An investigation exposes data brokers using ads to help track almost any phone

An investigation conducted by a data privacy group has revealed a vast tracking network that can follow the movements of a person’s phone, according to reports from 404 Media and Krebs on Security. The people-tracking service, called Locate X, reportedly lets users follow a device using its mobile advertising identifier, a unique number assigned to phones.

The New Jersey-based Atlas Data Privacy Corp, which aims to help people remove their personal information from data brokers, found that the software is capable of showing the whereabouts of mobile phones on a map, allowing anyone with access to track someone’s precise location across state lines, according to 404 Media. The information could then be used to figure out a specific phone owner’s identity.

A screen recording of the software viewed by 404 Media and other media outlets showed a cluster of hundreds of mobile phones — represented by red dots on a map — over an abortion clinic. The software was then shown tracing a specific device as it went from place to place: going from a home in Alabama, to a Lowe’s, a church, and then to a Florida abortion clinic.

The tool relies on the mobile advertising ID that Google and Apple assign to each phone to serve users targeted ads. Advertisers can then build a growing profile of information around that ID based on where it accesses services that deliver ads. That can also creates a network of locations that data brokers like Babel Street, which makes Locate X, can use to create tracking tools.

Atlas hired a private investigator to contact Babel Street. While under the guise of a prospective customer, the investigator said they were interested in purchasing information about home addresses in New Jersey, 404 Media reports. A Babel Street salesperson reportedly brought up Locate X, but said it’s only available to government officials or contractors. When the investigator said they were thinking about getting into government work, the salesperson said “that’s good enough” and “they don’t actually check,” as reported by 404 Media.