Leaked dataset from a location data company with a log of the movements of 12M+ Americans shows how “anonymous” location data can be used to track people
and it's not hard to figure out who you are Whitney Kimball / Gizmodo : Holy Shit, Reportedly Jerry Hildenbrand / Android Central : Your phone tracks your every move and there is nothing you can do about it Colin Barry / KnowTechie : The largest surveillance project in United States history is now public Paul Wagenseil / Tom's Guide : Your phone is tracking your location: Here's how to stop it Asif Shaik / iPhone Hacks : Here Is How Easy It Was to Track Location of 12 Million Smartphone Users via Leaked Data Mike Dano / Light Reading : Report Blows Holes in Anonymized Location Privacy Claims Todd Haselton / CNBC : How to stop your iPhone from tracking your location Ben Lovejoy / 9to5Mac : You could be in this ‘zero privacy’ location-tracking database of 12M phones Msmash / Slashdot : An Investigation Into the Smartphone Tracking Industry Tweets: Stuart A. Thompson / @stuartathompson : When we first started working with the data, we wanted to see if any sensitive sites were included. I zoomed into the Pentagon and saw this. Our jaws hit the floor. Full piece: http://nytimes.com/tracked pic.twitter.com/0GB3KnhQcR Charlie Warzel / @cwarzel : Today @stuartathompson and I pubbed the 1st in a series on location tracking. Based off more than 50 billion location pings we obtained covering 12 million phones. It's the culmination of months of reporting. We'll be publishing 7 stories in all this week. https://www.nytimes.com/... Stuart A. Thompson / @stuartathompson : Months ago, someone contacted us with an astounding dataset. It tracked the precise movements of more than 12 million Americans in several major cities including Washington, New York and San Francisco. Today we published our findings: https://www.nytimes.com/... Lea Kissner / @leakissner : The companies you should worry most about with regards to your privacy probably aren't the ones you're thinking of. They're the ones who siphon data off the sides where you don't see it and can't control it: trackers, ISPs, data brokers. 🧵🧵🧵 https://twitter.com/... Steve Sailer / @steve_sailer : Can you use your database to figure out who murdered Seth Rich at 4:20 am on July 10, 2016 on the southwest corner of Flagler Place and W Street Northwest in Washington DC? Seth Rich seemed like a good guy. I'd like to see him finally get some justice. https://twitter.com/... Zach Gage / @helvetica : really incredible article about how your movements are all being tracked/sold by private companies (the latest ios update makes some changes to limit this kind of always-on surveillance, but i've definitely messed this up. Pokemon Go and Dark Sky both have years of my movements) https://twitter.com/... Joanna Stern / @joannastern : To me, this great reporting has one only hope: to help convince lawmakers that we need more rules and protections. I point to this quote from Jaron Lainer in my smartphone of the decade essay: https://www.wsj.com/... pic.twitter.com/s0ywuK8YdQ Benedict Evans / @benedictevans : Among other things, stories like this are an argument for platform owners exerting (even) more control over what developers and publishers are allowed to do, and doing more aggressive curation of the app stores https://twitter.com/... Dare Obasanjo / @carnage4life : Yesterday I saw a US lawmaker claiming that figuring out location from your IP address is a nefarious privacy violation if a big tech company does it. In reality, no name companies are buying & selling your real-time location data from apps & carriers. https://www.nytimes.com/... Matt Stoller / @matthewstoller : This is excellent reporting. We don't know enough about the industry to make coherent rules. It's time to stop debating the current list of privacy bills by @brianschatz, @SenMarkey, @SenatorCantwell, etc and INVESTIGATE. Diagnose, then proscribe. https://twitter.com/... Hamza Shaban / @hshaban : wondering if this insane story, like Motherboard's story before it, about bounty hunters buying up phone location data, will, like, actually lead the FCC to do anything meaningful about it https://twitter.com/... Tom Gara / @tomgara : The reporting here is fantastic, I finished it and immediately went to the location settings on my iPhone and turned them off for every app except Google Maps (I have made the tactical choice for Google to be my primary data panopticon) https://www.nytimes.com/... Joanna Stern / @joannastern : How many people will say: “I don't care if some company knows that I go to work”? Or that “I went food to Whole Foods last night”? Joanna Stern / @joannastern : My biggest worry after reading this great piece by @cwarzel and @stuartathompson? That people simply don't care enough to understand the larger implications of this sort of tracking. https://www.nytimes.com/... Joshua Stevens / @jscarto : Reminds me of that time, in 2011, @kirkgoldsberry found locational breadcrumbs in iPhone backup files: https://phys.org/... This sort of tracking is troubling. That it happens on such a wide scale, and has been happening for so long, is astounding. https://twitter.com/... Kashmir Hill / @kashhill : @nytimes @PrivacyProject He works in the tech industry which increasingly determines what our privacy looks like. He works on drones that will be doing massive data collection as they zip around. And he's like, “meh,” about ability to track his every move & perceive that he's interviewing w/a competitor. Tom Warren / @tomwarren : interesting look at smartphone tracking data from The NY Times 👏It really is alarming how much data we generate every second, and just how well it's tracked by lots of companies https://twitter.com/... Bryan William Jones / @bwjones : An excellent article that demonstrates how important privacy can be, and reveals just how much information can be gleaned from tracking phone records, establishing your identity and documenting your life. There is real danger here with info that