How a Handful of Location Data Brokers Actively Track Millions, and How to Stop Them

The talk opens with the EFF's examination of a small group of location data brokers that gather precise movement data from millions of phones. The presenters use Gravy Analytics as the central example. A breach exposed records tied to apps ranging from dating and games to weather and finance tools, and many of the app developers involved said they had no idea their users' locations were leaving their software.

The middle of the talk maps two main pipelines. In the first, tracking SDKs embedded in apps, sometimes supplied in return for payment, send location straight to brokers. In the second, real-time bidding in ad auctions lets companies receive coordinates and device identifiers from bid requests even when they never win the ad. The speakers describe how this data reaches government agencies and private investigators, and how it has been used to target people by beliefs, medical visits and other sensitive activity. They argue that the advertising business model rewards collecting as much personal data as possible.

The closing section turns to practical steps. Developers are urged to vet SDKs, request fewer permissions and be open about data practices, while platform makers are asked to offer finer permission controls and better blocking. Lawmakers are urged to pass a federal privacy law with a private right of action. Individuals can reset or delete their advertising ID, audit app permissions, use opt-out services and, in sensitive situations, rely on offline navigation. The speakers reported that data requests they filed with brokers returned nothing about them, which they credited to layered blocking tools.