Data brokers are selling your location by the day, and you can force them to stop

A quiet industry buys and sells the daily movements of ordinary people. Data brokers assemble streams of precise location signals harvested from smartphone apps, package those trails, and sell them to advertisers, marketers, and in some cases government buyers. The trade operates largely out of view, but it is not beyond reach. Federal enforcement has established that selling sensitive location data crosses legal lines, and consumers retain tools to cut off much of the collection that feeds the market.

The scale of the trade is easy to underestimate, because it happens without any direct interaction with the people whose movements are being tracked. A single smartphone can leak its coordinates to dozens of companies over the course of a day, each transfer invisible to the person carrying it, and the resulting profiles can be detailed enough to expose the most private corners of a life. What makes the situation different from most privacy problems is that both regulators and the built-in controls on modern phones now offer real ways to push back.

Where the location signals come from

The raw material of the location economy is the smartphone in a person’s pocket. Countless apps request access to location for a plausible reason, such as weather, navigation, or local search, and many then transmit that coordinate stream to advertising and analytics companies that have nothing to do with the app’s stated purpose. Those companies aggregate the feeds into detailed movement histories that can reveal where a person sleeps, works, worships, and seeks medical care. The businesses that compile and resell this information are documented in reference material on the information broker industry. Because the data is tied to a device identifier rather than a name, brokers have long argued it is anonymous, but researchers have repeatedly shown that a trail of daily locations is so distinctive that it can be matched back to an individual with little effort.

The enforcement action that named the harm

Regulators have moved from describing the problem to punishing it. In January 2024 the Federal Trade Commission announced an order prohibiting the data broker X-Mode Social and its successor company Outlogic from sharing or selling sensitive location data, the agency’s first settlement targeting a broker over precise location information, detailed in its official enforcement announcement. The FTC charged that the company had sold precise location data that could be used to track people’s visits to sensitive places, including medical and reproductive health clinics, places of worship, and domestic abuse shelters. The order established a principle: location data that can expose a person’s presence at a sensitive site is not an ordinary commodity, and brokers cannot trade it freely.

A pattern of cases, not an isolated one

The X-Mode action was one of several. The commission pursued the data broker Kochava over the collection and sale of precise location data drawn from hundreds of millions of mobile devices, litigation that produced a proposed settlement barring the company from selling sensitive location data absent affirmative consent. The agency also reached a settlement with the marketing firm InMarket over its handling of location information. Taken together, the cases signal that regulators regard the unchecked monetization of movement data as a practice they intend to constrain rather than tolerate. The through-line in each is consent: the enforcement did not ban location services outright but insisted that people be told, and be given a real choice, before their whereabouts are collected and sold.

The controls built into the phone

Consumers can shut off much of the collection at the source. Both major mobile operating systems allow location permission to be revoked entirely or narrowed to only while an app is in use, and both let a user substitute an approximate location for a precise one, which is sufficient for most weather and search functions while denying brokers the exact coordinates they prize. The systems also assign a resettable advertising identifier that ties an individual’s behavior together across apps, and both platforms allow that identifier to be reset or disabled, which fragments the profile brokers try to build. The Federal Trade Commission publishes plain-language guidance on managing these settings and on protecting personal information through its consumer advice site. Turning off location for apps that do not genuinely need it, and refusing background access, removes a large share of a device’s contribution to the market.

Opting out at the broker level

Device settings stop new collection, but they do not erase data already gathered, which is why the broker-level opt-out matters. Many data brokers maintain opt-out request pages as a matter of policy or legal obligation, and a person can demand deletion and suppression of their records directly. Residents of states with comprehensive privacy laws have a stronger hand, because those statutes grant enforceable rights to access, delete, and opt out of the sale of personal information, and some require brokers to honor a universal opt-out signal sent automatically by a browser. Several states also operate registries that require data brokers to formally register, giving consumers a directory of the companies to contact. The process is tedious because the brokers are numerous, but each honored request removes an individual from another dataset.

A market that can be narrowed

The location-data trade thrives on inattention. It depends on apps quietly requesting more access than they need, on identifiers that stitch scattered signals into a coherent portrait, and on the assumption that no one will object. Enforcement has proven that the practice is not untouchable, and the tools available to consumers, from tightening a single permission to filing broker opt-outs, meaningfully shrink the supply of data the market runs on. The trade will not vanish because one household adjusts its settings. But the notion that a person’s daily movements are simply for sale, with no recourse, is not accurate. The collection can be limited, the sale can be refused, and regulators have made clear that the most sensitive of these trails are off-limits.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview