In February 2016, Clear Channel Outdoor launched a product called RADAR. The pitch was simple: the company's tens of thousands of American billboards would now map the "real-world habits and behaviors" of the people walking and driving past them, using mobile location data pulled from cellphones. A company spokesman insisted the data was "anonymous and aggregated," a "one-to-many, not one-to-one" view of the public (1).

Jeffrey Chester of the Center for Digital Democracy saw it differently. "It is incredibly creepy," he told NPR at the time. "People have no idea that they're being tracked and targeted" (1).

Ten years later, the out-of-home advertising industry still leans on the same two words: anonymous and aggregated. The documented record shows why that framing keeps failing. The same mobile location streams that measure a billboard audience are bought, resold, geofenced, and handed to federal agencies without a warrant. The billboard is not one-way anymore.

The Billboard That Reads the Crowd

RADAR was not a camera. It was a data partnership. Clear Channel wired together AT&T Data Patterns (location records from AT&T subscribers), PlaceIQ (location collected through other apps), and Placed (a firm that paid consumers to be tracked so it could link ad exposure to in-store visits). Launched across the top eleven US markets, including Los Angeles and New York, RADAR turned the ordinary drive past a billboard into a measurable, sellable event (1).

That was the measurement layer. The screen layer was watching too.

In October 2017, the rebuilt Piccadilly Lights in London went live with hidden cameras and recognition technology that analyzed the foot and road traffic in front of it. Ad content was "influenced by the characteristics of the crowd around it": gender, age group, even detected emotion. The system could respond to passing cars. The operator, Landsec, said no personal details were collected or stored (2).

Piccadilly was the polished version of something older. In 2013, Tesco installed Amscreen face-scanning cameras at all 450 of its UK petrol stations to detect a customer's gender and approximate age and serve tailored ads at the till. The Amscreen chief executive compared it to the film Minority Report. Tesco's defense was the same as every defense since: "No data or images are collected or stored" (3).

Today the camera layer is a commodity. Quividi's VidiReports software runs computer vision on "any standard webcam pointed at an audience," counts exactly how many people looked at a screen, and estimates mood, demographics, and dwell time, then pushes it all to a cloud data platform (4).

None of this is a secret. It is the selling point.

The Measurement Cartel and Its Location Currency

The American billboard industry has its own ratings bureau, and it now runs on location. Geopath describes itself as "the OOH industry standard" for "state-of-the-art audience location measurement, insights, and market research innovation" (5). The currency that lets advertisers buy a billboard audience is, by Geopath's own account in industry coverage, built on mobile device and connected-car location data.

That is the pivot the industry does not advertise. A billboard audience used to be a count of cars and pedestrians. Now it is a location dataset. Once a dataset exists, it is an asset. And once it is an asset, it moves.

The entire American framework for what can happen to that asset is self-regulation. The Digital Advertising Alliance's principles, dating from its 2009 OBA Principles through its 2013 Mobile Guidance on precise location and its 2017 Cross-Device Guidance, are voluntary. There is no statute behind them (6). The trade has a name, surveillance capitalism, which describes collecting what people do in private and selling predictions about what they will do next. This is surveillance capitalism unfolding while virtually no one is paying attention and just glued to their phones.

What "anonymous and aggregated" actually buys is the problem the industry will not sit with.

What $160 Buys at a Data Broker

In May 2022, a reporter at Motherboard bought something. For just over $160, he purchased a week's worth of location data covering more than 600 Planned Parenthood locations, from a broker called SafeGraph. The data classified Planned Parenthood as a trackable "brand," showed where visitors came from (inferred from where their phones rested at night, down to the census block), how long they stayed, and where they went after.

Some of those records held only four or five devices. A group that small cannot stay anonymous. Once you can see where those phones sit at night and how they move during the day, matching a device to a real person is straightforward (7).

SafeGraph's pitch to developers was that this exhaust data cost "$1-$4 per user per year," harvested through SDKs. Google had banned SafeGraph from the Play Store a year earlier. The CDC had bought $420,000 of SafeGraph data, as reported in 2022. SafeGraph stopped selling the Planned Parenthood dataset only after the story ran (7).

The dollar figure isn't the point. The industry calls this data "aggregated," a word meant to sound like headcounts with nobody in them. What that reporter bought was a week of clinic visits for $160, specific enough to point at individual people. If the data were truly aggregated, that purchase would not have been possible. The data that billboards and their measurement vendors describe as "aggregated" is precisely the data that lets a stranger buy a list of clinic visitors.

