House Investigating Company Selling Phone Location Data to Government Agencies

Jun 24, 2020
In The News

WASHINGTON—A congressional committee has opened an investigation into the sale of the location data drawn from millions of U.S. mobile phones to law-enforcement agencies, according to a letter shared with The Wall Street Journal.

The Democratic-led House Committee on Oversight and Reform said it was conducting an investigation in conjunction with two Democratic senators of the products sold by Venntel Inc. Venntel is a Virginia-based data broker and software company that has contracts with the Department of Homeland Security, the criminal investigation division of the Internal Revenue Service, the Federal Bureau of Investigation and other government entities.

“The vast majority of Americans carry cellphones with apps capable of collecting precise location information 24 hours a day, 7 days a week. This location-tracking raises serious privacy and security concerns,” said the letter, which was signed by committee chairwoman Carolyn Maloney (D., N.Y.) and Rep. Mark DeSaulnier (D., Calif.) as well as Sens. Elizabeth Warren (D., Mass.) and Ron Wyden (D., Ore.).

The committee requested that Venntel provide information on its clients, the source of its data and the steps it has taken to protect privacy and personal information in its data set by early July, according to the letter.

The investigation is the latest indication of interest by regulators and lawmakers in the increasing use by law-enforcement and intelligence agencies of cellphone location data sold by marketing companies.

Chris Gildea, the president of Venntel, didn’t immediately respond to a request for comment.

The Journal reported this year that Venntel’s platform was used by DHS to detect unlawful border crossings and was used unsuccessfully by the IRS to try to track criminal suspects.

Venntel’s data is drawn from mobile apps like weather trackers and games that require the consumers to opt in to allowing location tracking. The data—which isn’t linked to a customer’s name or phone number—is sold by the company that originally collects it and resold until it ends up in the hands of Venntel and other location-data aggregators that collect and sell such data.

Generally, consumers have consented to their data being collected for marketing purposes and other corporate research—not government surveillance—raising questions about whether mobile-phone users are being given fair notice about the use of their data.

Venntel is a wholly owned subsidiary of the Dulles, Va.-based Gravy Analytics Inc., a company that works with some of America’s largest corporations on marketing and advertising campaigns using location records from millions of cellphones.

In business documents, Gravy said that it can track more than 150 million U.S. mobile devices monthly, though it isn’t clear how much of that data it makes available to the federal government through Venntel. Gravy says it complies with all applicable laws and takes its privacy obligations seriously.

In the data, consumers are generally represented only by an alphanumeric string called the Identifier for Advertisers (IDFA) on iPhones and the Android Advertising ID (AAID) on phones running Google operating systems.

But in practice, the real-world movements of the phone can reveal details about its ownership. Where the phone is located overnight is likely where the phone’s owner lives, for example. The identity of that person can further be corroborated if their workplace, place of worship, therapist’s office or other information about their real-world activities are known to investigators.

The Journal reviewed one marketing database similar to the kind used by Venntel. In many cases, the data is precise enough to clearly identify the home address of the phone’s user, which can then be cross-checked against public databases showing property-ownership records or rental-address history.

For commercial purposes, the data is mostly valuable in the aggregate. Investors, advertisers and marketers use it to target ads, determine the demographics of where a brand’s consumers live, track how long people linger in stores on average and determine whether business is increasing or decreasing at real-world locations.

Prosecutors have long been able to get data from cellphone carriers on individual subscribers and use it as evidence in court.

Until 2018, prosecutors needed “reasonable grounds” to get court approval to seek cell-tower records from a carrier. In June 2018, the U.S. Supreme Court strengthened the requirement to show probable cause a crime has been committed before such data can be obtained from carriers.

But the law is unclear about whether law-enforcement or intelligence areas can buy bulk location data derived from marketers, rather than trying to get cell records from carriers. Government lawyers at numerous agencies have approved purchasing Venntel subscriptions and other similar services, but few courts have had the opportunity to weigh in.