FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data

The Federal Trade Commission finalized an order prohibiting Gravy Analytics and its subsidiary Venntel from unlawfully tracking and selling sensitive location data from users, including data about consumers’ visits to health-related locations and places of worship.

In a complaint first announced last month, the FTC alleged that Gravy and Venntel violated the FTC Act by unfairly selling sensitive consumer location data, and by collecting and using consumers’ location data without obtaining verifiable user consent for commercial and government uses. The complaint alleged that Gravy Analytics used geofencing, which creates a virtual geographical boundary, to identify and sell lists of consumers who visited healthcare facilities and places of worship and sold additional lists that associate individual consumers to other sensitive characteristics.

Under the final order, Gravy Analytics and Venntel will be prohibited from selling, disclosing, or using sensitive location data except in limited circumstances involving national security or law enforcement. The companies must also establish a sensitive data location program.

After receiving two substantive comments, the Commission voted 5-0 to approve the final order and send responses to the commenters.