Mode, the enforcement action against Gravy Analytics marks the FTC’s fourth action this year challenging the sale of sensitive location data and the fifth action challenging the unfair handling of consumers’ sensitive location data by data aggregators. With the anticipated change in leadership at the FTC in 2025, it remains to be seen what enforcement priorities will be going forward. Regardless, companies would be advised to start reviewing their location data collection practices now.