Your Phone Knows You’re at the Doctor, and Data Brokers Do, Too — Then Profit From It

Chris McQueen finished treatment for leukemia a year and a half ago, but the ads for fake cures never stopped.

Juice cleanses to cure cancer, “natural” cancer treatments, clinics in Mexico promising full recovery with little chemotherapy — all appeared on McQueen’s mobile phone during routine oncologist visits and monthly bloodwork.

McQueen and others have taken to social media to vent about companies known as data brokers tracking their whereabouts via their smartphones’ location data, connecting it with other data gathered about them, and then drawing inferences about their health struggles to sell to companies hawking unproven treatments.

“It makes me feel sick to my stomach,” said McQueen, who lives in San Diego and fears some patients are putting themselves at risk, potentially fatally, if they try such untested treatments instead of following their oncologists’ advice.

More than 92% of patients in a 2022 American Medical Association survey said they believed their health data should not be available for purchase. But many people might not realize that when they are sitting in a hospital, an abortion clinic, or an Alcoholics Anonymous meeting in a church basement, the location data emitted from their mobile phones isn’t covered by the Health Insurance Portability and Accountability Act, better known as HIPAA, which protects patient privacy.

That worries Eric Ellsworth, director of health policy and innovation at the Center for the Study of Services, a nonprofit focused on delivering consumers reliable information on local medical services and healthcare professionals.

“Data brokers typically are just hoovering up data from the open web and then buying it from anybody,” he said.

The U.S. government has begun to penalize some companies that track Americans when they visit health facilities and places of worship. But privacy and legal experts don’t think actions against a few companies will stop an entire industry built on scooping up Americans’ private data. They’re calling on more states or Congress to ban advertisers from tracking Americans’ locations via their phones.

But progress has been fitful. California Gov. Gavin Newsom, a Democrat, on Sept. 27 vetoed a bill that would have blocked the sale and sharing of location and other sensitive personal data, saying it went “a step too far.” And a recent study from Stanford University showed that only 9% of data brokers are adhering to an existing California privacy law that gives consumers the right to delete their data, correct personal information, and learn what personal records the business is selling.

In January, Consumer Reports released model legislation giving state lawmakers a framework to ban or limit the sale of geolocation data, which uses GPS to identify a person’s movements in real time. Connecticut, Delaware, Maryland, New Jersey, Oregon, and Virginia have already banned the sale of precise geolocation data. But digital advertisers have also lobbied states to block such proposed limits.

The Money Behind Data Sales

Data brokers and advertisers argue that location data itself is not sensitive data, said F. Mario Trujillo, senior staff attorney at the Electronic Frontier Foundation, a nonprofit that champions user privacy. “But location data is sensitive. It’s the comprehensive collection of location data that reveals sensitive things.”

Advertising trade groups say that targeted advertising saves consumers time and lowers the cost of searching for products, while also allowing websites and apps to offer digital services without paywalls or subscriptions.

“A national privacy law should protect consumers from harmful or unexpected uses of data without preventing businesses from providing the services consumers request and expect,” said Jim Potter, executive director of 4As Health, a subsidiary of the American Association of Advertising Agencies. “That balance is especially important in advertising, which is not merely a business model but a key part of the modern economy.”

The U.S. government has begun to look into industry practices. In August, the Federal Trade Commission warned retailers about using private consumer data to increase prices.

In May, the agency also placed limits on a data broker that the agency began investigating in 2022. That settlement prohibits Idaho-based data broker Kochava and a subsidiary from “selling, sharing or disclosing sensitive location data without consumer consent” following allegations that the companies “sold location data from hundreds of millions of mobile devices” that could be used to trace the movements of people when they visited hospitals, churches, abortion clinics, and other sensitive locations.

Kochava did not respond to requests for comment.

While privacy advocates have welcomed the government actions, they pointed out that the terms of individual settlements don’t apply to other companies, because settlements aren’t laws or regulations.

Meanwhile, digital advertising has become a major source of profits for big tech companies, which often offer consumers services such as apps, email, and cloud storage in exchange for monetizing personal data. A 2024 report by Federal Reserve Bank of St. Louis economists on the economic implications of digital advertising showed that the profit margins for three of the four biggest tech firms — Google parent Alphabet, Facebook parent Meta, and Microsoft — were at least twice as large as the services sector average.

Other studies have shown that once data brokers build their collection systems, they face minimal additional costs to sell the same data repeatedly, including to AI companies. And their reach is wide: A 2019 study found that data brokers had data tied to more than 90% of Facebook accounts in the United States. And a 2020 report by the Electronic Frontier Foundation said Google shared sensitive user data — including geolocation, device IDs, identifying cookies, and browsing history — with potentially hundreds of digital advertising companies.

