Data collected by phone apps is almost always described as anonymous and gathered “for advertising”. In reality it reaches a global market from which the daily movements of identifiable people can be reconstructed. This is not an assumption: the newsroom netzpolitik.org, the public broadcaster Bayerischer Rundfunk and media partners in six countries have documented the commercial chain since summer 2024, obtaining datasets directly from brokers.
The legal question is whether this “mobile data” overlaps with personal data. The short answer: in most cases it does not merely overlap, it coincides — and sometimes it is special category data, under the strictest regime in the General Data Protection Regulation.
What “mobile data” actually means
The phrase covers three layers with different legal regimes, and confusing them is the source of most misunderstandings.
- Traffic and location data processed by the electronic communications provider — governed in Romania by Law no. 506/2004. A strict regime, with access subject to procedural safeguards.
- Information generated on the phone and read by apps — the device advertising identifier, coordinates from the positioning system, IP address, device model, operating system version, network operator. It is processed not by the mobile operator but by the app developer and its commercial partners.
- Inferred data — behavioural profile, probable home, workplace, daily routine, categories of interest. Not collected but calculated from the first two layers.
The second layer feeds the third. It is also where most breaches occur, because it is the layer least visible to the person concerned.
How data travels from the phone to the broker
The chain has four links and involves no criminal act. Developers integrate third-party software modules (SDKs) into their apps to display ads or measure usage; the modules read information on the device and send it to their provider. Each time an ad is shown, a bid request is broadcast to dozens or hundreds of participants at once, containing the device identifier, the location and the IP address. The essential point, and too little understood: the request is not a transmission to a recipient but a broadcast — every participant receives the data, including those that do not bid and will never show an ad. Further along, specialised companies merge the streams by identifier, build movement histories over months or years and sell the datasets on online data marketplaces, where anyone who opens an account can buy; one of the platforms identified in the investigation is established in the European Union, in Berlin.
For scale: one dataset from January 2025 contained 380 million location records from 137 countries, linked to about 40,000 apps; another, from November 2025, contained 278 million records from Belgium, including signals from the European Commission headquarters, the European Parliament and NATO headquarters. What matters legally, however, is not the volume but how they were obtained: free samples, offered to prospective customers to persuade them to buy a subscription.
A necessary clarification: the companies contacted by journalists generally denied any commercial relationship with the brokers concerned. The only case confirmed so far by a supervisory authority is the weather app WetterOnline, which the competent German authority found had passed precise location data to third parties without valid consent.
Is this personal data?
The whole legal regime depends on whether the information qualifies as personal data.
Article 4(1) of Regulation (EU) 2016/679 defines personal data as any information relating to an identified or identifiable person, directly or indirectly, by reference to an identifier, and recital 30 expressly mentions online identifiers associated with devices and applications. In C-582/14, Breyer, the Court of Justice held that a dynamic IP address is personal data where the party processing it has means reasonably likely to be used to identify the person with the help of third parties. In C-604/22, IAB Europe, judgment of 7 March 2024, the Court held that the string encoding a user’s preferences in the consent framework used in automated online advertising is personal data where it can be combined with other identifiers such as the IP address, and that the organisation setting the technical rules of the framework can be a joint controller.
The industry’s standard defence is that the data traded is pseudonymised or even anonymous, the identifier being a string with no name attached. The argument gained apparent weight after the judgment of 4 September 2025 in C-413/23 P, EDPS v SRB, in which the Court confirmed the relative approach: whether pseudonymised information is personal data is assessed by reference to the means reasonably available to the recipient.
Applied here, the argument turns against those who rely on it. The test is not whether the data “looks” anonymous, but whether the recipient can identify the person by means reasonably likely to be used — and recital 26 expressly lists singling out among them. The journalists did exactly that, with tools anyone can use: they isolated the devices present night after night at the same address, then matched the address with names on doorbells, public registers and information available online. An advertising identifier with a precise location history is not an anonymous number but a key to identification. And even on the logic of the judgment, a controller that holds the additional information allowing the data to be attributed to a specific person remains bound by the Regulation.
