By Zeynep Tufekci / The New York Times

The Federal Trade Commission just took much-needed action against a company and its subsidiaries. You’ve probably never heard of those companies, but they’ve probably heard of you. More accurately, they know where you’ve been. Exactly where you’ve been.

A clinic providing reproductive services? A protest? The new place you just moved, while trying to hide the address from an abusive ex or a stalker? They know.

Earlier investigations revealed that the companies, Gravy Analytics and its subsidiary Venntel, got that data through innocuous-looking apps, including weather and navigation apps. They sold that location data to third parties, including but not just law enforcement agencies. One minute you’re checking whether it’s raining, the next thing you know, immigration police are at the door, asking why you were visiting a migrant shelter. No need for a warrant, just a payment to a corporation will do.

These companies also sold, the FTC says, “health or medical decisions, political activities and religious viewpoints” that they derived from the location data.

The new FTC proposed order would ban these companies from selling “sensitive location data except in limited circumstances involving national security and law enforcement.” This would include places such as medical facilities, religious organizations, correctional facilities, labor unions, schools, shelters and military installations.

Also this week, the Consumer Financial Protection Bureau published new rules that would limit how credit data can be distributed; especially addresses, which are currently part of many people’s regular credit files. (If you receive a credit card or statements at home, your address is on there.) At the moment, marketers can easily purchase that data, and those purchases can result in more than just annoying ads.

Investigators from the publication 404 Media found that criminals can then purchase sensitive personal data for about $15 per person in Telegram groups where “members offer services for a price, such as shooting up a house, armed robberies, stabbings, and assault.”

The CFPB aims to limit distribution of such data to what’s defined as “legitimate purposes” under current financial laws, such as issuing credit or insurance or employer background checks.

To this, I’d say: Don’t get your hopes up. The proposed FTC rule and CFPB guidance could easily be reversed under a new administration, and it’s not even certain if those agencies will survive the government dismantling Donald Trump has promised.

It’s a pity that Congress never passed proper privacy laws, so whatever the agencies can do will be limited and easily reversible.

Checking whether it will rain or playing a mobile game (another common source for such sensitive data) shouldn’t come at such a high cost, but when lawmakers don’t do what they should, that’s exactly what happens.

This article originally appeared in The New York Times, c.2024.