is already being exploited... https://twitter.com/... Lauren Goode / @laurengoode : What stands out is not the fact that our smartphones and smartphone apps are collecting our location data - that we knew - but that protections around anonymity crumble once data sets are cross-referenced or combined https://twitter.com/... Robert Caruso / @robertcaruso : “This data reveals your kid's exact route to school and where you spent the night, or potentially even whom you spent the night with.” Correct! https://twitter.com/... Peter A. Shulman / @pashulman : WOW. “We followed military officials with security clearances as they drove home at night. We tracked law enforcement officers as they took their kids to school. We watched high-powered lawyers (and their guests) as they traveled from private jets to vacation properties.” https://twitter.com/... James Joyner / @drjjoyner : “[C]itizens would surely rise up in outrage if the government attempted to mandate that every person above the age of 12 carry a tracking device that revealed their location 24 hours a day. Yet ... Americans have ... consented to just such a system run by private companies.” https://twitter.com/... Justin Wolfers / @justinwolfers : It's not often you read a piece of journalism (indeed, data journalism!) that you know will turn an industry on its head and spark a new legislative agenda, but this is one of those it'll-change-the-world pieces. https://twitter.com/... Mira Kamdar / @mirakamdar : This article is a must-read. There's a handy link to reduce how trackable you are on your phone. I just did. https://twitter.com/... Jonathan Zittrain / @zittrain : A data leak powers a great piece by @stuartathompson and @cwarzel on the personal location data free-for-all. Another reason for brokers to be information fiduciaries. Meanwhile, self-styled privacy champion Apple could tweak iOS to default to city-level location sharing only. https://twitter.com/... Stuart A. Thompson / @stuartathompson : The data included more than 50 billion rows of data. That's 50 billion places people have been. Shops, workplaces, homes, hotels. All laid out in intricate detail, tied to an ID that let us follow individual paths. Kashmir Hill / @kashhill : @nytimes @PrivacyProject Of course, a former Microsoft engineer who now works at Amazon, whose interview w/ a competitor was detectable in the location data, isn't that worried about widespread stalking of people's movements through phones. https://twitter.com/... Kashmir Hill / @kashhill : Last December, @nytimes did an amazing story on how your location gets tracked by phone apps & sold: https://www.nytimes.com/.... Now, @PrivacyProject revisits the topic, w/a huge dataset of those locations & interviews with the people tracked: https://www.nytimes.com/... Wolfie Christl / @wolfiechristl : “Every minute of every day, everywhere on the planet, dozens of companies ...are logging the movements of tens of millions of people with mobile phones” The NYT obtained a file containing 50 billion location records from 12 million phones. Massive piece: https://www.nytimes.com/... https://twitter.com/... John Battelle / @johnbattelle : Apple/Google et al claim to be privacy driven companies, yet take no resp. for the externalities of their core platform. This report is chilling, but in no way a surprise. https://www.nytimes.com/... https://twitter.com/... Charlie Warzel / @cwarzel : @nytopinion Here is what was in the data: More than 50 billion location pings from the phones of more than 12 million Americans, across several major cities. @stuartathompson and I then spent months reporting on how we are all tracked through apps on our phones. https://www.nytimes.com/...
Context & Ripple Effects
This is the payoff of a year of reporting on the location data supply chain: after the NYT showed in 2018 how apps share precise location with 75+ companies up to thousands of times a day, it obtained an actual dataset from one location data firm — over 50 billion pings from 12 million phones across major cities in 2016–2017 — and demonstrated that "anonymous" is a fiction.
The demonstration was concrete enough to be alarming: within days, reporters had identified a Secret Service agent, his home address and family details from the same data, and a later unclassified memo revealed the [[a:962359|Defense Intelligence Agency buying commercial location databases to track Americans without warrants]]. The story reframes the $12B location data industry not as marketing infrastructure but as de facto surveillance available to anyone who pays.
First-order effects
- The named location data company faces immediate exposure of its core product claim — its dataset, sold as anonymized, let outsiders re-identify individuals including a serving Secret Service agent.
- App users whose phones generated the pings learn their movements were logged and resold across the collector-aggregator-marketplace chain documented in the industry reporting.
Second-order effects
- App developers embedding location SDKs face pressure from platforms and users to justify data sharing, since the leak shows where their SDK partners' data ends up.
- Buyers downstream of aggregators — advertisers, retailers, hedge funds per the earlier NYT supply-chain reporting — risk being associated with surveillance-grade data, forcing them to weigh reputational cost against targeting value.
Third-order effects
- If anonymized location data can be trivially re-identified, the regulatory case for treating it as personal data strengthens, threatening the consent-based legal foundation of the $12B industry.
- Government agencies' warrant-free use of commercial databases, already visible in the DIA memo, points toward Congress having to decide whether purchased location data is a loophole around Fourth Amendment protections.
The trend: Commercial location tracking is moving from an opaque advertising supply chain to a contested public issue, as each leak and government-use revelation collapses the anonymization defense the industry runs on.