Dangerous apps – In the web of data brokers | DW Documentary
This documentary follows journalists who obtain billions of smartphone location points and prove that "anonymous" data can often be traced back to real people. Step by step, it shows how everyday apps (weather, shopping, games, dating) feed a global market where data brokers sell detailed movement profiles—creating risks from stalking to espionage to warfare. The film ends with a stark message: without strong rules, location data turns into a weapon against ordinary people, soldiers, dissidents, and democracies.
1. A tracking device in everyone's pocket
The story opens in Berlin, with an investigation that quickly becomes global. Two journalists are stunned by what they've received: massive sets of location data from unsuspecting smartphone users—data so intimate it feels like spy work.
"You felt like you were working for a spy agency; you had the most intimate insights into people's lives."
The film immediately flips a familiar spy-movie idea into everyday reality. We imagine a GPS tracker being planted on someone—but the documentary argues we're already carrying one: our smartphones.
"The shocking reality is that we all have such a tracking device in our pockets: our smartphones."
And once someone has enough of these location points, they can build movement behavior profiles—detailed "where you go, when you go, and how long you stay" patterns—about almost anyone: dissidents, officials, agents, even soldiers.
"Whoever has this data can construct millions of movement behavior profiles."
2. Ukraine: phones that comfort—and phones that can expose 🪖
The documentary then grounds the threat in the harshest setting possible: the war in Ukraine. Soldiers like Dmytro describe brutal frontline experiences—fear, captivity, and surviving day to day in destroyed places.
"It wasn't that I was afraid of dying. It was the prospect of being taken prisoner."
"While in the midst of fighting house-to-house, I learned what war really means. You feel like a hunted animal."
At the same time, their smartphones are emotionally essential: the only link to family and normal life.
"Sure, it lets you stay in contact with your loved ones!"
A military expert explains that morale is a core part of war—and phones help maintain it. So "just turn phones off" isn't realistic.
"Cell phones are possibly one of the most important elements in the war in Ukraine to strengthen the troops' morale…"
But the documentary asks the terrifying next question: what if soldiers' location data can be bought online?
"But how dangerous are they? What happens when the location data of soldiers like Dmytro can easily be bought on the internet?"
3. The dataset: billions of dots that can pinpoint a room
In late 2023, the journalists Ingo Dachwitz and Sebastian Meineck receive an enormous dataset—a "free sample" from a Florida data broker. The scale is so huge it literally breaks their computer.
"His computer crashed when he first tried to open the data set."
They describe what's inside: billions of rows, each with latitude and longitude.
"We had 3.6 billion locations."
When mapped, the precision becomes frightening. It's not only "in this building," but potentially which corner of which room.
"The data were so exact that you could see not just that someone was in the building, but in which corner of which room the cell phone was in."
Soon they collect even more datasets from other brokers—over 10 billion location points total—revealing a vast, industrial pipeline of tracking.
4. "Anonymous" IDs that aren't really anonymous
At first glance, the data seems anonymous because it contains IDs instead of names. But the journalists show how easy it is to re-identify someone using only routine patterns—especially home + workplace.
"We learned very quickly that this data is anything but anonymous."
"It starts with two locations: the home and workplace. These two criteria alone identify us."
To prove it, they trace one ID's nights (home) and days (a school), and that's enough to find the real person behind the ID: Emma, an 18-year-old student.
"These pieces of information alone led us… to her."
5. Emma: how "ordinary life" becomes a stalking map 😟
Emma watches her life appear as a precise trail: her bus route to school, supermarket trips, hangouts with friends—captured as countless location points.
"It's unreal that you can retrace it so precisely."
"It's pretty unreal how many points there are… And that they have all of that just from me, an ordinary person."
The documentary explains the mechanism in simple terms: many apps ask for location permission during installation. If you agree—even once—your data may flow into advertising systems, and eventually into broker datasets.
Then comes the part that hits hardest: Emma's dog-walking route in quieter areas, especially evenings. She immediately understands how this could enable stalking.
"If some man had this data and decided to stalk me, that would be scary."
The journalists underline that this is no longer only a privacy problem; it's a security problem—because the same data can be misused by criminals, stalkers, and intelligence services.
"It's not just a data privacy issue. It's also a serious security issue."
