Mobile location data and the files data brokers keep on you

On 16 September the news outlet The Markup and the consumer organisation Consumer Reports published what volunteers received when they used new privacy laws in several US states to request their files from data brokers, companies that collect and resell personal data. The files cover US residents. Each typically contained names, addresses and Social Security numbers, plus more than a thousand guesses about the person's traits and habits. The same month, the press freedom organisation Freedom of the Press Foundation (FPF) set out two phone settings, usable outside the US too, that reduce the location data a phone gives away.

Acxiom, a data broker based in Arkansas, claims data on billions of people worldwide, including profiles on roughly 95% of US adults. In the files the reporters reviewed, it made predictions in more than 3,000 categories, from the ages and genders of people's children to their estimated "alcohol usage". Relatively new laws in states including Minnesota and Oregon require companies to disclose who ultimately bought the data, and the Acxiom files listed more than 100 buyers, among them insurers, banks, drug makers, General Motors and Disney.

Brokers can hold a phone's advertising ID, a smart TV's tracking identifier, a home IP address and a car's vehicle identification number (VIN). A researcher quoted in the report said location data might reveal visits to a military base, a school or a medical specialist.

Perspective

The Markup reports that opting out of one broker removes your data from that broker only, not from the copies already sold to others. A request to see what a company holds has the same limit, covering one company at a time. Several places in Asia grant that right.

Taiwan's Personal Data Protection Act lets people ask an organisation to answer inquiries, allow review or provide copies of their data (Article 10). A decision is due within 15 days, extendable by up to 15 more (Article 13), and a fee for necessary costs is allowed (Article 14). In Hong Kong, section 18 of the Personal Data (Privacy) Ordinance lets individuals ask a data user, meaning an organisation that holds their data, for a copy, and section 19 requires compliance within 40 days. Section 21 of Singapore's Personal Data Protection Act requires organisations, on request, to provide the personal data they hold and information about how it has been or may have been used or disclosed within the year before the request.

According to FPF, ad-based location tracking often runs through real-time bidding and software development kits (SDKs) embedded in apps, and a substantial amount of it is tied back to individual devices through advertising IDs. FPF also notes that after reports earlier in 2026 that troops had been targeted using commercial location data, Pentagon officials told Reuters and members of Congress that ad-based location tracking on troops' phones and computers had been disabled.

FPF's first step is to keep apps from reading the advertising ID. On iPhone, go to Settings > Privacy & Security > Tracking and turn off "Allow Apps to Request to Track". According to Apple's support page, apps then cannot access the advertising identifier (IDFA), and apps keep their full capabilities. On Android, the path on Google's Privacy & Terms page is Settings > Privacy > Ads > "Delete advertising ID"; on phones with another menu layout, Ads sits under Security & privacy > Privacy > Privacy controls.

The second step is to switch off location access for every app that does not need it, keeping it for something like a maps app, and to turn it back on when needed. On iPhone that is under Privacy & Security > Location Services; on Android, under Security & Privacy > Privacy > Permission manager > Location. Both steps take a few minutes. The tracking setting requires iOS 14.5 or later, the Android advertising ID is provided by Google Play services, and as of 29 September both companies' help pages were available in English and Chinese.