No Fluff Advisory · Research · Location Plain language

Research paper · October 2026

Last Seen

Location data is sold as ground truth. In the public record, visit counts are projected or carry no stated basis, visit lift mostly rests on matched comparisons, no visit metric holds accreditation, and three companies under FTC location orders still document precise or device-level offers.

Evgeny Popov · No Fluff Advisory

Research cutoff 24 October 2026 · Only information available by that date is used

Short on time? Read the plain-language version: the same findings in fewer, shorter words.

793source records registered
502claims in the research ledger
47products scored
221corrections logged

Abstract

Abstract

What location advertising and location intelligence actually sell in 2026: where the data comes from, how a visit becomes a number, whether anyone checks it, whether lift is causal, what the law now forbids, and whether agents can buy by place. Research current to 24 October 2026, the date the status-sensitive facts were read, with the United States as the main market.

In short

Location data is sold as ground truth, and the public record does not back the description. Visit numbers are projections from panels whose size is not disclosed on a comparable basis, or carry no stated basis at all. Most visit-lift products compare exposed devices with a matched or modelled group, not a holdout. No independent comparison of any vendor's projected retail visits with door counts or transactions was found, and no visit metric holds MRC accreditation; both that MRC once accredited have lost it. The FTC's five location orders mostly bar sensitive locations, not precise location as such, and three of the five ordered companies still document precise or device-level offers. Five states now ban the sale of precise geolocation outright. Agent protocols can describe a place, but in the sources screened no location signal has a public interoperability test. On the Ground Quotient, independent assurance is the weakest dimension in every cohort.

What a buyer can do with this

Treat a visit count as a projection and a visit lift as a correlation until the vendor shows otherwise: ask which kind of number it is, what the control was, whether anyone has compared the counts with the ground, where the observations come from, and whether the vendor is under an order. Chapter 12 turns this into eight questions. This paper audits what vendors document in public by the cutoff; it does not test whose numbers are accurate.

The question

Location is the oldest offline signal in digital advertising and the one with the most enforcement against it. The same panels feed store-visit attribution, location audiences, geofenced local buying, the US out-of-home audience currency and the foot-traffic dashboards investors read as fact. This paper asks what those products measure, where their data comes from, whether anyone has checked the numbers, whether their lift is causal, what the FTC orders and state laws changed, and whether agent-driven buying can carry location. The author's own writing calls footfall attribution "correlated and modeled by default" and DOOH outcome studies "a model on a model"; those positions were registered as rival hypotheses, not evidence.

How it was done

Seven hypotheses and four coded questions were registered with their decision rules on 24 October 2026, before any research began, alongside a product register and scoring rules with fixed anchors. AI research agents then ran 11 workstreams, a vendor-universe sweep and 8 company profiles. A separate AI verifier, told to refute, checked each file. In all, 793 source records were registered, almost all of them opened in full, and the ledger holds 502 claims, each traced to a source; 493 research claims were checked by a verifier or a review, and the rest are author syntheses (the hypothesis readings and the privacy-cap effect) plus one legal finding added in review, New Jersey's 2026 sale ban, which a separate check read in the enacted statute. Another AI model reviewed the evidence and the design twice before scoring, then the full paper, then the live edition; every factual point it raised was checked at its primary source or against the paper's own data before anything changed, and several of the reviewer's own assertions turned out to be wrong. The corrections ledger holds 221 entries. 47 products are scored on 11 dimensions in five cohorts, and every counted cell was re-checked by a separate verifier. This is AI-assisted research with a published process. It has not been audited or peer reviewed, and no vendor saw it before publication. The author works at Samba, co-leads AgenticAdvertising.org's Signals & Measurement working group, and earlier worked at Verve Group, whose lineage includes the location-advertising company Verve Wireless; the full statement is in chapter 13.