6. Basma Mostafa: exile in Berlin, and the fear of being found anywhere
The documentary moves from "could this be misused?" to "people already feel hunted." Basma Mostafa, an Egyptian journalist living in exile in Berlin, says she never feels safe. She believes Egyptian agents follow and threaten her.
"I have no place to go. They can find me in any place!"
She recounts a chilling encounter: someone approaches her openly to signal that the embassy "knows everything."
"The high men in the Egyptian embassy know about you, everything."
She describes being tailed in a surreal mirror-like way near Brandenburg Gate—walking in circles and noticing the same behavior from a man she recognized.
"I start to walk… in a circle… And then I looked to him… I find him… walking in a circle like me!"
After an assault at a demonstration, police reportedly recommend she change residence. Yet she still wonders how they could know where she is—down to streets and daily routes.
"I'm still wondering really how they know about my location… about where I am?"
The journalists show her movement pattern inside a dataset—routes from her home to places she recognizes: playground, hospital, daycare. Seeing it, she sums up the feeling in one word:
"Like hacked."
Experts say it's plausible that even "second-rate" intelligence agencies can now buy access to surveillance-like capabilities once limited to major powers.
"Increasingly have access to data they likely wouldn't have had just a few years ago."
7. Why collect location data at all? Advertising, markets, and easy access
The film shifts to the business engine behind the tracking: the advertising industry. At a trade fair panel, ad executives describe "movement data" as a way to measure whether ads lead to real store visits—ad → foot traffic attribution.
"It helps us understand who came into contact with our advertising."
"The ones that saw the ad and then actually came into the store afterwards."
They argue it helps even small businesses avoid wasting money advertising to the wrong city.
But the documentary contrasts that with what data sellers openly claim online: that they know precisely where people live, work, and spend free time, and that the data is easy to obtain.
"Anyone who wants to can get their hands on this data quite easily, as it's traded freely online."
Most shocking: the journalists say they didn't need secret channels or huge payments. They got sample datasets simply by asking and exchanging a few emails.
"These are sample data sets that we got simply by asking for them…"
A key hub is Datarade, a Berlin-based company that acts as a marketplace connecting buyers and sellers. Trading precise location data without consent is forbidden in Germany, but operating as an intermediary for foreign brokers is portrayed as permitted—creating a loophole-like situation.
"Data brokers practically throw these data sets at potential buyers."
8. An insider's warning: the industry became "nose-blind"
Former ad-industry professional Arielle Garcia explains how the promise of targeted advertising changed everything: it's no longer about the content you read, but about reaching the person—in the right place, at the right time.
"You're gonna reach whoever you wanna reach… at the right moment, in the right place, at the right time."
Her main critique is cultural: the industry becomes "nose-blind"—so used to the data that it stops noticing how sensitive it is.
"The industry is how nose-blind it is to the sensitivity of this data."
She argues people focus on selling products, while ignoring the "byproduct": mass trade in data that can end up with governments or bad actors.
"Are you realizing that the byproduct… is now this mass trade in very sensitive consumer information…?"
The documentary then asks the uncomfortable moral question: is misuse just "collateral damage"—not desired, but tolerated?
9. Real-world harm: outing, cartel violence, and national security alarms
The film backs up the danger with concrete cases.
First, a US Catholic priest is outed as gay against his will after a reporter buys location data—reportedly including data linked to Grindr—leading to resignation.
"Monsignor Jeffrey Burrill was outed as a homosexual against his will…"
Second, an even more violent example: the Sinaloa Cartel allegedly uses location data of an FBI agent to identify contacts—then intimidates and, in some cases, kills them.
"The cartel then intimidated, and in some cases killed, those individuals…"
Then the investigation finds a politically explosive pattern in Germany: someone whose routine suggests work at a German intelligence location in Bad Aibling, specifically near a building nicknamed "The Tin Can," associated with NSA-BND cooperation.
"We're clearly on the trail of a high-ranking functionary who most certainly doesn't want to be tracked so precisely."
Former US national security official John Bolton reacts by explaining how "pattern of life" analysis enables kidnappings or assassinations by predicting habits and routes.
"They build what they call a pattern of life."
"This sort of information really can be quite threatening."
He frames it as a national security threat: foreign spying on military personnel and sensitive assets.
"That's very troubling… significant national security threats."