The Real-Time Bidding Leak

The data does not even need a willing app developer to leak. It falls out of the ad auctions themselves.

In December 2024, the FTC settled with two location brokers, Mobilewalla and Gravy Analytics (with its government-facing subsidiary Venntel). The documented facts are the smoking gun of the programmatic chain. Mobilewalla collected precise location and advertising IDs (the serial number a phone broadcasts to every app on it) from real-time bidding auctions, even when it lost the bid, and resold that raw data. The FTC banned the practice, marking the first time real-time bidding data retention was treated as an unfair practice (9).

Gravy Analytics used geofencing to "identify and sell lists of consumers who attended certain events related to medical conditions and places of worship," advertising precision down to about one meter. Both companies were ordered to delete the sensitive location data they had already collected. The FTC's stated position was blunt: location data is sensitive data, full stop (9).

That December action was not the first stop, and it was not the last. It sat in the middle of a line that runs cleanly through the decade.

Four FTC Actions, One Broken Market

The FTC's first-ever settlement with a data broker over sensitive location data came in January 2024, against X-Mode, which had renamed itself Outlogic. X-Mode had harvested location from apps including Muslim Pro, which had 98 million downloads. Some of its clients were US military contractors. Apple and Google both banned X-Mode's SDK from their app stores. The FTC barred the company from selling location data tied to places of worship, reproductive health clinics, and domestic abuse shelters (8).

FTC Chair Lina Khan put the principle plainly: businesses do not have free license to market and sell Americans' sensitive location data (8).

In December 2024 came Mobilewalla and Gravy Analytics (9). Then, in May 2026, the FTC announced a settlement banning Kochava and its subsidiary Collective Data Solutions from selling sensitive location data without affirmative express consent. Kochava had sold precise geolocation, accurate to about ten meters, from hundreds of millions of devices, revealing visits to houses of worship and health clinics, plus yearly incomes, device IDs, and app usage (10).

The Kochava case shows both the reach and the ceiling of enforcement. The FTC first sued in August 2022. The order, finalized in June 2026, carried no fine. Four years, four settlements, and not one dollar of penalty on the Kochava order. If this is the FTC's enforcement line, it is a speed bump across a highway (10).

The Government Is a Customer

Here is where the billboard-adjacent data pipeline stops being an advertising story and becomes a surveillance story. The federal government buys this data.

The Electronic Frontier Foundation mapped the chain in detail: SDK "cash-for-data" deals, bidstream skimming, and a set of government-facing brokers. Venntel, Gravy Analytics' subsidiary, counts the IRS, DHS, ICE, CBP, the DEA and the FBI among its clients. DHS alone paid at least $2 million. A bulk feed called "Geographic Marketing Data, Western Hemisphere" ran $650,000 a year and was delivered daily through an S3 bucket (11).

The other brokers are no less striking. Babel Street's Locate X served the Secret Service, SOCOM, CBP and ICE, and its terms of use banned mentioning the product in legal proceedings. Anomaly 6, used by SOCOM, was demonstrated tracking 183 devices that had visited NSA and CIA headquarters (11).

A Norwegian GDPR request traced one phone's data through the full chain: apps called Funny Weather and Sygic, into a firm called Predicio, then to Gravy Analytics, then to Venntel. Venntel claims to draw data from more than 80,000 apps (11).

The legal frame is the part that should stop a reader cold. In Carpenter v. United States (2018), the Supreme Court held that the government needs a warrant for cell-site location records. But courts have not yet ruled on whether the government can simply buy the same data from a broker and skip the warrant. EFF's argument is that the Fourth Amendment should not be for sale (11).

The activity has only accelerated. In March 2026, NPR reported that data collected for ad targeting "also sells that data, including bulk cell phone location data, to police departments and federal government agencies in ways that can reveal intimate details about Americans without a warrant." At a Senate hearing that month, the FBI director declined to commit to stopping the purchase of Americans' location data. ICE held a contract with Penlink for a tool called Webloc, which tracks phone movements and finds phones that visited specific places (12).

And in January 2026, ICE went further. It posted a formal Request for Information on the federal contracting site asking data and ad-tech brokers what "Ad Tech compliant and location data services" they could offer federal investigators: personal, financial, location, and health data (13).

Tom Bowman of the Center for Democracy and Technology called it what it was: an attempt "to rebrand surveillance as a commercial transaction." Ad tech compliance regimes, he noted, were never designed to protect people from government surveillance (13).

We covered the police-run license plate cameras in a separate piece. This is the advertising industry's version of the same transaction.

Where Geofencing Leads

The most direct ancestor of all of this is the geofence, and it has a name: Copley Advertising.