When location becomes special category data
Repeated presence at a specialist clinic, a place of worship, a party office, a trade union or a victims’ centre is not just a geographic coordinate. It reveals health, religious beliefs, political opinions, trade union membership or sex life.
In C-184/20, OT, the Court held that Article 9 applies even where information does not expressly concern a special category but allows one to be inferred through comparison or deduction. The position was confirmed in C-252/21, Meta Platforms and Others: data from which special categories can be inferred fall within Article 9, which triggers the requirement of explicit consent.
Nobody in the chain described above obtains explicit consent for health or religious data. Nor could they: the person does not know the chain exists. Investigation partners in other countries documented the tracking of thousands of devices in hospitals, in centres for victims of violence and within the perimeter of critical infrastructure.
The rule in Romania: consent before the identifier is read
Many developers assume the consent rule concerns only cookies and only websites. It is a costly mistake.
Article 5(3) of Directive 2002/58/EC, transposed by Article 4(5) of Law no. 506/2004, makes storing information, or gaining access to information stored, in terminal equipment subject to two cumulative conditions: the person’s consent and prior, clear and complete information. The text speaks not of cookies, nor of personal data, but of information and terminal equipment. In Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on 7 October 2024, the European Data Protection Board confirmed that the rule covers identifiers built into the operating system and any technical means of accessing information on the device, whether or not the information is personal data.
The practical consequence is direct: an integrated module reading the advertising identifier for advertising or measurement needs prior consent. Two rules follow, and they are the ones most often broken:
- The operating system permission is not consent. Location access granted in the phone’s settings is a technical authorisation, with no specific purpose and no information about recipients. It does not meet the conditions of Articles 4(11) and 7 of the Regulation.
- Timing matters. Consent is prior by definition. Starting the advertising modules when the app opens, before the user has answered, is already a breach. The French authority fined a mobile game developer 3 million euros for reading a technical identifier for advertising after the user had refused tracking, and since 2025 it has been checking mobile apps systematically, on the basis of a dedicated recommendation.
In Romania the framework applies in the same way. By a communiqué of 16 July 2025, ANSPDCP announced a fine of 30,000 lei on a controller for breaching Article 4(5)(a) and (b) of Law no. 506/2004, and a further 20,286.80 lei for breaching Articles 12 to 14 of the Regulation. The investigation began with a single complaint. The consent mechanism itself is covered in cookie banners and GDPR in Romania.
Why consent and legitimate interest do not hold up
Informed consent
Consent is valid only if the person knows who receives the data and for what purpose. When the bid request is broadcast to hundreds of participants and the dataset is resold several times, the condition cannot be met even in theory: there is no list of recipients, because the recipients are not known even to the sender.
Purpose limitation
Article 5(1)(b) requires specified, explicit and legitimate purposes. “Sale to third parties” is not a specified purpose but the absence of one.
Legitimate interest
In Guidelines 8/2020 on the targeting of social media users, the Board stated that tracking people across websites, locations, devices and services, and data brokering, require consent, the balancing test being hard to pass. The same position appears at paragraph 120 of Guidelines 1/2024 on processing based on Article 6(1)(f), in the version put to public consultation. Moreover, where access to the device triggers Article 5(3) of Directive 2002/58/EC, consent is required by law and the controller cannot choose another basis.
Rights and transfers
The information required by Article 14 becomes practically impossible to provide, and the rights of access, objection and erasure cannot be exercised effectively, because the person does not know who holds their data. Most brokers are established outside the European Economic Area, which brings Chapter V into play. And supervision is getting organised: in November 2025, at the request of the Belgian authority, the Board completed a market study of data brokers, with a methodology for identifying them that other EU authorities can reuse.