10. Politics and regulation: the US stalls, Germany investigates, and one app stands out
In Washington, the revelations become widely discussed in 2024, and privacy advocates hope for action. But the documentary portrays the political direction changing dramatically with the incoming Trump administration, suggesting privacy protection is deprioritized.
"I don't feel the Trump administration is focused on this issue at all."
Meanwhile, many brokers remain US-based, and the film suggests meaningful regulation there is limited.
"It doesn't appear that any real effort is being made to regulate their activities."
In Germany, the journalists discover something personal: their own location data appears in the dataset—proof that "this can happen to anyone," including investigators.
"I, myself popped up in this data set!"
They trace a likely source: the weather app WetterOnline, the only app where Dachwitz had enabled location access. The dataset includes tens of thousands of apps (classified ads, flight tracking, games, dating), but WetterOnline stands out for scale.
Some apps share only coarse location (like a district). Others are extremely precise. And some share data with a few partners, while others share with hundreds.
WetterOnline, the film says, shared user data with 800+ companies, potentially revealing where people live and work.
"WetterOnline stands out… shares user data with more than 800 companies…"
German regulator Bettina Gayk describes authorities being alarmed. In spring 2025, they raid WetterOnline unannounced and find "pipelines" of location data flowing to major platforms.
"We actually found a pipeline via which location data were exchanged with Amazon."
"There's another link to Google services."
Amazon denies sharing sensitive location data onward; Google doesn't respond. WetterOnline later claims it stopped collecting location for advertising and stopped the flow. But the documentary stresses the key point: once the data enters the ecosystem, it can spread globally and end up with brokers anyway.
"This data must come from somewhere if it's being traded."
The film summarizes the big structural issue: app makers aren't the only ones holding the data—advertising partners pass it along, networks merge, and brokers unrelated to apps collect and sell it to almost anyone.
"It's a total loss of control!"
11. France: even journalists can't decode how data travels
French investigative journalist Martin Untersinger (Le Monde) joins the cross-border collaboration (with Netzpolitik and Bayerischer Rundfunk) to analyze French-app data.
He identifies major sharing by popular apps like Le Bon Coin, plus many other app types. Then comes a surprise: Le Monde's own Android app appears in the dataset, with thousands of advertising IDs.
"Does our application… figure in this data? And yes, it did…"
Le Monde doesn't collect precise location like WetterOnline, so the data is less sensitive—but the discovery becomes a test: if their own app is in there, surely they can trace the path.
They can't.
"Neither our technical teams, nor our marketing teams, nor our legal team had any idea how this data ended up…"
Untersinger calls it a perfect illustration of how the ecosystem is effectively impossible to fully decipher: too many actors, too much opacity, constant renaming and merging.
"This industry is impossible to decode or decipher."
"I get the impression that the situation is unsolvable."
12. The US and abortion: tracking clinic visits, and a family's fear 👣
US journalist Byron Tau introduces a chilling tool: LocateX, software associated with Babel Street, demonstrated using purchased app-derived location data. The tool can identify phones that visited abortion clinics.
"LocateX… makes it possible to track which cell phone users visit abortion clinics."
Tau describes watching a phone cross a state line from a place where abortion is outlawed, suggesting the pattern of someone seeking abortion care.
"That certainly looked like the pattern of somebody… seeking out a medical opinion on abortion."
The film then focuses on Lauren Miller in Texas. After learning she was carrying twins, doctors discover one fetus is non-viable (trisomy 18 and severe brain abnormality). A doctor bluntly tells her the necessary medical step.
"This baby's not going to make it to birth. You need to leave the state."
To save the healthy twin, she needs a selective reduction (aborting the non-viable twin). But Texas law makes abortion inaccessible even in such scenarios, so she travels to Colorado—secretly, telling no one.
In the airport, she tries to hide her pregnancy, afraid of attention, and her fear becomes modern and specific: phones.
"We were truly debating, like, do we leave our cell phones at home?"
She shows she has many apps with location access, meaning her journey could plausibly exist in some dataset—and could be used by authorities or activists.
"If you start understanding what that means and how that can be dangerous for you… then that does become a concern."
Her conclusion is a policy demand, not just personal anxiety: this should be regulated because it's a safety issue.
"We shouldn't be able to just track anybody because that's a safety concern."
