The pitch (what they say it does)
Why does a flashlight app need your location in the background? It does not, and the privacy policy will not say so plainly. It will say "to improve service quality" or "for analytics," somewhere past clause eleven. The FTC has already made the point for us: in its action against X-Mode Social and Outlogic, the agency found the company sold precise location data without removing sensitive places like reproductive health clinics, places of worship, or domestic abuse shelters. That is not a hypothetical harm. It is a documented one.
The pitch is always the same. The app needs location to "personalize your experience," to show nearby stores, to tag where a photo was taken, to log a run. Sometimes that is true. Often it is a thin justification for a data stream the company monetizes elsewhere. The FTC's complaint against Mobilewalla alleged the company collected and sold precise location data, then failed to verify consent from the people whose data it was. Under Section 5 of the FTC Act, deceptive or unfair data practices are actionable. The vendor's framing is not the standard. The data flow is.
What they collect (often more)
Precise location is not one data point. It is a continuous trace. A trace reveals where you sleep, where you work, which clinic you visited on Tuesday, which church you attend, who you spent the night with. The FTC has said as much: the information revealed through sold location data exposed consumers to potential discrimination, physical violence, and emotional distress. The EFF argues that all location data is sensitive, not just data tied to a short list of protected places. That is the correct frame. A narrow list of sensitive locations is a partial fix. It leaves the rest of the trace exposed.
What they don't tell you (usually about resale or model training)
The policy rarely says "we sell your location to brokers." It says "we share with trusted partners." Those partners are often data brokers, and brokers resell. The FTC's X-Mode/Outlogic order explicitly prohibits selling sensitive location data and requires a supplier assessment program: the company must confirm consumers consented, or it cannot collect or use the data. Mobilewalla faced a similar mandate, including a privacy program assessed annually and employee training. State laws are moving too. The EFF notes that five state statutes now address location privacy, but none gives consumers a direct right to sue. Enforcement depends on attorneys general with limited staff. That is the gap. The law is catching up; the resale market is not waiting.
Your move (what to do about it)
Open your phone's settings and audit location permissions app by app. Set every app that does not need background location to "while using" or "never." Weather apps can work with a city you type in. Photo apps do not need your trace. Then open each app's privacy settings and look for an opt-out from "personalized advertising" or "data sharing." If the opt-out exists without breaking core function, take it on day one. If the app will not run without background location and has no clear reason, delete it. The FTC has shown that enforcement follows the worst actors, but it arrives after the data is sold. Your setting change arrives before.
FAQ
Doesn't a weather app need my location to work?
No. Type in a city and it will forecast just fine. Background location on a weather app buys you a marginally better forecast and hands a broker a continuous trace of where you sleep and work. Set it to "while using" or "never" and move on.
If I opt out of personalized ads, does that stop the data sale?
Sometimes, sometimes not. The opt-out often stops ad targeting but not the underlying collection or resale. Read the app's privacy settings for a separate "data sharing" toggle, and if there isn't one, assume the trace is still flowing. That is your signal to delete the app.
Can I sue if a broker sold my location data?
Not directly, in most states. The EFF notes five state statutes address location privacy, but none gives consumers a private right of action. Enforcement runs through attorneys general with limited staff. Your leverage is the permission setting, not the courtroom.
