An ordinary trip to the gym, grocery store or dinner can generate a record of where you go and how you live. Research and federal enforcement cases show how location data from mobile apps and advertising systems can travel through an industry most consumers never encounter.
By Saturday afternoon, your phone may have gone with you to the gym, a grocery store, a coffee shop and dinner with friends. You checked the weather, used a navigation app to avoid traffic, scanned a loyalty card and searched for a restaurant. Nothing about the day seems revealing. But depending on your apps, permissions and the technology behind them, parts of that routine may have generated location records that travel much farther than you do.
A single location reading says little. Repeated readings can show where you live, where you work and how you spend your time, including regular visits to healthcare facilities, places of worship, political gatherings or someone else’s home. And the people analyzing those patterns may have no relationship with you.
The scale makes this a national privacy issue, not a niche one. According to Pew Research Center, 91% of U.S. adults owned a smartphone in 2026, up from 35% in 2011. The devices are now essential for communication, navigation and commerce, and the information they generate has value to companies far beyond the apps on your screen.
The Business of Knowing Where You Go
Most people understand that a navigation app needs location data to give directions, or that a weather app needs it for a local forecast. The less visible part begins when location data enters the advertising industry, where it is used to decide which ads to show, measure campaigns and build audiences based on behavior.
One key mechanism is real-time bidding. When an app or website has ad space to fill, an automated system invites advertisers to bid for it. The information shared during that process can include an advertising identifier, device details and location. The auction takes a fraction of a second, and the consumer never sees it.
The Federal Trade Commission explained in December 2024 that these exchanges can broadcast consumer information to many potential advertisers. Only one needs to win the auction, but others may receive portions of the data. That creates an opening for companies interested in the data itself rather than the ad.
In its case against data broker Mobilewalla, the FTC alleged that the company collected more than 500 million unique advertising identifiers paired with precise location information between January 2018 and June 2020. The identifiers represent devices or advertising profiles, not necessarily 500 million people. According to the agency, Mobilewalla obtained some of the data from advertising exchanges and kept it even when it lost the auctions, then used it commercially, including for audience analysis. The FTC alleged the data included visits to healthcare facilities and places of worship. In January 2025, the agency finalized an order restricting the company’s collection and sale of sensitive location information.
Seventeen Billion Location Signals a Day
Mobilewalla was not the only company to draw scrutiny. In another action, the FTC alleged that Gravy Analytics and its subsidiary Venntel bought location records from data suppliers and sold information that could reveal consumers’ visits to sensitive places. According to the complaint, the companies claimed to collect and process more than 17 billion location signals daily from approximately one billion mobile devices.
Those figures describe the companies’ own claims about their scale, as recounted in the FTC complaint, not an independent count of people monitored each day. Still, they show the volume involved. The FTC alleged that the companies used geofencing, which draws a digital boundary around a physical area, to identify devices that appeared at particular locations, and that the resulting data could be used to build lists tied to visits to medical facilities, religious institutions and other sensitive places. The agency finalized an order in January 2025 restricting the companies’ use and sale of sensitive location data, with limited exceptions.
What makes these cases troubling is how ordinary the underlying activity was. Visiting a doctor, attending a service or joining a public gathering should not mean a person’s movements become a commercial product.
The industry’s roots run deep. Foursquare, once a symbol of the location-sharing internet, has been acquired by an advertising technology company, and co-founder Dennis Crowley says the deal paid its shareholders nothing.
When a Device Becomes a Person
Location data is often described as anonymous because it carries advertising identifiers instead of names. But removing a name does not prevent identification. A phone that spends every night at one residential address and every weekday at another location offers strong clues about who owns it, and combined with other records, those clues get stronger.
In August 2026, the Committee to Protect Journalists published an investigation into how data from digital advertising systems can expose journalists and their sources. It described a sample of roughly 100 million location records tied to one million devices, covering just two weeks in 2025. Belgian journalist Nicolas Baudoux said the sample was enough to identify individuals within it.
The implications go beyond journalism. A location history can reveal relationships, sensitive appointments and routines. The risk depends on how precise, complete and accessible the data is, but a missing name does not eliminate it. A person can be careful about what they post on social media while unknowingly generating a separate record of where they go.