What it found

  1. Visit numbers are projections or unlabelled. In cohort A, four products document a projected visit number (Foursquare, InMarket, GroundTruth and Azira), some alongside an observed count, and nine visit numbers (including Arrivalist's arrival counts) state no basis at all . Chapter 1.
  2. Supply is undocumented. In the sources screened, no vendor discloses a US panel series on one definition across the 2019 to 2021 permission changes, and no filing attributes a quantified supply change to them, so H1 is unresolved . Ownership concentrated: T-Mobile bought Vistar Media and Blis in 2025 , ZeroToOne.AI announced it had acquired GroundTruth in March 2026 and Infillion announced it would acquire Foursquare in September 2026 . Chapter 2.
  3. Platform changes are dated; their effects are not. Apple's and Google's permission changes are dated from their own documentation, and in the sources screened no filing, platform statement or independent measurement quantifies what that did to US SDK supply . Chapter 3.
  4. Nobody has checked the counts against the ground at scale. No independent multi-site comparison of projected retail visits with door counts or transactions was found; the independent checks cover parks, trails, census counts and polling places, mostly before 2021, and are adverse for SafeGraph's 2018 panel. H2 is unresolved . Chapter 4.
  5. Lift is mostly correlation. Six of the eight cohort A products that document a lift method use a matched or synthetic control, and a ninth documents exposed-only visits with no lift claim; H3 is contradicted . The comparator decides the number: one vendor's case shows 29% lift against its holdout and 310% against unexposed devices . Chapter 5.
  6. What audiences are built from is not disclosed. Too few audience products name their primary source to say whether bidstream or SDK data dominates; H4 is unresolved . T-Mobile's app-based audience segments have been on Vistar's DOOH buying platform since May 2025, and on 5 October 2026 Vistar announced enhanced segments with location insights, available only there . Chapter 6.
  7. The orders did not end the trade. Only InMarket's FTC order bans selling precise location outright ; three of the five ordered companies still document precise or device-level offers, so H5 is contradicted . Gravy Analytics, a Unacast company, confirmed a breach of its cloud storage in January 2025 . Chapter 7.
  8. Nobody accredits the number. MRC's only location standard dates from 2017 and says nothing about lift ; on 24 October 2026 no visit or location metric was on any of its lists, so H6 is contradicted . Chapter 8.
  9. Out-of-home runs on mobility data. Half the US DOOH products coded name no mobility source for their audience numbers , and the US audience currency is being rebuilt, with a pilot in the second half of 2026 . Chapter 9.
  10. Agents can describe a place; production buying by place is not established. In the protocols and registry screened on 24 October 2026, the furthest any location signal reaches in agent-driven buying is one implemented connector; H7 is unresolved . Chapter 10.
  11. On the Ground Quotient, independent assurance is the weakest dimension everywhere. The field GQ is 41 in visit measurement, 44 in audiences, 41 in foot-traffic analytics and 38 in raw movement data. 1 product reaches the Most documented band, by less than a quarter of a point. Chapter 11.

What it means

On this paper's reading, location data is a useful signal sold with more certainty than the public record supports. A buyer who wants to treat a visit count as a count, or a lift as causal, should ask for the kind of number, the control, a ground-truth comparison, the sources and the vendor's regulatory record. Chapter 12 sets out those questions.

Chapter 1

What a location number is

Every location number is one of four kinds: observed, projected, declared or inferred. Most visit numbers in the documentation opened for this paper are projections or carry no stated basis. "Precise" has no single boundary. The US statutes read draw it at 1,750 or 1,850 feet, industry rules at two decimal places of latitude and longitude, and the bid-request standard draws none. A visit counted after exposure is visitation, and lift needs a control. Most of the controls vendors document are matched or modelled.

In short

Under this paper's coding rule, the visit totals reported by Foursquare Attribution, InMarket's LCI, GroundTruth Projected Visits and Azira are projected. For nine of the visit numbers coded across the fourteen cohort A seed products, Arrivalist's arrival counts among them, the basis is not disclosed . Placer.ai's population visit estimates are extrapolations from a device panel; it also exposes raw panel counts . The US statutes read for this paper define precise geolocation by a radius of 1,750 feet, or 1,850 feet in California . The Network Advertising Initiative (NAI) treats two or fewer decimal places as imprecise, Google caps bid-request coordinates at 0.01 degrees, and OpenRTB 2.6 has no rule on truncating coordinates . Apple quantises approximate location to a region with a typical radius of about five kilometres. Google documents Android's approximate location as accurate to within about 3 square kilometres . Nine cohort A products document a general visit-measurement method and eight of them claim lift. Six of the eight use a matched or synthetic control and two a randomised or holdout control; the ninth reports exposed-only visits with no lift claim . In one undated PlaceIQ case, the same campaign showed 29% lift against a holdout and 310% against the open population .

