Your Phone's Location Data Can Expose Sensitive Visits, FTC Actions Highlight
Data brokers may collect and sell location information revealing visits to doctors, pharmacies, and places of worship, prompting regulatory action and security concerns.
The smartphone in your pocket can log your movements, potentially revealing sensitive details about your life, such as visits to doctors, pharmacies, and places of worship. This location data can be collected and shared by apps, often through third-party software, and subsequently enter the digital advertising ecosystem.
The Federal Trade Commission (FTC) has taken action against companies for allegedly selling such sensitive location data. In May 2026, the FTC announced a settlement with the data broker Kochava and its subsidiary, barring them from selling or sharing sensitive location data without explicit consent. The FTC had alleged that Kochava sold location data from hundreds of millions of mobile devices that could track users to healthcare facilities, places of worship, and other sensitive locations. Kochava did not admit wrongdoing.
This action followed similar steps taken in December 2024, when the FTC targeted data companies Gravy Analytics and Mobilewalla over allegations of selling sensitive location data. In January 2025, Gravy Analytics reportedly experienced a data breach, with a hacker posting what they claimed was 17 terabytes of stolen data, including millions of location points from devices near sensitive locations like the White House and military bases.
Advertising identifiers, such as Apple's IDFA and Google's advertising ID on Android devices, can be used in conjunction with location data to build a detailed profile of a device's movements. Even without precise location permissions, apps might estimate a general area through internet connection information. This data can reveal patterns, such as when a home might be empty or how often someone visits a particular clinic, potentially creating safety concerns or enhancing the effectiveness of scams.
Users can take steps to limit the sharing of this data. On iPhones, this includes disabling "Allow Apps to Request to Track" in Privacy & Security settings and turning off "Personalized Ads" in Apple Advertising settings. For Samsung Galaxy and Google Pixel devices, users can delete their advertising ID through the "Ads" settings within Privacy or Security and privacy menus.
Reviewing and tightening app location permissions is also crucial. Users can set apps to "Never," "Ask Next Time," "While Using the App," or "When I Share" access. Turning off "Precise Location" for apps that do not require exact whereabouts, such as weather or shopping apps, can further reduce data collection. It is also recommended to delete unused apps, as they may retain forgotten permissions.
Beyond app settings, information collected by data brokers and people-search websites can further identify individuals. Personal data removal services can help in requesting the removal of this information from such sites. These steps aim to reduce the amount of information available that could build a detailed trail of an individual's movements and personal life.