X-Mode and Outlogic: The FTC's Location Data Order

Your phone can record where you worship, get care and go to meetings. This FTC order explains why selling that data is now restricted for one broker.

By Siddharth ShankarUpdated October 11, 2026

Most people know that apps ask for location access. Fewer know that location data can be sold onward to brokers and then to buyers the user never heard of. A 2024 FTC order shows what regulators consider unacceptable.

What happened

The FTC finalized an order against X-Mode Social and its successor company Outlogic. The agency's statement says the company "sold precise location data that could be used to track people's visits to sensitive locations," such as medical and reproductive health clinics and places of worship. It also says the company failed until May 2023 to remove sensitive locations from the raw location data it sold, and did not implement reasonable safeguards against downstream use of that data. The Commission voted 3-0-2 for final approval.

What the order requires

The FTC lists several requirements. The company must not sell or share sensitive location data, must keep a list of sensitive locations and must delete previously collected data unless it has consent. It must set up a supplier assessment program, build procedures to prevent linking data to locations that serve LGBTQ+ people or to protest sites, and keep a privacy program with a data retention schedule.

How location data reaches brokers

A phone records location through GPS, Wi-Fi and nearby signals. Apps with permission can pass that to partners through software kits. The FTC order describes a broker that bought and sold this data. The detail "downstream use" means the broker lost track of what buyers did with it.

Location data is personal even without a name. A repeated pattern, such as a device that sleeps in one place and visits a clinic every week, can often be linked to a person. The FTC order treats sensitive-place visits as a category that needs special care.

What was exposed

The exposure was not a breach. It was a lawful-looking market for precise location signals. The data included visits to places that can reveal health, religion or personal life. The order does not say how many people were affected, and we do not estimate it.

How it ended

The order is a rule on the company, not a payout for individuals. The FTC page says nothing about money paid to consumers or a civil penalty. That makes this an unhappy ending for anyone looking for compensation, although the restrictions are meaningful for future sales.

Why this case matters

The order draws a line between location data in general and location data that reveals sensitive facts about a person. A visit to a clinic or a place of worship says something about health or belief, whatever name is attached to the device. The FTC's approach treats those places as needing special care.

For ordinary users, the case shows that a permission you give to one app can feed a chain of buyers. Consent at the first step does not guarantee that you know where the data ends up.

Key facts at a glance

• Company: X-Mode Social and successor Outlogic
• Order finalized: April 2024
• Core finding: sold precise location data that could reveal sensitive visits
• Gap: until May 2023, it did not remove sensitive locations from raw data
• Vote: 3-0-2
• Penalty: none stated on the FTC page

How to limit location tracking

What the page does not say

The FTC page does not state how many people were affected or how long the practice ran beyond the May 2023 date. We have not added figures from other sources.

Nothing here can be undone for the people involved, but you can prepare. See the guides on why data brokers hold your information, how to opt out of data brokers yourself and what strangers can find about you online. You can also try our free find personal information exposed online.