Neither Google nor Meta responded to requests for comment. Microsoft has supported a national privacy law in the U.S., similar to one in the European Union. Microsoft spokesperson Paige Fisher said the company “has long believed that people should not have to give up their privacy simply because they use modern technology.”

‘Pretty Big Attack Surface’

The San Diego-based Privacy Rights Clearinghouse and the Electronic Frontier Foundation identified 750 data brokers operating in the U.S. as of last year. But they said many have not registered with state governments and may not offer easy opt-out forms or the ability for people to check the accuracy of their files, as one can for a credit report.

“We’re seeing a lot of scary stories,” said Matt Schwartz, a policy analyst at Consumer Reports who focuses on privacy.

Consumer Reports reported in September that when it had volunteers look at files companies had built about them, the information was often riddled with errors. One person’s report “showed four different ages, listed him as both male and female, predicted three markedly different incomes, and listed his jobs as ‘farmer,’ ‘homemaker,’ and a ‘self-employed white collar’” though he was none of those.

The data brokers create marketing lists that categorize consumers based on location data collected from their devices, Schwartz said. That could include whether they have visited reproductive health facilities, taken part in protests, or supported a particular political party by attending a rally.

He’s also worried about the risk of data breaches.

“The fact that we have an entirely unregulated space where anyone can buy and sell this information means there are hundreds of data brokers that are collecting this information,” Schwartz said. “That’s a pretty big attack surface.”

Opting Out

One way companies are attempting to address privacy concerns is by asking internet users to “opt in” to sharing their geolocation and health data. But Schwartz said opt-ins often contain verbiage allowing for the unlimited use, sharing, and sale of consumers’ location and health data. He said it presents consumers with an awkward choice — opt in and share sensitive data, or be blocked from using the website or app.

The other problem is that even when sensitive locations are stripped from a customer’s profile, data brokers and advertisers can still track a person’s route right up to the boundary of a sensitive zone and pick it up immediately upon departure, making it easy to infer the destination, the Electronic Frontier Foundation said in an August policy paper.

“If you’re tracking an individual, you track them from their home to their work, and then you track them going to a medical facility,” EFF’s Trujillo said, describing the sensitive locations as essentially blackout windows on the map. “There would still be this assumption that you’re entering that medical facility.”

To increase privacy on mobile phones in the absence of federal laws, Trujillo recommends people limit which apps track their location data and disable ad tracking on their phones. It is also possible to turn off location data or put phones in airplane mode before heading to sensitive locations.

While policymakers debate new privacy laws, doctors such as Julien Cavanagh say they are left to fix the mess that targeted online ads for fake cures create for patients’ health. Cavanagh, a neurologist in Atlanta, said he now asks patients whether they are taking supplements bought online when they show up with unexplained neurological symptoms.

“Some of these sham treatments can be toxic, cause vitamin or micronutrient deficiencies, or counteract the action of their prescribed medications,” he said. “The targeted ads are very common and insensitive.”

How To Stop Your Phone From Tracking Your Location in Healthcare Settings

At least 20 states allow their residents to demand that data brokers delete their personal data, but typically consumers must file requests with individual data brokers. California has a centralized portal for requesting such opt-outs, at privacy.ca.gov/drop/. People also can change their mobile device settings to prevent tracking:

On an iPhone:

To turn off location tracking:

• Go to “Settings” and enter “Location” into the search bar.
• Click “Location Services.”
• To turn off location tracking completely, click the “Location Services” toggle switch at the top of the screen to the off position.
• Or, from the same “Location Services” screen, navigate through individual apps to turn off location access app by app.

(Screenshot by KFF Health News of iPhone 16 iOS 26.6.1)

(Screenshot by KFF Health News of iPhone 16 iOS 26.6.1)

To stop data brokers from tracking you:

• Go to “Privacy & Security,” then “Tracking.”
• Turn off “Allow Apps to Request to Track.”

(Screenshot by KFF Health News of iPhone 16 iOS 26.6.1)

(Screenshot by KFF Health News of iPhone 16 iOS 26.6.1)

On Android:

To turn off location tracking:

• Open the “Settings” app.
• Scroll down and tap “Location.”
• To turn off location tracking completely, toggle the switch next to the tab to the off position.
• Click the “Close” button if given the option to turn on location again.
• Or, from the same location settings screen, navigate through individual apps to turn off location access app by app.

(Screenshot by KFF Health News of Google Pixel Android 17)

(Screenshot by KFF Health News of Google Pixel Android 17)

(Screenshot by KFF Health News of Google Pixel Android 17)

To stop data brokers from tracking you:

• In your settings, navigate to the security and privacy tab.
• Scroll down and click on the privacy controls tab.
• Click “Ads.”
• Then tap “Delete advertising ID.”

(Screenshot by KFF Health News of Google Pixel Android 17)

(Screenshot by KFF Health News of Google Pixel Android 17)

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.This article first appeared on KFF Health News and is republished here under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.