An App You Forgot About Just Sold Where You Sleep
The FTC just banned one data broker from selling where you pray, get treated, and sleep. Here’s how to pull your own location off the market in 20 minutes.
There is a list somewhere with your name on it.
Not your name, exactly. A long number that belongs to your phone. But next to that number is a trail of dots, every place your phone has been. The coffee shop. The office. The street you live on. The building you walked into last Tuesday that you’d rather no one knew about.
And until very recently, that trail was for sale to anyone with a credit card.
Last month, the U.S. Federal Trade Commission (FTC) finally closed the book on one of the companies selling it. After nearly four years of fighting, a prominent data broker called Kochava agreed to stop selling the most sensitive parts of that trail. The landmark settlement was finalized in late June 2026.
If you’ve never heard the name “Kochava,” or even the term “data broker,” that’s entirely by design. They make money precisely because you don’t know they exist.
A Quick, Plain-English Definition
What is a data broker? A data broker is a company that collects information about you, without ever interacting with you and sells it to third parties. While some sell your name and email address, location brokers sell something far more intimate: exactly where your phone goes, all day, every day, accurate to within a few feet.
They don’t get this information by hacking your device. They buy it legally. Free utilities: a weather app, a casual game, a flashlight, or a coupon saver quietly bundle third-party software development kits (SDKs) into their code. This code reads your device’s exact coordinates and ships them off to the open market.
You tapped “Allow” once, years ago, and forgot. The app didn’t.
Why the FTC Spent Four Years Fighting This
According to the FTC’s complaint, Kochava sold precise, timestamped location data from hundreds of millions of unique mobile devices. Because the telemetry data was so precise, an absolute stranger could use it to pinpoint exactly who visited:
- Domestic violence shelters
- Addiction recovery clinics
- Reproductive health centers
- Mental health facilities
- Houses of worship
Think about what that data reveals. A location dot at an oncology clinic every three weeks tells a story. A dot at a shelter tells a story. A recurring dot at a mosque, synagogue, or church every single week tells a story. None of those stories are anyone else’s business, yet all of them were commercially available.
The June 2026 settlement explicitly bans Kochava from selling location data tied to these sensitive areas unless users clearly, knowingly give affirmative consent first.
The company must also construct a system to honor those preferences, track data leaks, and provide a clear mechanism for consumers to opt out.
This isn’t an isolated incident. Back in December 2024, the FTC targeted three other major players: Mobilewalla, Gravy Analytics, and Outlogic for identical tracking abuses. Gravy Analytics later suffered a massive data breach where a huge trove of captured location data spilled onto the dark web entirely.
This isn’t just a case of one bad company; it is an industry-wide business model.
📋 The 20-Minute Privacy Triage Playbook
While these federal enforcement actions are massive wins, they are slow, piecemeal, and reactive. They do not switch off the data collection firehose at large. Your everyday physical movements are still being logged and brokered by companies the FTC hasn’t penalized yet.
Get Pop Alexandru’s stories in your inbox
Join Medium for free to get updates from this writer.
Fortunately, you can drastically reduce your digital footprint today for free.
It takes less than twenty minutes.
Step 1: Purge Your Mobile Advertising Identifier
Your smartphone utilizes a single persistent tracking string — an “advertising ID” — that data brokers use to stitch separate location dots into a single, cohesive historical profile. If you delete this identifier, you break their ability to track you over time.
- On Android: Open Settings ➔ navigate to Google Services ➔ select Ads ➔ tap “Delete advertising ID”. Apps can no longer track your cross-app movements or link your location data to a permanent profile.
- On iPhone: Navigate to Settings ➔ select Privacy & Security ➔ tap Tracking ➔ toggle off “Allow Apps to Request to Track”. This systematically disables the identifier across the board. While in this menu, open Location Services and audit your app inventory, setting any non-essential app permissions to “Never”.
Step 2: Revoke Extraneous Location Permissions
Manually review your installed applications and aggressively strip away location access. A flashlight app has zero operational need to know you are sitting in a medical clinic. A mobile puzzle game doesn’t need your exact home address.
Unless an application strictly requires live positioning to function (like a maps interface, a ride-hailing tool, or a hyper-local weather radar), change its access state to “Never”. This cuts off data collection directly at the source.
Step 3: Enforce Massive Data Deletions
- If you are a California Resident: The state recently launched its free DROP (Delete Request and Opt-out Platform) system. You submit your informational criteria once, and every registered data broker operating in California is legally compelled to scrub your data from their servers and re-verify that deletion every 45 days. Data brokers must begin strictly honoring these consolidated requests starting August 1, 2026.
- If you live outside California: You aren’t entirely out of luck. Major data brokers maintain individual opt-out request pages on their web portals. You can search
"[Broker Name] opt out"to manually request removal, or use premium automated privacy services to handle the programmatic removal requests on your behalf.
🧠 For the Technically Curious: In mobile operating systems, this structural tracker is designated as the AAID (Android Advertising ID) on Google devices and the IDFA (Identifier for Advertisers) on Apple hardware. Zeroing or deleting this value won’t make your device completely invisible, networks can still infer basic location telemetry via your public IP address or active account sign-ins, but it entirely severs the cheap, automated link that commercial location brokers rely on to resell an aggregated profile of your life.
It is the structural difference between being followed by a stalker who knows your name, versus one who has to guess who you are every single morning.
Shutting the Door
Nobody ever asked for your permission before an analytics corporation in Idaho mapped out exactly where you lay your head down at night, where you choose to pray, or where you go to heal. They simply harvested it because the technical backdoors were left wide open and consumers were kept entirely in the dark.
The FTC is slowly shutting those backdoors down, one legal action at a time. But you don’t have to wait around for federal regulators to finally audit the specific entity tracking your movements. You can reclaim your physical privacy tonight.
Take 20 minutes right now. Clear out your device’s tracking tokens, drop unnecessary location access to “Never”, and rest easy knowing that the only person tracking your daily life is you.
📈 Master the Art of Consumer Protection & Threat Intelligence
Modern data collection and corporate surveillance loops rely on technical obfuscation and complex user-experience patterns to exploit consumer data. To ensure you never miss an actionable threat intelligence playbook or a deep-dive into digital civil liberties:
- Follow Pop123 on Medium for immediate alerts on newly published technical analyses, mobile operating system privacy deep-dives, and data protection strategies.
- Explore my Data Engineering and Machine Learning Projects on GitHub to inspect my public code repositories, view active data pipelines, or fork my structural modeling workflows.
- Subscribe to direct email updates by clicking the envelope icon (✉️) next to the follow button to ensure these tactical security breakdowns land right in your inbox.
Thank you for reading. If you found this tactical breakdown of data broker privacy valuable, consider leaving a clap and sharing your thoughts, configuration questions, or analytical feedback in the responses below. I am as always open to further discussing the topic!
