Are Apps Selling Your Location? How to Stop It

Last checked: Oct 22, 2026. Based on FTC press releases and final orders issued in April and May 2024.

Maya downloads a free weather app. It asks for location access so it can show the local forecast. She taps Allow. What she doesn't know: the app's developer embedded a software library from a company called X-Mode Social, and that library sent Maya's precise location, every few minutes, to X-Mode's servers. X-Mode packaged that location data with millions of other people's movements and sold it.

The Federal Trade Commission announced orders against X-Mode Social (which later renamed itself Outlogic) and InMarket Media in January 2024, finalized in April 2024 for X-Mode and May 2024 for InMarket. X-Mode is banned from selling sensitive location data, and InMarket is banned from selling or licensing any precise location data (FTC). The orders came after the FTC found that both companies collected and sold location data that could track people to medical clinics, places of worship, and other sensitive locations, without adequate consent.

If you're wondering whether your apps are selling your location, the answer is probably yes unless you've already locked down your phone's settings. This guide explains how it works, what the FTC orders mean, and the steps you can take right now to stop it.

#Watch: How apps sell your location

This video walks through how location tracking works in free apps and what you can do about it.

#What X-Mode Social did, in plain language

X-Mode Social collected location data two ways:

1. From its own apps. X-Mode published apps like Drunk Mode (which claimed to help you avoid drunk texting) and Walk Against Humanity. When you installed one of these apps, you granted it location access. The app sent your location to X-Mode.

2. From SDKs in other apps. An SDK is a software development kit, a piece of code that app developers can plug into their apps. Developers often add SDKs for analytics, ads, or features they don't want to build themselves. X-Mode offered an SDK that many developers embedded in their apps. When you used one of those apps and it had location access, the X-Mode SDK collected your location and sent it to X-Mode's servers, even though you'd never heard of X-Mode.

X-Mode linked location data to your phone's advertising ID, the unique identifier your phone generates for ad tracking (called IDFA on iPhone and AAID on Android). That let X-Mode and its customers connect your location trail to other data tied to the same ID, such as which apps you use and which ads you've seen.

X-Mode then sold or licensed this location data. Customers included data brokers, advertising companies, and government contractors. The FTC's complaint notes that the data could reveal visits to sensitive places like medical clinics, addiction recovery centers, and places of worship.

#What the FTC ordered

The FTC's final orders against X-Mode Social (now Outlogic), finalized in April 2024, and InMarket Media, finalized in May 2024, include:

• X-Mode prohibition. X-Mode is banned from selling, licensing, or disclosing any location data related to sensitive locations, including medical facilities, places of worship, and shelters.

• InMarket prohibition. InMarket is banned from selling or licensing any precise location data.

• Deletion of previously collected data. X-Mode must delete or destroy all historical location data it collected, unless the data is covered by consent, has been deidentified, or is non-sensitive.

• Consent requirements going forward. If either company wants to collect location data in the future, it must obtain clear, affirmative consent that explains what data will be collected, how it will be used, and who it will be shared with.

The orders last 20 years.

The FTC sued Kochava in 2022.

#How location tracking works in apps

When you install an app and it asks for location access, you're making a choice about whether to let that specific app see where you are. But that choice doesn't control what happens next. If the app's developer embedded third-party SDKs, those SDKs can collect and send your location to companies you've never heard of.

The two types of tracking:

Many apps use both. The app shows you the weather or recipes or fitness tracking, and in the background, one or more SDKs are sending data to third parties.

Your advertising ID ties it together. Apps and SDKs use your phone's advertising ID to link your location data with your app usage, web browsing (if you're using an in-app browser), and ad interactions. That's how a data broker can build a profile that says "this person visited a medical clinic on Tuesday, browsed these websites on Wednesday, and uses these apps."

#Four steps to stop apps from tracking your location

These steps work on both iPhone and Android. Do all four for the best protection.

#Step 1: Review and restrict app location permissions

Go through your installed apps and set location access to While Using the App or Never for any app that doesn't absolutely need constant location access.

On iPhone:

• Open Settings > Privacy & Security > Location Services.
• Tap each app and choose Never, Ask Next Time, or While Using the App.
• Avoid Always unless you have a specific reason, like a navigation app you use for turn-by-turn directions.

On Android:

• Open Settings > Location > App location permissions (the exact path varies by Android version and manufacturer).
• Tap each app and choose Don't allow, Ask every time, or Allow only while using the app.
• Avoid Allow all the time.

#Step 2: Turn off Precise Location

Even when an app has location access, you can limit it to your approximate location instead of your exact coordinates.

On iPhone (iOS 14 and later):

• Open Settings > Privacy & Security > Location Services.
• Tap an app and turn off Precise Location.
• This gives the app a rough area (a few miles wide) instead of your exact GPS coordinates.

On Android (varies by version):

• When granting location permission, some Android versions let you choose Approximate instead of Precise.
• On newer versions, open Settings > Location > App location permissions, tap an app, and look for a Use precise location toggle you can turn off.

#Step 3: Limit ad tracking and delete your advertising ID

Your advertising ID is what links your location data to your app usage and browsing. Deleting it breaks that link.

On iPhone:

• Open Settings > Privacy & Security > Tracking.
• Turn off Allow Apps to Request to Track. This stops apps from accessing your IDFA.

