Collected, Not Followed
Your movements are not being followed. They are being collected, by ordinary apps on your own phone, and then sold onward. The record is being written anyway, and the thing that makes that record yours has a name.
It is the advertising identifier: a unique code your phone carries so advertisers can recognize the device. The Federal Trade Commission put it plainly. Raw location data sold by one broker was associated with mobile advertising IDs, was not anonymized, and could match an individual's device to the places it visited.
An Inference About Your Life
That data was not stolen. It came through a software development kit built into ordinary apps, then went to hundreds of clients. Until May 2023, the Commission found, that company had no policy for removing sensitive locations from the raw data it sold.
Sensitive means what you would expect. Across these actions the Commission named reproductive health clinics, places of worship, addiction recovery facilities, and homeless and domestic violence shelters. A movement trail is not a map of where you go. It is an inference about your life.
In 2022 the FTC sued a location data broker called Kochava for selling precise location data from hundreds of millions of phones. That case ended in a 2026 court order, entered in June 2026 in the U.S. District Court for the District of Idaho. The order bars Kochava from selling location data tied to a defined list of sensitive places without your affirmative express consent, and requires a plain way to withdraw consent, and a way to ask who your precise location data went to.
Act on the Actual Link
So act on the actual link. Reset or limit the advertising identifier on your phone, and cut app location permissions back to the few that need it while you use them. And on VPNs, use the FTC's own words: a VPN does not render you anonymous, it shifts trust to the provider. It does nothing about app collection.
That is the correction worth carrying out of this lesson. The leak is not the network you joined. It is the code your phone hands to every app you installed once and forgot about.
Sit down with the phone once and make one pass. Open the location permission list and read it top to bottom. Anything that does not need your location to do its job goes to Never; anything that genuinely does, to While Using. Then find the advertising identifier control and reset or limit it. One pass, and it acts on the record instead of on the network.