Those damn conspiracy theorists, right again.

https://www.vice.com/en/article/m7vymn/cdc-tracked-phones-location-data-curfews

Location data is information on a device’s location sourced from the phone, which can then show where a person lives, works, and where they went. The sort of data the CDC bought was aggregated—meaning it was designed to follow trends that emerge from the movements of groups of people—but researchers have repeatedly raised concerns with how location data can be deanonymized and used to track specific people.

The CDC used the data for monitoring curfews, with the documents saying that SafeGraph’s data “has been critical for ongoing response efforts, such as hourly monitoring of activity in curfew zones or detailed counts of visits to participating pharmacies for vaccine monitoring.”

“The CDC seems to have purposefully created an open-ended list of use cases, which included monitoring curfews, neighbor to neighbor visits, visits to churches, schools and pharmacies, and also a variety of analysis with this data specifically focused on ‘violence.’”

Some of the use cases are not explicitly linked to the COVID-19 pandemic. One reads “Research points of interest for physical activity and chronic disease prevention such as visits to parks, gyms, or weight management businesses.”

Motherboard previously bought a set of SafeGraph location data for $200. The data was aggregated, meaning it was not supposed to pinpoint the movements of specific devices and hence people, but at the time, Edwards said "In my opinion the SafeGraph data is way beyond any safe thresholds [around anonymity]." Edwards pointed to a search result in SafeGraph’s data portal that displayed data related to a specific doctor’s office, showing how finely tuned the company’s data can be. Theoretically, an attacker could use that data to then attempt to unmask the specific users, something which researchers have repeatedly demonstrated is possible.

Google banned SafeGraph from its Google Play Store in June. This meant that any app developers using SafeGraph’s code had to remove it from their apps, or face having their app removed from the store.