On Android:

• Open Settings > Privacy > Ads.
• Tap Delete advertising ID. This removes your ID entirely.

Do this every few months on Android. Deleting your ID doesn't delete the data brokers already have, but it stops them from adding new activity to your old profile.

#Step 4: Delete apps you don't use

Every app on your phone is a potential data collection point. If you haven't opened an app in months, delete it.

Free apps with vague privacy policies and lots of permissions are higher risk. If an app asks for location, contacts, camera, and microphone, and you're not sure why it needs all that, that's a red flag.

#What about apps you need?

Some apps legitimately need location. Navigation apps like Google Maps or Waze don't work without it. Ride-sharing apps like Uber need your location to pick you up. Weather apps show better forecasts when they know where you are.

For these apps:

• Use While Using the App instead of Always.
• Turn off Precise Location if approximate location is enough. (A weather app works fine with approximate location.)
• Check the app's privacy policy to see if it shares location data with third parties. If it does, look for a setting to opt out, or consider switching to an app that doesn't share.

#The limits of these steps

These steps significantly reduce location tracking, but they don't eliminate it entirely.

• IP-based location. Even with location services off, apps and websites can estimate your location from your IP address. A VPN can mask this.

• Wi-Fi and Bluetooth scanning. Some apps scan nearby Wi-Fi networks and Bluetooth devices to estimate location, even when GPS is off. Android lets you disable Wi-Fi and Bluetooth scanning in Settings > Location > Location services > Wi-Fi scanning and Bluetooth scanning.

• Data brokers already have your history. Deleting your advertising ID and restricting location access stops new data collection, but it doesn't delete the location data that X-Mode, InMarket, and others collected before you changed your settings. The FTC orders require X-Mode to delete historical data unless it's covered by consent, deidentified, or non-sensitive, but other location data companies weren't part of those orders.

#Who else is doing this?

X-Mode and InMarket aren't the only companies selling location data. The FTC sued Kochava in 2022. Other location data brokers and ad tech companies continue to operate, and many haven't faced FTC action.

Apps that are free and ask for lots of permissions are more likely to use SDKs that collect and sell data. That's often how they make money.

#What the law says (as of October 2026)

The legal landscape is shifting:

• Federal: The FTC has been using its authority under Section 5 of the FTC Act, which prohibits unfair or deceptive practices, to take action against companies selling sensitive location data. The FTC considers it unfair when companies collect and sell location data tied to sensitive places without meaningful consent.

• State laws: California's CCPA, Virginia's CDPA, and similar laws in Colorado, Connecticut, and other states give residents the right to opt out of the sale of their personal information, including location data. California's Delete Act (DROP) requires data brokers to process deletion requests.

• Sensitive location data is the focus. The FTC orders specifically target location data tied to medical facilities, places of worship, and other sensitive locations, but the FTC has said that all precise location data can be sensitive depending on context.

No comprehensive federal privacy law covers location data yet, but the FTC's enforcement actions show the agency is treating this as a priority.

#The bigger picture: location data and data brokers

Location data is one part of the broader data broker ecosystem. The same companies that buy and sell your location might also have your name, address, phone number, email, and browsing history, often linked together through your advertising ID or other identifiers.

If you're working on removing your personal information from data brokers, adding these location-privacy steps makes your broader privacy effort more effective. Once you've opted out of people-search sites and cleaned up your Google results, limiting new location data collection keeps your profile from refilling.

Our main guide, how to remove your personal information from the internet, covers the full process.

#The four-step routine (a realistic plan)

1. Today: Go through your phone's app list. Set every app that doesn't need constant location access to While Using or Never. Turn off Precise Location where you can. On Android, delete your advertising ID.

2. Every few months: On Android, delete your advertising ID again. Review your app permissions to see if any apps have regained access you didn't intend to give.

3. When you install a new app: Check what permissions it asks for. If it wants location and you're not sure why, say no. You can always grant it later if the app doesn't work.

4. If you're on Android: Disable Wi-Fi and Bluetooth scanning if you don't need indoor location features.

These steps take about 15 minutes the first time and a few minutes for each check-in. That's the realistic routine. The goal isn't perfection. The goal is to make it harder for data brokers to track you without your knowledge.

#Sources

1. Federal Trade Commission, "FTC Finalizes Order with X-Mode and Successor Outlogic Prohibiting it from Sharing or Selling Sensitive Location Data" (April 12, 2024). https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-order-x-mode-successor-outlogic-prohibiting-it-sharing-or-selling-sensitive-location

2. Federal Trade Commission, "FTC Finalizes Order with InMarket Prohibiting It from Selling or Sharing Precise Location Data" (May 1, 2024). https://www.ftc.gov/news-events/news/press-releases/2024/05/ftc-finalizes-order-inmarket-prohibiting-it-selling-or-sharing-precise-location-data

3. Federal Trade Commission, Cases and Proceedings, In the Matter of X-Mode Social, Inc. https://www.ftc.gov/legal-library/browse/cases-proceedings/2123038-x-mode-social-inc

---

UndoLeak erases your data from data brokers and keeps it off. Location data is one piece. We handle the rest: people-search sites, Google results, leaked photos, and ongoing monitoring so your information stays private.