Phone Location Data Can Reveal Doctor, Church and Pharmacy Visits

Your smartphone can reveal where you go — including visits to doctors, pharmacies, churches and support groups — without anyone physically following you. The location data is often collected not through hacking but through ordinary apps that users install themselves and the permissions they grant.

Apps frequently include advertising and analytics software from outside companies. Depending on the app's permissions and privacy practices, that technology may collect or receive information about a device and its location. Once location data leaves the phone, controlling where it goes becomes much harder.

Smartphones use advertising identifiers that help advertisers and developers measure ads and activity. Apple devices use the IDFA, while Android devices use Google's advertising ID. Combined with location data and other signals, these identifiers can help companies build a detailed trail of where a device has been. A device that sleeps at a home address every night and appears at a dialysis center every Tuesday and Thursday is not anonymous to anyone who can connect those locations with other identifying information.

The federal government has spent years fighting one such case in court. On May 4, 2026, the Federal Trade Commission announced a settlement that bars the data broker Kochava and its subsidiary, Collective Data Solutions, from selling, sharing or disclosing sensitive location data without people's affirmative express consent, subject to the terms of the order. The FTC alleged Kochava sold location data from hundreds of millions of mobile devices that could track people to health facilities, places of worship and other sensitive locations. Kochava did not admit wrongdoing.

Kochava was not alone. In December 2024, the FTC took action against two more location data companies, Gravy Analytics and Mobilewalla, over allegations involving the sale of sensitive location data. In January 2025, Gravy Analytics was breached. A hacker posted what they claimed was 17 terabytes of stolen data on a Russian cybercrime forum. Security researchers examining a sample found more than 30 million location points, including phones at the White House, the Kremlin and military bases around the world. The data reportedly came from everyday apps, including games and dating apps.

The pattern is clear: a company collects movements, regulators take action over how sensitive location data gets handled, and then criminals allegedly obtain a massive collection of data anyway. A few weeks of location data can potentially reveal health conditions, religious observance, relationship patterns and daily routines. Those last few can turn a privacy problem into a safety concern. A device that regularly leaves a home at the same time and returns two hours later can reveal patterns about when someone may be away.

Location information can also make a scam call more convincing. A caller who says they are from the billing office at a clinic on Oak Street about a visit last week is much harder to dismiss when the clinic and timing happen to be correct. With Medicare Open Enrollment beginning October 15, a caller who seems to know your doctor or pharmacy may sound more convincing than a random scammer.

Many people granted location permission to a weather app, a store app or a game years ago and forgot about it. Even apps without precise location permission may be able to estimate a general area through information such as an internet connection.

Users cannot make themselves invisible, but they can make their movements harder to track. On Apple devices, the first step is to control whether apps can request permission to track across other companies' apps and websites. When this setting is off, apps that request permission to track are treated as though the user selected Ask App Not to Track. They cannot access Apple's system advertising identifier, the IDFA. Apple also has a separate setting for ads that Apple itself delivers, which limits how Apple personalizes ads in services such as the App Store, Apple News and Stocks.

None of this takes technical skill, and users can tackle one part at a time. Limiting advertising identifiers removes one tool used to connect activity for advertising purposes, though it is not the only way companies can recognize a device. The FTC's enforcement actions and the Gravy Analytics breach show that location data can travel far beyond the app that collected it — and that the consequences can range from targeted scams to physical safety risks.

2Views

Author

Derek Weston

Sports Writer

Derek Weston covers public affairs, politics, business, culture and daily news for Core Memo. The role focuses on verification, context, and clear explanations for readers.

All articles by this author