In spring 2015, a Christian organization hired Copley to serve anti-abortion ads, "You Have Choices" and "Pregnancy Help," to the phones of "abortion-minded women" sitting in clinic waiting rooms. The geofences covered reproductive health centers and methadone clinics in Columbus, New York City, Pittsburgh, Richmond and St. Louis, and the ads followed those phones for up to 30 days (16).

Massachusetts Attorney General Maura Healey settled the case in April 2017, barring Copley from geofencing Massachusetts healthcare facilities to infer health status. Her words framed the risk precisely: geofencing "has the potential to digitally harass people and interfere with health privacy" (16).

That single case is now the template for state law. Washington's My Health My Data Act and Nevada's SB 370 both restrict the use of geofencing to collect information from, or target content to, people entering healthcare facilities. Washington added a private right of action. The states had to write these bans because federal law does not do the job (15).

America's Regulation Gap Is the Story

Measure the American regime against what it actually is. On one side: a voluntary self-regulatory framework whose core principles date to 2009 and 2017 (6). On the other: a patchwork of recent FTC consent orders, most of them carrying no fine, and state laws that had to step in because Congress has not (8, 9, 10, 15, 17).

California is the strongest American pillar. Under CCPA as amended by CPRA, precise geolocation is "sensitive personal information," and consumers hold a right to limit its use and disclosure. The law covers data brokers and includes a right to opt out of sale and sharing (17). But even California's law is opt-out by design. The default is still collection.

Compare the European default. Under GDPR, the Norwegian data authority fined Grindr NOK 65 million, roughly EUR 6.5 million, the largest fine in the country's history, for disclosing users' GPS location, IP address, ad ID, age, gender, and the fact of being a Grindr user to third parties for behavioral advertising without valid consent. The Privacy Appeals Board upheld the decision in 2023: the consent was "neither voluntary, specific nor informed." The regulator warned that business models built on behavioral advertising should expect dissuasive fines (14).

The billboard is not the surprising part of this story. The gap between what Europe requires and what the United States allows is where the harm lives. Under one regime the same behavior brings a record fine. Under the other it brings consent orders with no fine attached. The United States has no federal privacy law, no warrant requirement for purchased location data, and an enforcement record measured in consent orders without fines. The European Union fines the same behavior. The American states ban geofencing around clinics because Washington will not.

What Actually Changes Hands

Everything above describes one transaction. It is worth saying plainly what is bought and sold.

Take that advertising ID. When you install an app, it asks for location access, usually to do something you want: a weather forecast, a store finder, a coupon. Grant it and the app stamps the ID, the time and your coordinates every few minutes. A broker buys those feeds from thousands of apps at once, so the same ID turns up across all of them, and a pile of pings becomes a profile.

The profile is not anonymous in any sense a person would recognize. It has a home, taken from wherever the ID rests each night. It has a workplace, taken from where it sits on weekday afternoons. It has a route between the two. It has a history of the businesses you walked into, and how long you stayed, the same method SafeGraph used to label a clinic visit as a visit to a "brand" (7). It carries an income band and a list of the apps you run, both standard contents of a broker feed in the FTC's Kochava order (10). None of that requires your name, only that something you carry keeps broadcasting and that enough buyers compare notes.

Put the billboard in the middle of that. The industry's version stops at the measurement: an audience passed this screen, here is the demographic mix. The chain underneath keeps going, because the same ID that shows you drove past a billboard also shows you walked into the shop afterward. That is what makes the billboard audience sellable, and what makes it a record of where you went.

So what changes hands is not your name. It is a map of your movements with a stable number attached, sold to companies you never chose and resold onward because nothing in American law stops it. Who profits? The developer who sells the feed for a few dollars per user per year, the broker who aggregates it, the measurement firm that packages it into a billboard audience, and every buyer after that, including, on the record, agencies paying to skip a warrant (11, 12, 13). You are the only party to the transaction who was never asked.

A degoogled phone helps at the margin, because it strips out the Google advertising ID and the Play Services layer that ties so many apps to one number. However it does not fully close the channel. Location still leaves through whatever apps you install and the permissions you grant them, and an app can stamp its own identifier on your coordinates. Airplane mode is a stronger lever while it is on, but the fixes usually accumulate on the device and upload when you reconnect, so the result is less data, not none.

That is the privacy violation, and it does not depend on anyone learning your name. It depends on a number that follows you, brokers who sell it, and a law that permits them to.

