The ad in the app
became a police search.

You were the supply, not the customer

This page shares its shape with the Palantir page. There is no Fog Data Science product you signed up for, no account you opened, no privacy notice with your consent recorded in it. Its customers are police departments, and you are not a customer. You are the material.

The difference from Palantir is where the material comes from. Palantir joins records the government already held. Fog does not touch government records at all. It resells data that began on your phone, in apps you chose to install, and travelled through the ordinary advertising market before a company you have never heard of packaged it into a tool for the police.

That difference matters, because it is the one part of this that you can see, and the one place there is anything honest to do about it. But first, what the thing actually is. Almost everything known publicly comes from a single Electronic Frontier Foundation investigation in 2022, built from more than a hundred public-records requests, whose findings the EFF shared with the Associated Press. This page is an account of what those records showed, and it says so wherever the record is a finding rather than a fine.

How an app became the feed

Every phone carries an advertising identifier: a unique string that Google and Apple assign so advertisers can recognise your device across different apps. It exists to make ads more targeted. Thousands of apps embed tracking code that reads that identifier and, with it, streams of location readings, then sells both into a wholesale market for location data. The AP found the underlying readings came from ordinary apps, naming Waze, Starbucks, and hundreds of others, none of which set out to be a police tool.

Fog buys from that market. According to the EFF, Fog Reveal identifies devices by what it calls a "Fog ID," a hashed value derived from the advertising identifier. Fog told its customers the Fog ID cannot be turned back into the original advertising ID, which is the company's central privacy claim and is examined further down. The mechanism, though, is not in dispute: the same identifier built to sell you shoes is the one that lets a detective pull your movements. The phone page on this site is about that identifier and the layer it lives in, because it is the source of everything on this page.

The AP reported that Fog worked closely with another location broker, Venntel, to the point that their marketing materials were nearly identical and Venntel staff recommended Fog to police. The market this data moves through is not a secret backchannel. It is the advertising economy, sold twice.

What Fog Reveal actually does

Fog Reveal is a web application. The EFF's guided tour of the interface, reconstructed from training documents obtained in the records requests, describes an officer drawing a box on a map, choosing a span of dates, and getting back the devices that were inside it, then following any one of them backward and forward across the map. Point at a location and see who was there. Point at a device and see everywhere it went.

The scale is Fog's own marketing claim, not an outside estimate. The company advertised billions of data points on more than 250 million devices, and the records describe police searching across hundreds of billions of location signals. Investigators can build what the industry calls a pattern of life: home, workplace, the people a device travels with, the places it returns to.

The price, and who was buying

The EFF found Fog offered to state highway patrols, city police departments, and county sheriffs for less than $10,000 a year. The AP reported subscriptions starting at around $7,500. That is the number that makes this different from the surveillance you were warned about: it is cheap enough that a small-town department can buy it out of a normal budget line, without a public vote and often without anyone outside the department knowing it exists.

Counting the buyers is harder, because much of the use never became a contract. The EFF documented what it could from the records it received.

These counts are floors, not totals. The EFF has been explicit that its investigation was extensive but not exhaustive: some agencies took free trials that left no purchase record, and the requests reached only the departments that answered them. The honest reading is that the documented use is the part that happened to surface, and the real figure is higher by an unknown amount.

No warrant, by design

In Carpenter v. United States (2018) the Supreme Court held that the government generally needs a warrant to obtain the historical cell-site location records a phone company keeps. The theory of the location-data market is that Carpenter does not reach it, because this data is not pried from a carrier. It is bought on the open market from a broker, from data that users are said to have agreed to share when they tapped through an app's permission screen. Whether that theory holds is being argued in courts and in Congress, and it has not been settled.

A legal scholar walking through Fog Reveal for The Conversation made the plain point: the tool lets police do without a warrant the exact thing Carpenter said normally requires one. The records the EFF obtained show officers using it that way, tracing devices back through time with no court order in the file.

This is the part to state carefully. A dragnet does not select for suspicion. Everyone whose phone was inside the box is returned by the query, not only the person under investigation, which means the reach of a single search includes people who did nothing but stand near a place. The same capability can show who attended a protest, who visited a place of worship, and who went to a reproductive-health clinic. That is a description of what the tool can surface, drawn from the investigations, not an allegation that any particular department ran any particular search.

Who built it

Fog Data Science was founded in 2016, the AP reported, by two former officials of the Department of Homeland Security under President George W. Bush. Robert Liscouski had led the department's National Cyber Security Division. Matthew Broderick, a former Marine brigadier general, had run the Homeland Security Operations Center, the department's watch floor, during Hurricane Katrina in 2005.

This is not incidental colour. The people who built a tool that puts nationwide location tracking on a small-department budget came out of the part of government that does national-security surveillance, and pointed the same idea at the retail end of the market. The capability moved from the federal top of the system to a county login, and the founders are the throughline.

The response, and Fog's answer taken seriously

After the reporting, Representative Anna Eshoo asked the Federal Trade Commission to investigate Fog for unfair and deceptive practices that invade privacy and may skirt Fourth Amendment protections. It fits a wider push, led in the Senate by Ron Wyden, to make the FTC treat the sale of location data by brokers as a legal problem rather than a business model.

State it plainly, because the site's rules require it: there has been no enforcement action and no fine against Fog Data Science. Nothing described here is, as far as the public record shows, a violation of any current law. That is not a footnote. It is the argument. The tool operates in the gap the law has not closed.

Fog's own defence deserves to be met on its terms. The company's position, per the EFF's reading of its documents, is that Fog IDs are hashed and anonymised and cannot be reversed into advertising IDs, so the data does not identify people by name. Grant it. Even granted, it answers a question nobody serious is asking. A pattern of life does not need a name attached. A device that sleeps at one address every night and spends every weekday at one office has, in practice, told you who it belongs to, and the EFF noted that combining a Fog result with other records is how identification actually happens. Anonymised movement, followed closely enough, stops being anonymous. The claim is technically defensible and beside the point.

What actually reduces this

Unlike the Palantir page, this one does not have to end in pure structure, because the supply chain starts on a device you hold. None of the steps below is a fix, and each reduces the supply by some amount rather than stopping it. That is the honest framing this site uses everywhere.

• Reset and limit the advertising identifier. Both Android and iOS let you delete or turn off the advertising ID, which breaks the persistent thread that ties a month of your movements together. It is a setting, it is free, and it is the single most direct thing an individual can do about this particular pipeline.
• Starve the apps that sell location. Most apps that harvest location do not need it. Setting location permission to "while using" or "never," and denying it to anything that has no reason to ask, cuts what enters the market in the first place. The phone page is the deeper version of this argument, because the operating system is where the identifier and the permissions actually live.
• The real answer is collective, and it is legislative. Because there is no fine and no violation, the thing that closes this is a law, not a settlement. Some states have moved to bar police from buying location data they would need a warrant to demand, and proposals at the federal level, of the "Fourth Amendment is not for sale" kind, aim to shut the broker loophole directly. That is where this actually stops.
• The FTC has started on the brokers. The commission has moved against the data-broker end of this market: an order banning X-Mode and its successor Outlogic from selling sensitive location data, and a 2024 action against Gravy Analytics and Venntel, the broker the AP tied to Fog. These reach the suppliers, not Fog, but they are the shape of the answer.

Fog Data Science now has an entry in our Corporate Dossier, and like Palantir it carries no fine. That is not an oversight. The uncomfortable point of this page is the same one: the thing protecting you was never a law that had already been broken, it was friction and obscurity, and both are cheap to remove. What replaces them has to be written down.