The FTC alleged that Gravy Analytics and its subsidiary Venntel collected and sold sensitive location data without properly verifying informed consent. In January 2025 it finalised an order restricting use and sale, requiring a sensitive-location programme and addressing historical data. The action documents a commercial privacy problem and specific restrictions; it does not ban every broker, every location use or all qualifying security activity.
A phone’s movement can expose more than an advertising preference. Visits to clinics, places of worship, shelters or other sensitive locations can support inferences about a person’s life even when a product begins with a device identifier. The FTC’s action against Gravy Analytics and Venntel concerns that commercial chain: collection, consent, processing and onward sale. The original complaint’s allegations and the resulting consent order should be read separately, rather than treating a settlement as a criminal verdict.
The January 2025 order requires restrictions and compliance measures, including a programme for identifying sensitive locations. Its definitions also carve out certain security, national-security and emergency federal law-enforcement uses, and some directly requested services can qualify for exceptions. Those details matter when assessing what changed. A real regulatory intervention provides evidence of the market and its risks, but it does not establish that every smartphone owner has been personally tracked by an intelligence agency or that sensitive-location trade has universally ended.
The established record.
- 01
The FTC announced the proposed action in December 2024 and finalised its order in January 2025.
- 02
The order requires a sensitive-locations programme and restricts relevant use, sale and disclosure.
- 03
Its definitions and exceptions leave some qualifying uses outside the general restrictions.
How the story unfolded.
- Before the FTC action
A commercial location chain
The complaint describes collection and sale of location information associated with sensitive visits.
- 3 December 2024
The proposed action
The FTC publishes a complaint and proposed consent restrictions.
- 14 January 2025
The order is finalised
The FTC announces the final consent order and its compliance requirements.
Where the evidence stops.
A consent order is not a criminal conviction or a universal ban on location brokers. The complaint’s allegations are not admissions of every asserted fact; exceptions and definitions must be read precisely.
What would move this forward?
- Audit supplier consent records against actual collection and onward transfers.
- Test compliance with sensitive-location exclusion and deletion requirements.
- Examine exception claims and whether downstream products permit prohibited inferences or reidentification.
Read the original sources.
The source may establish a narrower point than the headline. Follow the specific finding, its date and its limitations.
How meaningful is consent when the sensitive inference appears several companies downstream?