Key Allegations in the Complaint
The FTC’s complaint focuses on the following critical points:
1. Massive Collection and Sale of Location Data
Gravy Analytics and Venntel allegedly collected precise geolocation data from billions of mobile devices daily without consumer consent. This data was sold to third parties, including government entities and private businesses. The companies used mobile advertising IDs (MAIDs) to identify and track individual users.
2. Tracking to Sensitive Locations
The companies are accused of tracking consumers to sensitive locations such as religious institutions, political events, medical facilities, and domestic violence shelters. These practices revealed private details about individuals’ lives, such as their health conditions, political affiliations, and religious beliefs.
3. Creation of “Audience Segments”
Gravy Analytics allegedly categorised individuals into over 1,100 audience segments based on their location data. Examples include “New Parents/Expecting,” “Political Activists,” and “Women’s Health.” These audience segments, tied to specific MAIDs, were then sold to customers, enabling invasive targeted advertising and profiling.
4. Failure to Verify Consent
The complaint alleges that Gravy Analytics and Venntel did not take reasonable steps to verify whether consumers had consented to the collection and sale of their location data. In some cases, the companies used data from suppliers who failed to provide clear information on how consumer consent was obtained.
5. Impact on Privacy and Security
The FTC argues that the data practices of Gravy Analytics and Venntel caused significant harm to consumers by invading their privacy and exposing them to risks of stigma, discrimination, and physical harm.
Business Practices That Fuelled Privacy Violations
According to the FTC, Gravy Analytics and Venntel’s practices were particularly invasive:
• Raw Location Data Sales: Gravy Analytics sold raw location data, including precise latitude and longitude coordinates, along with timestamps and IP addresses.
• Geo-Fencing Tools: The companies offered geo-fencing capabilities that allowed customers to identify and target users present at specific locations during designated timeframes.
• Continuous Tracking: Venntel provided tools to continuously monitor a single device’s movement over time, revealing users’ daily routines and social associations.
These practices enabled customers to track individuals, even linking their movements to specific events or characteristics like political affiliation or health conditions.
FTC’s Charges and Violations
The FTC outlined three major violations of Section 5 of the FTC Act:
1. Unfair Sale of Sensitive Location Data
The sale of geolocation data tied to sensitive locations caused substantial harm, such as privacy invasions and the risk of discrimination.
2. Unverified Collection of Location Data
Gravy Analytics and Venntel failed to ensure consumers were informed about how their data was collected and used, often repurposing the data for government and commercial purposes beyond the original consent.
3. Sale of Sensitive Inferences
Gravy Analytics categorised users based on sensitive characteristics inferred from their location data. For example, individuals attending breast cancer support groups were tagged as “Women’s Health,” which was then sold to marketers.
Consumer and Societal Impact
The misuse of geolocation data poses significant risks to individuals, including:
• Privacy Violations: The collection of precise geolocation data without consent enables intrusive monitoring of individuals’ daily lives.
• Discrimination: Audience segments like “Political Activist” or “Women’s Health” could lead to discriminatory practices in employment, healthcare, or insurance.
• Stigma and Harm: Individuals tracked to sensitive locations, such as LGBTQ+ events or domestic violence shelters, could face stigma or physical harm if their information is leaked or misused.
The FTC also highlighted cases where precise location data led to harmful outcomes, such as the exposure of a Catholic priest’s private activities and the tracking of “abortion-minded women” for targeted ads.
FTC’s Demands and Next Steps
The FTC seeks to hold Gravy Analytics and Venntel accountable for their violations by demanding:
• Ceasing Data Sales: Prohibit the sale of sensitive geolocation data.
• Reforms to Consent Practices: Implement strict measures to verify consumer consent.
• Consumer Protections: Introduce safeguards to prevent harm from the misuse of location data.
This case underscores the growing need for stricter regulations on the collection and sale of location data. The FTC’s actions highlight the importance of transparency, consent, and accountability in the data economy. As the surveillance economy continues to expand, this case may serve as a precedent for holding other companies accountable for invasive data practices.
