FTC forces data broker Mobilewalla to delete years of GPS tracking data

Mobilewalla collected GPS location data not by asking consumers for permission directly but by buying it from the mobile advertising ecosystem — the network of apps, ad exchanges, and data intermediaries that track users' locations to serve targeted advertising. Consumers who gave a weather app or a game permission to access their location often had no idea that location data was being sold through multiple intermediaries and ultimately assembled into a profile by companies like Mobilewalla.

The FTC's complaint specifically called out Mobilewalla's sale of location data drawn from sensitive sites: reproductive health clinics, places of worship, and domestic violence shelters. In the post-Dobbs environment — after the Supreme Court overturned Roe v. Wade in 2022 and several states criminalized abortion — the sale of location data from reproductive health facilities carried direct implications for users' legal exposure. Law enforcement in abortion-restricted states could theoretically subpoena such records.

The order permanently bans Mobilewalla from selling location data tied to sensitive locations. It also prohibits the company from collecting or using location data from non-consenting consumers for any commercial purpose. The deletion requirement — covering all historical location records — is among the most stringent remedies the FTC had imposed on a data broker up to that point.

Mobilewalla is one of dozens of data brokers operating in the location data industry. The FTC had taken similar actions against Outlogic (formerly X-Mode Social) in January 2024 and InMarket Media in March 2024. Each case targeted a different segment of the same ecosystem: companies that aggregate mobile location data from advertising networks and resell it to commercial clients, including insurers, retailers, hedge funds, and, in some cases, government agencies.

The FTC's authority to regulate data brokers comes primarily from Section 5 of the FTC Act, which prohibits 'unfair or deceptive acts or practices in or affecting commerce.' The agency has argued that collecting sensitive location data without meaningful consumer consent and selling it to undisclosed third parties meets the 'unfair' standard. Data brokers have contested this interpretation, arguing that consumers consented through app permission grants and privacy policies.

Congress has not passed comprehensive federal privacy legislation. The American Privacy Rights Act — which would have created a national standard for data collection, use, and deletion — passed the House Energy and Commerce Committee in 2024 but stalled on the House floor. Without a federal privacy law, the FTC must rely on its Section 5 authority and consent orders to regulate individual companies, creating a patchwork system that leaves millions of consumer records unprotected.

The Mobilewalla order matters beyond the company itself because it signals what the FTC considers a 'sensitive location' — a category that extends to any place where a user's presence could indicate their health decisions, religious practice, domestic safety situation, or other protected activity. The expansion of that category, through successive FTC orders, is effectively setting de facto privacy standards for the location data industry in the absence of congressional action.