Sunny Reads Your Privacy Policy: We'd Never Sell Your Data

"We'd never sell your data. Selling is such an ugly word. We share it."

That is Sunny, chipper spokesperson for the Department of Privacy, reading the quiet part of the privacy policy out loud — and the quiet part, it turns out, is doing most of the talking. The sketch is comedy. The cases behind it are federal enforcement actions.

Start with X-Mode, now called Outlogic. The data broker sold precise location data that could track visits to medical clinics, places of worship, and domestic-abuse shelters, according to the Federal Trade Commission's January 2024 order. Think about that product for a moment: a commercially available feed of where vulnerable people go, sold to whoever would pay. The FTC's response was historic — the first-ever ban on a data broker selling sensitive location data.

Then there is Mobilewalla. The broker tracked visitors to pregnancy centers and sold that audience to advertisers for targeted ads, per the JDSupra summary of the FTC's settlements. The business model, reduced to its essence: identify women in a moment of medical vulnerability, package them as an audience segment, sell access to the highest bidder. In December 2024, the FTC settled with Mobilewalla and with Gravy Analytics in related actions — the enforcement wave that followed the X-Mode precedent.

Sunny's genius as a character is that she never lies. "We share it" is, strictly speaking, accurate — the data moves from your phone to the broker to the buyer, and at no point does anyone use the word "sell" in the privacy policy. The entire data-broker industry runs on this vocabulary: sharing, partnering, enhancing, personalizing. The verbs are soft. The tracking is precise to the meter.

The legal theory that finally bit was simple: location data revealing visits to sensitive places is sensitive, and selling it without consent is an unfair practice. It took the FTC until 2024 to say so out loud, and the settlements keep coming. But the underlying economy — apps harvesting location, brokers aggregating it, buyers targeting it — is still running. The orders banned specific sales. They did not ban the business model.

So the next time a privacy policy tells you your data is "shared with trusted partners," remember Sunny's smile. The partners are trusted. The question is trusted by whom.

Sources: FTC press release, January 2024 (X-Mode/Outlogic order) — https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data ; JDSupra summary of FTC settlements (Mobilewalla, Gravy Analytics, December 2024) — https://www.jdsupra.com/legalnews/ftc-settles-with-data-brokers-over-2651118/

Evidence Locker entry: sunny-data-privacy. See the reel: https://www.instagram.com/reel/DeCdeYlozIZ/