The Federal Trade Commission (FTC) has initiated action against Gravy Analytics Inc. and its subsidiary Venntel Inc. for allegedly selling sensitive location data without user consent. The FTC claims the companies tracked and sold data about consumer visits to health-related locations and places of worship, violating privacy laws.
Under a proposed settlement, Gravy Analytics and Venntel are barred from selling or using sensitive location data in their products or services. They must also establish a program to manage such data responsibly.
The FTC's complaint accuses the companies of violating the FTC Act by unfairly collecting and selling consumer location data without obtaining verifiable user consent for commercial and government purposes. It further alleges that Gravy Analytics continued using location data even after realizing consumers had not provided informed consent.
Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, stated, "Surreptitious surveillance by data brokers undermines our civil liberties and puts servicemembers, union workers, religious minorities, and others at risk." He emphasized this is the fourth action taken this year challenging the sale of sensitive location data.
Gravy Analytics and Venntel are accused of acquiring consumer location information from other suppliers and claiming to process over 17 billion signals from around a billion mobile devices daily. The complaint states that geofencing was used to identify consumers attending specific events related to medical conditions or places of worship.
The proposed order requires the companies to delete all historical location data unless it is deidentified or rendered non-sensitive with consumer consent. Additionally, they must inform customers who received such data within the last three years about the need for deletion or de-identification.
The FTC will publish details of the consent agreement in the Federal Register soon. Public comments will be accepted for 30 days before deciding whether to finalize the order.
The Commission voted unanimously on this administrative complaint. Commissioner Alvaro Bedoya issued a concurring statement joined by Chair Lina Khan and Commissioner Rebecca Kelly Slaughter, while Commissioner Andrew Ferguson issued a concurring and dissenting statement.
This marks the fifth FTC action against improper handling of sensitive location data by aggregators. Previous cases include actions against Kochava in 2022 for tracking people to reproductive health clinics, X-Mode in January 2024 for selling raw location data, InMarket for precise user location sales, and Mobilewalla earlier today for similar violations.
The lead staffers on this matter are Jennifer Rimm, Brian Shull, and Bhavna Changrani from the FTC’s Bureau of Consumer Protection.
###
