On December 3, 2024, the U.S. Federal Trade Commission (FTC) issued two proposed orders prohibiting three data brokers – Gravy Analytics, Inc., its wholly-owned subsidiary, Venntel, Inc., and Mobilewalla – from obtaining and selling consumers’ sensitive location data, including visits to military bases, medical facilities, and places of worship (Gravy/Venntel), and a consumer’s private home (Mobilewalla), without consent or adequately verifying that consent was granted. The proposed orders were published in the Federal Register on December 6, 2024; the public comment period is open for 30 days.
According to the FTC’s complaint against Gravy Analytics and Venntel, the companies allegedly sold consumers’ precise geolocation information, which was not anonymized and was transferred to their customers at regular intervals (i.e. on a daily or weekly basis). Customers were also allegedly offered the opportunity to search and receive at least three years’ worth of historical data. The complaint further alleges that Gravy Analytics continued to use the location data after learning that consumers did not provide informed consent and that it sold information derived from the location data revealing consumers’ sensitive characteristics, e.g., pertaining to the consumer’s health, and religious or political activities.
Per the FTC complaint against Mobilewalla, the company is accused of selling consumers’ personal information, including location data, that it collected indirectly from multiple sources such as third-party aggregators and real-time bidding exchanges (“RTB exchanges”) without ensuring that the suppliers had obtained consumers’ consent. Mobilewalla allegedly sold access to raw location data that was not anonymized to their clients for advertising and other purposes. Further, Mobilewalla did not contractually require its suppliers to obtain consumers consent, and, per the complaint, consumers often had no knowledge that Mobilewalla had their data. According to the FTC, approximately 60 percent of Mobilewalla’s consumer data came from RTB exchanges that the company collected while it was placing bids to advertise for its clients. This information was alleged retained indefinitely despite the RTB exchanges disallowed the practice. In its proposed order, the FTC specifically banned Mobilewalla from collecting consumer data from online advertising auctions and using it for non-advertising purposes. This is the first time that the FTC has considered such a practice to be an unfair act in violation of Section 5(a) of the FTC Act.
In the proposed orders, the FTC banned all three data brokers from selling, licensing, transferring, sharing, disclosing, or using sensitive location data except in rare instances involving national security or law enforcement. Each data broker must delete, de-identify, or otherwise render the data non-sensitive (or obtain consent from the consumer), and require its customers that received historic data within the last three years to do the same. The data brokers may not make misrepresentations about their data collection practices, and each is required to establish a number of new processes and procedures, including the implementation of a supplier assessment program to ensure that consumers consent to the collection and use of their mobile device and location data, and the establishment of a sensitive location data program.
FTC Press Release – Gravy Analytics and Venntel | FTC Case Page – Gravy Analytics | Federal Register | FTC Press Release – Mobilewalla | FTC Case Page – Mobilewalla | Federal Register