The Federal Trade Commission (FTC) has taken action against Gravy Analytics Inc. and its subsidiary Venntel Inc. for unlawfully tracking and selling sensitive location data from users. The companies have agreed to a proposed settlement, which prohibits them from selling, disclosing, or using sensitive location data in any product or service.
Under the agreement, Gravy Analytics and Venntel must establish a sensitive data location program and delete all historic location data. They will also be required to inform customers who received historic location data within the last three years that it should be deleted, de-identified, or rendered non-sensitive.
The FTC alleges that Gravy Analytics continued to use consumers’ location data after learning that they didn’t provide informed consent. The companies allegedly sold sensitive characteristics, such as health or medical decisions, political activities, and religious viewpoints, derived from consumers’ location data.
The proposed settlement requires the companies to maintain a supplier assessment program to ensure that consumers have provided consent for the collection and use of all data that may reveal a mobile device or consumer’s precise location. The companies will also be banned from making misrepresentations about their data handling practices.
The FTC says the companies’ actions exposed consumers to potential privacy harms, which could include disclosure of health or medical decisions, political activity, and religious practices. The unauthorized disclosure of sensitive characteristics puts consumers at risk of stigma, discrimination, violence, and other harms.
This is the FTC’s fourth action taken this year challenging the sale of sensitive location data by data aggregators. The agency has also issued actions against Kochava, X-Mode, and InMarket for similar violations.
Source: https://www.ftc.gov/news-events/news/press-releases/2024/12