FTC goes after three data brokers with enforcement actions

The FTC has accused three data brokers, including Gravy Analytics and Venntel, of illegally tracking and selling non-anonymized consumer location data.

The Federal Trade Commission took action against three data brokers Tuesday, alleging the companies unlawfully tracked and sold sensitive consumer location data, including information that related to people’s visits to health care facilities and places of worship.

The FTC’s complaint accuses Virginia-based Gravy Analytics and its subsidiary Venntel of violating the FTC Act by allegedly obtaining consumer location information from other data suppliers and claiming to collect, process, and curate more than 17 billion signals from around a billion mobile devices daily. The location data the companies sold can be used to identify consumers and is not anonymized, according to the complaint.

Gravy Analytics also reportedly used geofencing technology to identify and sell lists of consumers based on sensitive personal characteristics such as health conditions, political activities, and religious viewpoints. 

Additionally, the FTC accused Georgia-based Mobilewalla of selling sensitive data that could reveal the location of a person’s home, along with using location data to create targeted advertising segments, including a June 2020 report analyzing George Floyd protesters’ racial backgrounds and city of residence.

“Surreptitious surveillance by data brokers undermines our civil liberties and puts servicemembers, union workers, religious minorities, and others at risk,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection.” 

The FTC order also says Mobilewalla, Gravy Analytics and Venntel won’t be allowed to sell or share any sensitive location data unless it’s for national security or law enforcement reasons. They also need to create a program to identify and protect sensitive places, including:

• Hospitals and medical centers
• Places of worship
• Prisons or jails
• Labor union offices
• Schools or childcare centers
• Services that help people based on race or ethnicity
• Shelters for the homeless, abuse victims, refugees, or immigrants
• Military bases

This current enforcement action marks the FTC’s fifth move this year to address the mishandling of location data, underscored by past actions against similar companies like Kochava and X-Mode for similar infractions.

The settlements come amid broader federal efforts, including the Consumer Financial Protection Bureau’s recent proposal to prevent brokers from selling sensitive personal information, such as Social Security numbers.

Gravy Analytics and Mobilewalla have yet to comment on the settlements, but the FTC is opening the agreements to public comment for 30 days before finalization. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure