Commercial Location Surveillance and Sensitive Places
How commercially sold location data has been used to infer visits to religious sites, healthcare facilities, protests, and other protected spaces
Location Search Tools in the Commercial Market
In 2024, journalists at 404 Media investigated a commercially available product called Locate X, developed by a company named Babel Street. Locate X is one of several location intelligence tools that allow subscribers to query historical mobile device location data associated with specific geographic areas.
Using the tool, journalists conducted searches centered on houses of worship.
A query around a synagogue in Los Angeles returned location data associated with thousands of distinct mobile devices. A similar search around a mosque in Dearborn, Michigan returned thousands of additional devices and tens of thousands of location signals spanning multiple years.
The tool did not only show devices present at those locations. It also allowed analysts to view where those devices appeared afterward, including patterns of travel across cities, states, and international borders.
These results demonstrated that commercially available datasets can be used to infer attendance at religious services and map subsequent movement patterns tied to individual devices.
Tracking Healthcare Visits
Researchers have demonstrated similar searches involving healthcare facilities.
In one documented example, analysts followed a single device as it traveled across state lines, stopped at a medical facility for a defined period of time, and then returned to its origin location. Based on overnight location patterns, the system inferred a likely home address.
The dataset revealed a sequence of movements associated with a specific device over time, including visits to sensitive healthcare locations.
These demonstrations were conducted using tools marketed for analytics and intelligence purposes, not bespoke law enforcement systems.
Cost and Accessibility of Location Data
Journalistic reporting has also examined how accessible this type of data can be.
In 2022, a reporter from Vice Motherboard contacted a location data vendor and requested a dataset showing visits to reproductive healthcare facilities. The vendor offered to sell aggregated foot traffic data covering hundreds of locations across dozens of states for a relatively small fee.
The dataset included information about visit frequency, duration, and movement patterns before and after visits.
Following public reporting, the vendor announced changes to its sales practices. However, the investigation illustrated how easily sensitive location datasets could be obtained prior to policy changes.
Location Data and Targeted Messaging
Location data has also been used to deliver targeted digital advertising.
Public disclosures revealed that location data associated with visits to healthcare facilities was used by third parties to deliver mobile advertisements to individuals inferred to have visited those locations. In some cases, ads were delivered while individuals were still on-site.
These campaigns relied on commercially acquired geolocation data rather than direct interaction between advertisers and healthcare providers.
Religious Practice Apps and Data Sharing
Several widely used religious practice apps have also been linked to commercial location data flows.
Investigations found that some apps providing prayer times and religious resources shared precise location data with third-party analytics or advertising partners. In certain cases, those partners sold location data to companies contracting with government agencies.
The apps involved had millions of users worldwide. Disclosures following reporting led to platform enforcement actions and changes to app store policies, but only after significant data collection had already occurred.
Categories of Sensitive Locations
In enforcement actions finalized in 2024 and 2025, the Federal Trade Commission identified specific categories of locations that require heightened protection due to their sensitivity.
These categories included:
- Medical and reproductive healthcare facilities
- Places of religious worship
- Domestic violence and homeless shelters
- LGBTQ+ community locations
- Labor union offices
- Sites of political protests or demonstrations
- Correctional facilities
- Military installations
The FTC’s orders prohibited certain companies from selling or using location data tied to these locations and required deletion of previously collected data.
The need to explicitly enumerate these categories reflected documented prior collection and sale practices within the industry.
Enforcement Actions and Timing
Between 2022 and 2025, the FTC brought actions against multiple location data brokers, including:
- X-Mode / Outlogic
- Mobilewalla
- Gravy Analytics and its subsidiary Venntel
- Kochava (ongoing litigation)
The cases addressed practices such as collecting location data through advertising infrastructure, selling sensitive location datasets, and enabling downstream resale to government and private customers.
In many instances, data had been collected for years before enforcement actions were taken.
Location Data and Public Assembly
Location data has also been used to analyze attendance at large public gatherings, including protests.
Public reporting has documented the availability of datasets capable of identifying devices present at demonstrations and mapping their movements before and after events. These capabilities raise concerns about how participation in protected activities can be inferred from commercial data.
The existence of such datasets does not depend on individuals identifying themselves or publicly sharing their participation.
What Location Data Can Reveal
Commercial location datasets can often be used to infer:
- Likely home and work locations
- Religious affiliation or practices
- Healthcare decisions
- Participation in protests or political events
- Travel patterns, including international movement
- Daily routines and behavioral patterns
These inferences can be made using device-level identifiers and repeated location signals over time.
Why Sensitive Location Tracking Raises Unique Risks
Unlike general consumer behavior data, location data tied to sensitive places intersects with fundamental rights and personal safety.
Visits to healthcare facilities, houses of worship, shelters, or protests are often protected activities. Persistent tracking of these visits creates risks of discrimination, harassment, profiling, or misuse when data is accessed by unknown parties.
The risks increase when data is retained long-term, resold multiple times, or accessed without the knowledge of the individuals involved.
Steps Individuals Can Consider
Individuals concerned about location data exposure may consider the following actions:
- Review which apps have access to precise location data
- Limit location permissions to “while in use” or disable them when not required
- Manually configure apps that allow city-level input instead of GPS access
- Request copies of personal data from known data brokers where legally available
- Consider leaving devices behind or disabling radios during sensitive activities
These steps reduce exposure but do not eliminate systemic collection.
The Structural Issue
The tracking of sensitive locations is not the result of isolated misuse. It reflects a broader data economy in which location information is collected at scale, packaged for resale, and reused across contexts.
When sensitive activities are mapped using commercial datasets, protections intended by constitutional, civil rights, or privacy frameworks can be indirectly bypassed.
The Bottom Line
Commercial location data has been used to infer visits to religious institutions, healthcare facilities, protests, and other sensitive spaces.
While recent enforcement actions have imposed restrictions on some companies, the underlying infrastructure that enables large-scale location collection remains widespread.
Understanding how these systems operate is essential for evaluating personal risk and for informing broader policy discussions about data collection, consent, and the limits of commercial surveillance.
Sources: 404 Media reporting on Locate X; Vice Motherboard investigations into SafeGraph and Near Intelligence; FTC enforcement actions against X-Mode/Outlogic, Mobilewalla, and Gravy Analytics/Venntel; Kochava litigation filings; reporting on religious app data sharing; EFF analysis of location data and protest surveillance.