How it intersects with other rules
The regime does not stop at data protection. Article 26(3) of Regulation (EU) 2022/2065 prohibits online platforms from presenting advertising based on profiling using special categories of data, and Article 28(2) prohibits profiling-based advertising where the recipient is a minor; in Romania the sanctions framework is set by Law no. 50/2024. Regulation (EU) 2024/1689, for its part, concerns not the collection but the systems built on the data: Article 5(1)(c) prohibits social scoring in contexts unrelated to the one in which the data was originally collected — exactly the case of data gathered “for advertising” and later used to assess people — and point (d) prohibits assessing the risk that a person will commit a criminal offence where it is based solely on profiling.
What it means for a company in Romania with a mobile app
If your company publishes an app, it is the controller for the processing in the app, whoever wrote the integrated modules.
- 1An inventory of integrated modules and recipients
recorded in the record of processing activities (Article 30). You cannot document what you do not know.
- 2Correct qualification of roles
A module provider that sets its own purposes is not a processor but a controller or joint controller, and the relationship is documented by an arrangement under Article 26, not by a simple processing agreement.
- 3A consent mechanism in the app
prior, with separate options for each purpose, refusal as easy as acceptance, and modules actually blocked until the user has chosen. Operating system permissions are handled separately.
- 4Article 13 information, reachable in the app
no more than two taps away, in line with the transparency guidelines.
- 5A data protection impact assessment
Under Article 1(1)(g) of ANSPDCP Decision no. 174/2018, an assessment is mandatory for large-scale and/or systematic processing of traffic and/or location data where it is not needed to provide the service the person requested. Advertising is not the service the user requested.
- 6Transfers and contract clauses
the Chapter V basis checked for onward recipients in the chain too, plus a ban on resale, purpose limitation, audit rights and an obligation to report incidents.
What the user can do
The useful measures are few: deleting the advertising identifier in the privacy settings, limiting location permissions to “only while using the app”, uninstalling unused apps, and refusing in the app’s own consent window, not only in the browser. The most effective legal tool remains an access request under Article 15, expressly asking for the categories of recipients, followed where appropriate by objection (Article 21) and erasure (Article 17). Where there is no answer, or only a formal one, a complaint to ANSPDCP follows — the July 2025 precedent started with a complaint from an individual.
Conclusion
“Mobile data” is not a neutral technical category. An advertising identifier with a location history is, in most situations, personal data under Article 4(1) of the Regulation, and when the route reveals visits to a clinic, a place of worship or a party office, it becomes special category data under Article 9.
The problem is not a lack of rules: prior consent for access to the device, a specified purpose, complete information, rights that can be exercised, documented transfers. The problem is applying them in a chain built so that nobody appears responsible for the whole. For companies that publish apps, one practical conclusion follows: responsibility does not travel with the data. The fact that an integrated module was written by someone else does not change who the controller is.
The analysis reflects the legal framework in force on 11 August 2026. The proposal to simplify data legislation, which would move the rules on access to terminal equipment from Directive 2002/58/EC into the GDPR, had not been adopted at that date and was under negotiation in the Council.
Frequently asked questions
Is a phone’s advertising identifier personal data?
As a rule, yes. Under Article 4(1) and recital 30 of Regulation (EU) 2016/679, online identifiers associated with devices are personal data where they allow identification, directly or indirectly. Combined with a precise location history, the identifier becomes a key to identification.
I gave the app permission to use my location. Does that mean I consented to advertising?
No. The operating system permission is a technical authorisation, with no specific purpose and no information about recipients. Consent under Articles 4(11) and 7 of the Regulation requires a specific and informed indication of wishes, for a defined purpose, that can be withdrawn as easily as it was given.
Our company’s app only uses standard advertising SDKs. Are we responsible for what they do?
Yes. The company that publishes the app is the controller for the processing that takes place in its app. If the SDK provider sets its own purposes, it is not a processor but a controller or joint controller, and the relationship is documented under Article 26.
What sanction risk exists in Romania for data collected through mobile apps?
Two cumulative grounds: Article 4(5) of Law no. 506/2004, for accessing information on the terminal equipment without consent and without information, and the GDPR for the processing itself, with fines of up to 20 million euros or 4% of worldwide annual turnover. The ANSPDCP communiqué of 16 July 2025 shows the two being applied together.