The documentary adds an important 2026 detail: according to testimony from the FBI director, the FBI is purchasing data from private brokers—and it raises the possibility of broader uses like immigration enforcement, mass arrests, and deportations.
"According to testimony from the FBI director in 2026, the FBI is purchasing data from private brokers."
13. Brussels and the EU: even regulators' staff are trackable
If the US won't act, could Europe stop the business model? The film points to the EU Commission as a potentially decisive regulator—and notes that EU staff themselves appear in the data.
Investigators see movement patterns of people working in EU institutions and commuting into Brussels suburbs, including those working on security issues.
One example appears to point to someone with an office in the Berlaymont building (EU Commission HQ). The data reveals their daily routine and then leads to a home in a wealthy suburb, where a doorbell name matches a high-ranking official close to Commission President Ursula von der Leyen.
"Even at secret ones. This person could be a potential target."
A target for espionage, the film suggests.
The Commission responds in writing: it's concerned, and insists companies in the EU must follow the GDPR (General Data Protection Regulation). GDPR says precise location data can only be collected for a specific purpose—so trading it should be prohibited.
So why does it continue?
Arielle Garcia argues the industry uses "mental gymnastics"—relabeling practices with comforting terms like "privacy safe," "privacy compliant," or "consented" to avoid changing behavior.
"The industry has a magical way of doing whatever mental gymnastics are required…"
"Everyone just started slapping words like 'privacy safe'… onto everything…"
One proposed fix is radical but simple: ban targeted advertising altogether, because the ecosystem is "so broken" that it cannot be made safe with tweaks.
"The simplest and most far-reaching step would be… banning targeted advertising."
14. Back to the battlefield: location data as a tool of modern war
The documentary returns to Ukraine to answer its most extreme question: can location data cost lives?
Journalists find points near the front—near Soledar and other contested areas—and match locations to buildings visible in wartime imagery at the time Dmytro's unit was there. Even worse, the data indicates connections via Starlink, a satellite internet service heavily used by Ukrainian troops.
"What's even worse: this data doesn't just reveal the user's location, but also that they were connected via Starlink…"
When shown the map, soldiers recognize specific sites: headquarters, evacuation points, routes.
"Right here by this red dot, that was our headquarters."
They can only hope they control the technology better than Russia can.
"All we can do is hope that we're more in control of this technology than the Russians."
A military analyst explains how such data could be used operationally: finding command posts (the "brains" of units), weapon caches, transport routes, and especially troop rotations, when lines are most vulnerable.
"When are troops rotated? That's actually always the point in time when the front line is the most vulnerable."
The documentary sums it up plainly: location data is now part of modern warfare.
"Location data has become a part of modern warfare."
15. Who sells this data? A broker in Florida—and a market that keeps going
To find the source, a team travels to a luxury area on Florida's west coast. The man who supplied the sample dataset lives there. When confronted, he refuses to talk and aggressively orders them away.
"Get off my property! Now!"
Later, his lawyer denies wrongdoing: claims the data is anonymous, collected with consent, and not knowingly sold to governments.
Back in Berlin, Datarade declines an interview too. In writing, it says it's only a marketplace and condemns illegal data trading.
But the documentary concludes the business continues to flourish: brokers remain active on platforms like Datarade, and many marketplaces exist worldwide. It's hard to regulate because it's lucrative.
Finally, the film lands on the everyday user problem: you could turn off location sharing, but then many apps stop working properly—so it doesn't feel like a real choice.
"So you really don't have a choice."
The closing metaphor is brutal and memorable:
"A smartphone's like a boat with hundreds of holes in it. With data leaking out all over."
And the final warning ties together dissidents, soldiers, and everyone else:
"Anyone who wants to can spy on you. Track where you go and what you do. Is it worth it?"
The documentary answers itself—personally, socially, and politically:
"The answer is no… for society… for democracy."
Conclusion
Chronologically, the film builds from personal routines (Emma) to political persecution (Basma) to state-level threats (EU/US officials) and finally to battlefield risk (Ukraine)—all powered by the same system: apps → ad networks → brokers → buyers. Its central lesson is that precise location data is inherently sensitive, and "anonymized IDs" don't reliably protect people. Without strong enforcement (or even structural change like limiting targeted advertising), the documentary suggests the leak won't stop—and neither will the harm.
Need a summary like this?
Get instant summaries with Harvest