On December 3, 2024, the Federal Trade Commission filed a complaint against Mobilewalla, Inc., a Delaware data broker headquartered in Chamblee, Georgia, founded in 2008. The complaint ran to five counts. The numbers inside it were large — more than 500 million unique consumer advertising identifiers, paired with precise location data, collected between January 2018 and June 2020. The FTC alleged that Mobilewalla had profiled George Floyd protesters by racial background and city of residence. That it had built segments targeting pregnant women, Hispanic churchgoers, LGBTQ+ individuals. That it had collected data from visits to domestic abuse shelters, places of worship, military installations, and reproductive health clinics.
This was reported as a location-data story. It was not primarily a location-data story. The location data was the evidence. The structure of the case was something else entirely.
The FTC's novel legal theory: collecting RTB data for purposes beyond participating in those auctions constitutes an unfair practice under Section 5 of the FTC Act. The auction was never the product. The broadcast was the product.
To understand why the Mobilewalla case matters, you need to understand what happens in a real-time bidding auction — not at the level of the press release, but at the level of the data.
When a user loads a webpage or opens a mobile app, the publisher's platform initiates a sequence. The Supply-Side Platform receives the ad call. It forwards the inventory to an ad exchange. The exchange packages a bid request following the IAB Tech Lab's OpenRTB specification — a JSON object — and fans it out to eligible Demand-Side Platforms. The OpenRTB 2.5 specification defines the standard fields. They include: the globally unique auction identifier, impression object (with bid floor, banner dimensions, ad position, video specifications), device object (including precise latitude/longitude from the GPS sensor, IP address, device type, operating system, mobile advertising ID — the IDFA on iOS, the AAID on Android), user object (including buyer-assigned exchange ID, demographic data, geographic location), and a Geo object nested inside device that can contain lat/lon accurate to within meters.
Every single bid request that flows through the programmatic exchange contains this data. Not sample data. Not anonymized data. Not aggregate data. The actual identifier of the actual device, in the actual place it currently sits, at the actual moment it is making a request — broadcast to every DSP in the exchange's eligible pool.
A large exchange handling 1 million ad requests per second sustained will field 5 million outbound bid requests per second — after the top-N DSP trimming that selects the five most likely competitive bidders per impression. The exchanges that set the industry's volume benchmarks — Index Exchange, OpenX, PubMatic, AppNexus — collectively process hundreds of billions of bid requests per day. Each one a small broadcast. Each one containing a device fingerprint, a location, a moment.
The FTC's complaint against Mobilewalla did not primarily concern what Mobilewalla did with data it had collected directly from consumers. It concerned what Mobilewalla did with data it extracted from the RTB auction stream — data it did not win in the auction, data it had no role in generating, data that was transmitted to it as part of an infrastructure it was never meant to own.
Count three of the FTC's complaint alleged that Mobilewalla "collected consumer data from RTB auctions, including from bid requests for which Mobilewalla did not win the auction." The legal theory was that this collection — this act of taking data from a broadcast you did not pay to win — constituted an unfair practice under Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), when the purpose of that collection extended beyond any legitimate role in the auction itself.
The auction was the cover story. The broadcast was the harvest.
500 million consumer advertising identifiers. Precise GPS location. January 2018 through June 2020. The data Mobilewalla collected was not used to serve ads. It was used to build profiles of people.
The academic literature on RTB's architecture has described this dynamic for years. Researchers at INRIA found that profiling increases prices two to five times and that over 80 bidders can participate in some auctions. Ahmad Bashir's 2019 dissertation at Northeastern found that up to 27% of browsing histories were being leaked to third parties through RTB. A 2025 paper from arXiv examining GDPR compatibility concluded that the RTB system is structurally incapable of meeting consent requirements — the broadcast is the mechanism, not an incidental feature of it.
What the FTC named in the Mobilewalla case is what researchers had been documenting since at least 2015: that the real-time bidding infrastructure functions as a systematic data broadcast, and that every participant in that infrastructure who retains the broadcast data for purposes beyond the auction is running a data-collection operation they have framed as an ad transaction.
The consent order finalized on January 14, 2025 — with a 4–1 commission vote, Commissioner Melissa Holyoak dissenting — prohibited Mobilewalla from collecting consumer data from RTB auctions for any purpose beyond participating in the auction itself. This is not a narrow prohibition on selling location data. It is a structural prohibition on the use case that makes the RTB data broker economy possible.
The order requires Mobilewalla to delete all historic location data, all hashed and unhashed phone numbers, and all derived work product. It requires Mobilewalla to instruct its customers to do the same. It prohibits selling or disclosing location data from sensitive locations within a radius of 1,850 feet — which covers essentially every meaningful location category a person might visit. Medical facilities. Religious organizations. Correctional facilities. Labor union offices. LGBTQ+ venues. Domestic abuse shelters. Political demonstrations. Military installations.
The 20-year consent order is the first to explicitly name the act of extracting data from the RTB broadcast for non-auction purposes as an unfair practice. The FTC did not need to prove that Mobilewalla harmed any specific individual. Under the unfairness standard at 15 U.S.C. § 45(n), it needed to prove substantial injury that consumers could not reasonably avoid themselves — which the systematic broadcast of precise location data to unknown parties plainly constitutes.
The FTC's Technology Blog, in announcing the case, framed it as a location-data enforcement action. That framing was accurate. It was also incomplete. The location data was the evidence of a structural condition. The condition was that the RTB infrastructure had been functioning as a consumer data broadcast medium since its inception, and the parties who understood this early had built businesses on top of it that had nothing to do with serving advertisements.
The Mobilewalla consent order does not shut down RTB. It does not change the OpenRTB specification. It does not require any exchange to stop broadcasting bid request data to DSPs. It prohibits one company — Mobilewalla — from using that broadcast as a data acquisition channel for non-auction purposes.
The infrastructure still operates at scale. A large exchange still processes 1 million ad requests per second. Each bid request still contains a device identifier and a precise location. The broadcast still goes out to five DSPs per auction, selected from a pool of 50 or more registered participants. Every participant in that broadcast receives the same data payload. What each participant does with it — whether they use it to bid, or use it to profile, or use it to build a data product they sell to a government contractor — is still, for the most part, their own decision to make.
The FTC named the architecture. It disciplined one company for what the architecture enabled. The architecture remains.
Research published in the Review of Managerial Science in 2025 found that 76% of brand evaluations are constructed at the moment of purchase rather than recalled from stored memory — which is to say that the moment of transaction is where preferences are most malleable, and the data infrastructure that identifies who is approaching that moment, from what location, carrying what signals of intent, is worth more than any individual impression sold at auction. The auction is the surface level. The data broadcast beneath it is the actual commodity.
Shoshana Zuboff, writing in the Journal of Information Technology in 2015, called the architecture "Big Other" — a system of concentrated knowledge production about behavior, extracted at scale, used to shape behavior rather than merely to serve it. The Mobilewalla case did not disprove this characterization. It gave it its first formal legal name.