Smartphone apps routinely collect location data that can reveal visits to doctors, pharmacies, places of worship and support groups, and parts of that information can end up with outside companies without any hacking involved.
The tracking often starts with ordinary permissions users grant themselves. Weather apps, shopping apps and games commonly ask for location access, and many include advertising and analytics software from outside firms. Depending on an app’s permissions and privacy practices, that software may collect or receive data about a device’s location.
Smartphones also use advertising identifiers meant to help companies measure ad performance. On Apple devices this is called the IDFA; Android devices use Google’s advertising ID. When apps are permitted to use these identifiers, they can help link activity across different apps, and combined with location and other data, build a detailed picture of where a device — and its owner — has been.
A device that is at one address every night and turns up at a dialysis center every Tuesday and Thursday is not hard to identify once that pattern is linked to other personal details.
Regulators have already acted
On May 4, 2026, the Federal Trade Commission announced a settlement barring data broker Kochava and its subsidiary, Collective Data Solutions, from selling, sharing or disclosing sensitive location data without people’s affirmative express consent, subject to the order’s terms. The FTC had alleged Kochava sold location data from hundreds of millions of mobile devices that could track people to health facilities, places of worship and other sensitive locations. Kochava did not admit wrongdoing.
Kochava is not the only company regulators have targeted. In December 2024, the FTC took action against two more location data firms, Gravy Analytics and Mobilewalla, over allegations involving the sale of sensitive location data.
In January 2025, Gravy Analytics was breached. A hacker posted what they claimed was 17 terabytes of stolen data on a Russian cybercrime forum. Security researchers who examined a sample found more than 30 million location points, including phones at the White House, the Kremlin and military bases around the world. The data reportedly came from everyday apps, including games and dating apps.
Why it matters beyond privacy
A device that regularly leaves home at the same time each day and returns two hours later can reveal when someone is away. Location details can also make scam calls more convincing — a caller claiming to be from
