NRK exposed phone-location sellers by requesting its own data, then buying it

In 2020, phone-location data was quietly becoming a government-adjacent commodity: brokers sold 'anonymized' movement records, US agencies such as Customs and Border Protection and ICE bought access, and the apps users trusted never named the buyers. The harm was real but diffuse — easy to describe, impossible to point at. Martin Gundersen, a journalist at Norwegian public broadcaster NRK, suspected his own phone was feeding that market and decided to prove it end to end.

He ran the experiment from February 2020: an extra phone loaded with apps and carried everywhere, while NRK's team separately documented 8,300+ phones tracked at hospitals and women's shelters. Then he turned GDPR's subject-access right into an investigative instrument, filing requests against every company the trail touched, starting with Venntel, the Virginia broker selling location data to US federal agencies. Venntel replied with 75,406 location records and confirmed the data had been shared for purposes including federal law enforcement and national security.

Each reply named the next firm, so the requests compounded: Venntel's parent Gravy Analytics, then the intermediaries Predicio and Complementics, then Sygic — the Slovak developer of navigation apps — and the maker of the Funny Weather app. NRK's technical analysis found an identifier Complementics used for Sygic data inside Venntel's records, and three Norwegian privacy specialists called the chain an apparent GDPR violation.

To show what 'anonymized' was worth, the NRK team had already bought access to a commercial location dataset for 35,000 NOK (about $4,000) and pulled out 31-year-old Karl Bjarne Bernhardsen of Stavanger. When they called him, they could recite where he had been through 2019 — the zoo, a job interview, days at the hospital as a first-time father. The data provider had called the same data anonymised; NRK had just demonstrated that the label meant nothing.

Force every data broker to answer GDPR requests, then buy the product: replies map the chain and the sample proves it is not anonymous

GDPR subject-access requests run on the sellers' own legal machinery: a broker must answer what it holds and with whom it shared it, so no subpoena or whistleblower is needed to start the chain.

Replies become a paper trail: Venntel's file named Gravy Analytics, which named Predicio and Complementics, which led back to Sygic and Funny Weather — a path no privacy policy revealed.

Buying the product as an ordinary customer is the strongest test: for 35,000 NOK, NRK identified a named person in data the seller called anonymised, and one phone call collapsed the defense.

Concrete harm made the story land: reading Bernhardsen his own movements — the zoo, the job interview, the hospital — converted a surveillance abstraction into news a reader could feel.

To expose a market whose harm is invisible, interrogate each supplier through its disclosure duties and buy the product yourself: every reply names the next seller, and the sample proves the damage.

The English account on NRKbeta (3 December 2020) drew 493 Hacker News points and 169 comments, and the journalist answered readers, crediting Michael Veale's access-request template. It fed a widening US debate: a commenter quoted Senator Ron Wyden saying Venntel had 'stonewalled Congress for months' over its sources, while CBP confirmed limited access to commercial data. Sygic's representative called the link 'not clear' and a breach if proven. Norwegian lawyers doubted prosecution would work because Venntel has no European offices — documentation itself, not a fine, was the deliverable.