Surveillance Without Following Anyone
The commercial market for location data has also drawn the interest of government agencies. In April 2026, researchers at the University of Toronto’s Citizen Lab published an investigation of Webloc, a geolocation surveillance system associated with Penlink. The researchers described a system with access to location records tied to hundreds of millions of devices worldwide, and examined how data derived from consumer apps and advertising could be used to search for devices, reconstruct movements and identify individuals.
Penlink disputed aspects of the findings, arguing that parts of the analysis relied on inaccurate information or misunderstood its current operations. The company said it follows applicable state privacy laws and responsible-use standards. That response matters, but it does not erase the broader issue raised by researchers and regulators: data collected through routine consumer technology can become useful for surveillance far removed from the original transaction.
Tracking someone once required physical observation or access to records held by carriers or transportation providers. Commercial datasets offer another route, sometimes combining observations from many apps and places. That raises hard questions about oversight, consent and the line between commercial data collection and government surveillance.
Our Information Rarely Stays Where We Leave It
We have examined related problems at Social Storytellers Collective. In Our Lives Are in the Cloud. The Risk Comes Home., we explored how consumers entrust businesses with personal information without knowing which vendors and employees can reach it. Our commentary on the Quest Diagnostics incident extended that concern to medical records, which patients share because care requires it, not because they have vetted every technology provider. We also recently reported on retailers using license-plate recognition technology to track vehicles.
These are different practices. A breach is unauthorized access, while commercial location collection often runs through business arrangements, app permissions and ad systems, though regulators have found cases where companies failed to obtain valid consent or otherwise handled sensitive data unlawfully. In New Mexico, a judge ordered Meta to pay $25 billion for misleading Facebook users about privacy. What these cases share is how little visibility consumers have once information leaves the original interaction. A vehicle entering a parking lot, a phone near a medical office and a login to a health portal look like separate events. Together they show how much of modern life produces data beyond the activity itself, and tracing where that data goes is far harder than understanding why it was collected.
Americans Know Something Is Wrong
Public concern is widespread. In a 2023 Pew Research Center survey, 81% of American adults said they were very or somewhat concerned about how companies use the data collected about them, and 73% said they had very little or no control over it. Another 67% said they understood very little or nothing about what companies do with their personal data. The survey covers corporate data collection broadly, not smartphone location tracking specifically, but it helps explain why the industry is so hard for consumers to navigate.
Companies are starting to draw public lines. Target has joined Walmart in saying it does not use customer identity, location, time of day or demand spikes to raise prices. Those statements are reassuring, but they are promises about one use of data, not a map of where the data goes.
Phone settings help. You can review app permissions, limit location access and turn off personalized advertising, and Apple and Android both offer tools that restrict access to advertising identifiers to varying degrees. But no single setting controls every source. Location can also be estimated from IP addresses, cellular networks and Wi-Fi connections, and the precision of those methods varies. Nor can consumers be expected to audit every company in the advertising market. Privacy controls matter, but responsibility cannot rest entirely with the person carrying the phone.
The Cost of an Ordinary Saturday
By the end of the day, you may have driven home from dinner, plugged in your phone and forgotten most of the small decisions you made with it. You checked directions, looked for somewhere to eat, stopped at a store, and maybe opened an app without asking whether it needed to know where you were.
Not every action creates a precise, persistent location record, and not every company that receives device data sells it to brokers. But the enforcement cases and investigations show that ordinary mobile activity can feed an industry capable of reconstructing sensitive patterns of movement. That is what consumers deserve to understand.
The benefits of these devices are substantial, and giving them up is not a realistic privacy strategy. The reasonable expectation is that companies collect only what they need, explain how it will be used, obtain meaningful consent where required and keep sensitive information from circulating beyond its proper use. Regulators and lawmakers have a role in setting and enforcing those safeguards, especially when data gathered for commercial purposes becomes available for surveillance.
Our phones make it easier to move through the world. They should not require us to surrender control over the record of everywhere we’ve been.
By Sunday morning, you may barely remember all the places you went on Saturday.
Depending on what was collected and retained, someone else’s database might.