The Tension, Stated Plainly

The out-of-home industry's position, repeated by Clear Channel, Geopath, Landsec, Tesco and Quividi, is that billboard tracking is "anonymous, aggregated audience measurement" (1, 2, 3, 4, 5). The documented challenge to that position is that the same location streams feed a broker chain that sold clinic-visit lists for $160, leaked out of real-time bidding auctions, triggered four FTC enforcement actions, and were purchased by ICE, the FBI, DHS and the military without warrants (7, 9, 8, 10, 11, 12, 13).

Both things cannot be true at once. Either the data is anonymous and aggregated, in which case it could not reveal visits to clinics, houses of worship, and NSA headquarters at ten-meter precision. Or it reveals those things, in which case "anonymous and aggregated" is a marketing term, not a technical fact.

The skepticism belongs on the industry, not on the people asking questions. The researchers and journalists who traced a phone from a weather app to a federal agency were not overstating anything. They were reading the receipts. The billboard industry's harmlessness claim is the claim that has repeatedly failed on contact with the documented record.

A billboard is no longer something you glance at from a car. It is a sensor in a commercial surveillance network, and the data it feeds is for sale to anyone with a credit card or a federal contract.

References

1. NPR, "Advertising Company Will Use Its Billboards To Track Passing Cellphones," February 29, 2016. https://www.npr.org/sections/thetwo-way/2016/02/29/468598100/using-billboards-company-will-collect-personal-information-to-help-advertisers

2. Irish News (Press Association), "The Piccadilly Circus lights will show adverts based on nearby cars and people," October 18, 2017. https://www.irishnews.com/magazine/technology/2017/10/18/news/the-piccadilly-circus-lights-will-show-adverts-based-on-nearby-cars-and-people-1165703/

3. BBC News, "Tesco petrol stations use face-scan tech to target ads," November 2013. https://www.bbc.co.uk/news/technology-24803378

4. Quividi, VidiReports product documentation (current). https://learn.quividi.com/vidireports/

5. Geopath, Out-of-Home measurement body homepage (current). https://geopath.org/

6. Digital Advertising Alliance, Self-Regulatory Principles hub (current). https://digitaladvertisingalliance.org/principles

7. Vice / Motherboard (Joseph Cox), "Data Broker Is Selling Location Data of People Who Visit Abortion Clinics," May 2022. https://www.vice.com/en/article/location-data-abortion-clinics-safegraph-planned-parenthood/

8. 404 Media (Emanuel Maiberg), "Impact: FTC Stops Data Broker X-Mode Selling Sensitive Location Data," January 2024. https://www.404media.co/impact-ftc-stops-x-mode-selling-sensitive-location-data/

9. Holland & Knight, "FTC Cracks Down on Selling Sensitive Location Info, Restricts Use of Consumer Data for 1st Time," December 2024. https://www.hklaw.com/en/insights/publications/2024/12/ftc-cracks-down-on-selling-sensitive-location-info-restricts-use

10. The Record (Suzanne Smalley), "FTC bans data broker Kochava from selling sensitive location info," May 2026. https://therecord.media/ftc-bans-kochava-location-data-sales

11. Electronic Frontier Foundation (Adam Schwartz), "How the Federal Government Buys Our Cell Phone Location Data," June 2022. https://www.eff.org/deeplinks/2022/06/how-federal-government-buys-our-cell-phone-location-data

12. NPR (A. Martínez / Morning Edition team), "Your data is everywhere. The government is buying it without a warrant," March 25, 2026. https://www.npr.org/2026/03/25/nx-s1-5752369/ice-surveillance-data-brokers-congress-anthropic

13. The Register, "ICE knocks on ad tech's data door to see what it knows about you," January 27, 2026. https://www.theregister.com/on-prem/2026/01/27/ice-takes-aim-at-data-held-by-advertising-and-tech-firms/4199821

14. Datatilsynet (Norwegian Data Protection Authority), "Record fine in the Grindr case confirmed," 2023. https://www.datatilsynet.no/en/news/aktuelle-nyheter-2023/record-fine-grindr-confirmed/

15. Future of Privacy Forum, "(Health) Data is What (Health) Data Does in Nevada," June 2023. https://fpf.org/blog/health-data-is-what-health-data-does-in-nevada/

16. Manatt, Phelps & Phillips, "Massachusetts AG Fences off Geofencing Ad Campaign," April 27, 2017. https://www.manatt.com/insights/newsletters/advertising-law/massachusetts-ag-fences-off-geofencing-ad-campaign

17. California Office of the Attorney General, CCPA/CPRA consumer guide (updated August 2026). https://oag.ca.gov/privacy/ccpa