This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

In December 2024, the FTC announced two separate settlements against Mobilewalla, Inc. and Gravy Analytics, Inc., asserting that the two companies were unlawfully tracking and selling sensitive location data from users without consent, including data related to visits to health centers. 

• Mobilewalla was additionally accused of using sensitive location data to develop audience segments and then selling that information to its clients so they could target specific consumers for advertising. One reported audience segment was pregnant women, identified through tracking data from pregnancy center visitors. 

• Gravy Analytics was accused of collecting and using sensitive consumer location data without informed consent, as well as selling data based on health-related characteristics. They were also alleged to have geofenced medical events and sold the resulting data. 

• Both companies were prohibited from selling, disclosing, or using sensitive location data from health clinics specifically, as well as other locations related to protected status (e.g., religious institutions, labor union offices, etc.). 

As part of the settlements, both companies are prohibited from selling, disclosing, or using sensitive location data obtained from visits to health clinics. The restrictions also extend to data collected from other locations associated with protected status, including religious institutions and labor union offices. These prohibitions represent a significant enforcement action in the ongoing effort to protect consumer privacy. 

Why these settlements are interesting and relevant 

• They restrict the sale of private and health-related geolocation data that isn’t subject to HIPAA. 

• Many consumer behaviors, when aggregated and analyzed, can reveal all kinds of information about the specific consumer, including health status. 

• This occurred under the previous administration, so it remains to be seen how, or if, the new administration’s FTC will handle similar cases. 

Restrictions on Geolocation Data Sales 

The recent settlements are notable because they impose strict limitations on the sale of private and health-related geolocation data even when such data is not subject to HIPAA regulations. By narrowing what information can be collected and monetized, they are a response to growing concerns over consumer privacy in the digital age. 

Aggregating and analyzing consumer behaviors can unveil sensitive insights about individuals, including their health status. For example, analyzing location data patterns has previously enabled companies to infer highly personal information based on purchasing habits. 

It is important to recognize that these settlements were reached under the previous executive administration. As a result, there is uncertainty about how the new FTC will approach similar matters. The handling of such cases going forward remains to be seen.

Contact us

For further details or additional information, please contact Noreen Vergara or another member of the Husch Blackwell Healthcare Privacy and Security Work Group.