Gravy Analytics was a location-data broker (Gravy Analytics, Inc., with a subsidiary Venntel) that merged into Unacast in December 2023; gravyanalytics.com now redirects to unacast.com, and Unacast's own site states the merger 'expand[ed] its product line and add[ed] global data coverage.' Under Unacast's current privacy policy, location data is sourced from third-party app SDKs, WiFi routers and Bluetooth beacons, combined with company-created 'geo-fences' around venues to infer visited locations and build audience 'personas,' and the policy explicitly states the company has sold categories of personal information — including Precise Geolocation Data, Identifiers, and Inferences — 'in order to monetize our services.' On January 14, 2025, the FTC finalized an order against Gravy Analytics and Venntel prohibiting them from selling, disclosing, or using sensitive location data (tied to healthcare facilities, places of worship, and similar sensitive categories) except for national-security or law-enforcement purposes, following a complaint that they sold such data without verifiable consent. Separately, in January 2025 Gravy Analytics disclosed (via a statement to press) an ongoing security-breach investigation after hackers claimed to have exfiltrated a large trove of historical location data.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-01-14]
The FTC finalized an order on January 14, 2025 prohibiting Gravy Analytics and its subsidiary Venntel from selling, disclosing, or using sensitive location data (e.g., data about visits to healthcare facilities and places of worship), following a complaint alleging the companies unfairly sold sensitive consumer location data and collected/used it without obtaining verifiable user consent; the order requires the companies to establish a sensitive-location-data compliance program.
Unacast's privacy policy (covering the Gravy Analytics business, now merged into Unacast) states that location data is received from third-party partners — app owners or data aggregators who primarily receive it from SDKs embedded in mobile apps, and that partners may also supply data from WiFi routers and Bluetooth beacons.
Unacast's own company-history page states that in December 2023, 'Unacast merges with Gravy Analytics, expanding its product line and adding global data coverage,' confirming Gravy Analytics is now part of Unacast; Gravy Analytics' own domain (gravyanalytics.com) redirects to unacast.com.
Unacast's privacy policy explicitly states that in the preceding twelve months it has sold categories of personal information — including Identifiers, Precise Geolocation Data, Internet or Network Activity, Demographic Data, and Inferences — 'in order to monetize our services,' a direct sale disclosure rather than a mere CCPA opt-out right statement.
In January 2025, following reports that hackers claimed to have exfiltrated a large trove of historical location data from Gravy Analytics, the company sent a statement from a Gravy Analytics email account to TechCrunch acknowledging the breach and stating its investigation was ongoing.
The FTC finalized an order on January 14, 2025 prohibiting Gravy Analytics and its subsidiary Venntel from selling, disclosing, or using sensitive location data (e.g., data about visits to healthcare facilities and places of worship), following a complaint alleging the companies unfairly sold sensitive consumer location data and collected/used it without obtaining verifiable user consent; the order requires the companies to establish a sensitive-location-data compliance program.
The same privacy policy states the company creates 'geo-fences' — virtual boundaries around locations of interest such as shopping centers, restaurants, and events — and combines received Location Data with these geo-fences and other collected venue information to infer the types of activities or events device users engage in.