Credit Bureaus & Data Brokers · Location data broker · Regulatory action + Private litigation + Data breach
Gravy Analytics / Unacast (incl. Venntel)
Headline
The FTC finalized an order on Jan 14, 2025 (5-0 vote) barring Gravy Analytics and its subsidiary Venntel from selling, disclosing or using sensitive location data, with narrow national-security and law-enforcement…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The FTC finalized an order on Jan 14, 2025 (5-0 vote) barring Gravy Analytics and its subsidiary Venntel from selling, disclosing or using sensitive location data, with narrow national-security and law-enforcement exceptions. The complaint alleged Gravy used geofences to compile and sell lists of people seen at medical facilities and houses of worship. On Jan 4, 2025 Gravy discovered that someone had accessed its AWS environment and copied location data; a subset was posted on a dark-web forum. Gravy says the posted data mostly covered a few days around New Year 2025 and consisted of advertising IDs, coordinates and timestamps. At least four class actions followed.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Primary source. www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-prohibiting-gravy-analytics-venntel-selling-sensitive-location-data — Unverified - heuristic first draft.
Terms
Arbitration
N/A - no consumer contract (B2B).
Data sharing
SELLS PRECISE GEOLOCATION. CA 2026 registry filings for Unacast and Venntel: precise geolocation = Yes; sold or shared to the FEDERAL GOVERNMENT = Yes. Unacast privacy policy (Sept 2026): 'We may sell your sensitive personal data'; customers may resell data; uses include 'law enforcement and national security'. Gravy itself was on California's AG-era registry from Feb 7, 2020.
Fees and billing
None: no consumer billing relationship.
Contacts
Privacy contact. privacy@unacast.com; consumerdataquestions@unacast.com; privacy@venntel.com
Legal notice. 44679 Endicott Dr Ste 300, Ashburn, VA 20147 (Unacast CA registry filing; Venntel at Ste 333). The N.D. Cal. complaint describes Unacast as a Delaware corporation headquartered in Cos Cob, CT. Verify which address is current.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| FTC press release · 2025-01-14 www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-prohibiting-gravy-analytics-venntel-selling-sensitive-location-data | whole row | Unassigned | confirmed | “will be prohibited from selling, disclosing, or using sensitive location data except in limited circumstances” Quote basis: not recorded. |
| Company incident disclosure · 2025-03-03 gravyanalytics.com/hubfs/Gravy%20Analytics%20Incident%20Fact%20Sheet_03032025.pdf?hsLang=en | whole row | Unassigned | confirmed | “On January 4, 2025, we discovered that a person had accessed Gravy Analytics' AWS cloud storage environment without authorization.” Quote basis: not recorded. |
| Company incident disclosure · 2025-03-03 gravyanalytics.com/hubfs/Gravy%20Analytics%20Incident%20Fact%20Sheet_03032025.pdf?hsLang=en | whole row | Unassigned | confirmed | “You will need to provide your device's MAID for us to process the opt-out request” Quote basis: not recorded. |
| News · 2025-02-06 www.theregister.com/2025/02/06/gravy_analytics_data_breach_suit/ | whole row | Unassigned | confirmed | “at least the fourth such lawsuit against Gravy since January” Quote basis: not recorded. |
| Court filing (complaint - allegations only) · 2025-02-05 storage.courtlistener.com/recap/gov.uscourts.cand.444005/gov.uscourts.cand.444005.1.0.pdf | whole row | Unassigned | confirmed | “tens of millions of mobile phone coordinates of devices inside the U.S., Russia, and Europe” Quote basis: not recorded. |
| Company privacy policy (last updated Sept 2026) · 2026-09 www.unacast.com/privacy-policy | whole row | Unassigned | confirmed | “Notice: We may sell your sensitive personal data.” Quote basis: not recorded. |
| Regulator registry (CSV) · 2026-07-29 cppa.ca.gov/data_broker_registry/registry.csv | whole row | Unassigned | confirmed | “Unacast, Inc. | Unacast | www.unacast.com | privacy@unacast.com | 7038408850 | 44679 Endicott Dr Ste 300 | Ashburn | Virginia” Quote basis: not recorded. |
| Regulator registry (CSV, AG-era) · 2020-02-07 cppa.ca.gov/data_broker_registry/complete-reg-data-brokers.csv | whole row | Unassigned | confirmed | “Gravy Analytics, Inc. | https://gravyanalytics.com/ | 2/7/2020” Quote basis: not recorded. |
| Regulator registry page (CalPrivacy/CPPA) · 2026-07-29 cppa.ca.gov/data_broker_registry/ | whole row | Unassigned | confirmed | “Data brokers are required to begin processing these requests on August 1, 2026.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.unacast.com/privacy-policy | Not fetched yet | NOT CONFIRMED |
| Terms of service No URL recorded | Not fetched yet | NOT CONFIRMED |
| Website https://www.unacast.com | Not fetched yet | — |
| Primary source https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-prohibiting-gravy-analytics-venntel-selling-sensitive-location-data Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: VA. Provisions of VCDPA on file:
| Provision | Type | Source |
|---|---|---|
| Applicability Threshold Va. Code § 59.1-576 | threshold | source |
| Right to Confirm and Access Va. Code § 59.1-577(A)(1) | hard | source |
| Right to Correction Va. Code § 59.1-577(A)(2) | hard | source |
| Right to Deletion Va. Code § 59.1-577(A)(3) | hard | source |
| Right to Data Portability Va. Code § 59.1-577(A)(4) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling Va. Code § 59.1-577(A)(5) | hard | source |
| Right to Appeal Denied Request Va. Code § 59.1-577(C) | hard | source |
| Sensitive Data — Opt-In Consent Required Va. Code § 59.1-578(A)(5); § 59.1-575 (definitions) | hard | source |
| Privacy Notice Requirements Va. Code § 59.1-578(C) | hard | source |
| Processor Contract Requirements Va. Code § 59.1-579(B) | hard | source |
| Data Protection Assessment Va. Code § 59.1-580 | hard | source |
| Enforcement — AG Only; Civil Penalties Va. Code § 59.1-584 | hard | source |