The definitions

FOUR KINDS OF LOCATION NUMBER, AND HOW THE NUMBERS SOLD WERE CODEDObserved: A panel device detected inside a defined place under stated dwell and accuracy rules, not scaled. 3 of 16, stream C sample 3 of 20, cohort A Cohort A: InMarket, GroundTruth, AziraObservedA panel device detectedinside a defined placeunder stated dwell andaccuracy rules, notscaled.3of 16, stream C sample3of 20, cohort ACohort A: InMarket,GroundTruth, AziraProjected: An observed count scaled to a population by a model (modelled, estimated, extrapolated). 4 of 16, stream C sample 4 of 20, cohort A Cohort A: Foursquare, InMarket, GroundTruth, AziraProjectedAn observed count scaledto a population by a model(modelled, estimated,extrapolated).4of 16, stream C sample4of 20, cohort ACohort A: Foursquare,InMarket, GroundTruth, AziraDeclared: From transactions, loyalty, Wi-Fi log-in or door counters. 1 of 16, stream C sample 4 of 20, cohort A Cohort A: Arrivalist, Foursquare, InMarket, CuebiqDeclaredFrom transactions,loyalty, Wi-Fi log-in ordoor counters.1of 16, stream C sample4of 20, cohort ACohort A: Arrivalist,Foursquare, InMarket, CuebiqInferred: A location taken from a bid request, an IP address or a user-declared field. 2 of 16, stream C sample 0 of 20, cohort A Cohort A: noneInferredA location taken from abid request, an IP addressor a user-declared field.2of 16, stream C sample0of 20, cohort ACohort A: noneBasis not disclosed: The source does not say which of the four kinds the number is. 6 of 16, stream C sample 9 of 20, cohort A Cohort A: Blis, Reveal Mobile, Adsquare, Cuebiq, Vistar, Kochava, Arrivalist, Lifesight, Precisely PlaceIQBasis not disclosedThe source does not saywhich of the four kindsthe number is.6of 16, stream C sample9of 20, cohort ACohort A: Blis, RevealMobile, Adsquare, Cuebiq,Vistar, Kochava, Arrivalist,Lifesight, Precisely PlaceIQCohort A counts follow verifier E’s correction (LOC-E-F29): Arrivalist’s spend lift is declared (card data) while the basis of its arrivalcounts is not stated, and the declared card-sales numbers Foursquare, InMarket and Cuebiq sell beside visits are added. Several vendors appearin both samples; do not add the two. A number is observed only when the source documents detection of panel devices in defined places;GroundTruth’s ‘observed’ rests on its own label, with no dwell or accuracy rule published.
Four of the 13 cohort A products that sell a visit number say which kind it is, and all four sell a projected number. The brief’s four kinds of location number, and the counts when the numbers opened were coded under question Q1: a sample of 16 numbers vendors sell or publish (stream C) and the 20 numbers sold by the cohort A products (stream E, after verification). In cohort A, the basis is not stated for 9 of 20 numbers; the four products that state a visit basis (Foursquare, InMarket, GroundTruth, Azira) each sell a projected visit count, three of them next to an observed one.Units: count of numbers coded · Scope: numbers opened in vendor documentation, US, at the cutoff · Sources Codes describe what the documentation states, not what a delivered report contains. A number coded "not disclosed" may be projected; the vendor does not say.Data: data/figure-data.json#number_kinds

A company can have rows in several cohorts, and evidence is not inherited between them. Foursquare's 2026 product menu lists Attribution, Audience and Proximity for marketers, a Geospatial Intelligence Platform, and the Places API and Movement SDK for developers . Placer.ai sells an Analytics Platform, Enrichment and a Data Marketplace, and its advertising page offers to measure lift without naming a separate measurement product . The product register holds 86 rows, 29 of them listed and 10 historical (chapter 13).

Four kinds of number

Most of the cohort A record is projection or silence, under the Q1 coding rule registered on 24 October 2026. A number is coded observed only when the source documents detection of panel devices for the places and period reported. It is coded projected when any scaling, extrapolation, normalisation or estimation to a population is documented, or when the vendor's own term implies one. Transactions, loyalty records, Wi-Fi and counters make a number declared, and bid requests, IP addresses and user-declared fields make it inferred. A number whose basis is not stated is coded not disclosed, and that gap is scored under method disclosure.

Foursquare Attribution, InMarket LCI's projected store visits, GroundTruth Projected Visits and Azira's extrapolated total visits are documented as projected. GroundTruth Observed Visits, Azira's observed visits and InMarket's exposed device visits are documented as observed . Arrivalist MediaInsights' spend lift is declared, from card transactions, but the basis of its arrival counts is not stated . For Blis, Reveal, Adsquare, Cuebiq, Vistar, Kochava, Lifesight and Precisely the basis is not disclosed . Unacast's pages name no attribution product in the sources screened .

The projections are documented to different depths. Foursquare's 2022 method post describes census weighting of the panel to the national population and projection of visit volumes on match rates by platform and partner . InMarket's console defines Overall Projected Store Visits as exposed device visits multiplied by an "ND Device / DMA Size Ratio", in undated text from the NinthDecimal era . Azira counts each observed device as 1/P(Detection) devices, extrapolates only above about 1,000 observed visits and caps the multiplier at 20x . GroundTruth applies the visitation of a per-campaign panel of impressed devices to all impressed devices. The projection appears once a campaign reaches about 40 Observed Visits and 350,000 impressions, and GroundTruth reports no uncertainty for it .

Foot-traffic products show the scaling outright. Placer.ai's documentation scales 74.8 thousand panel device visits to one Michigan grocery store to an estimated 2.4 million . That implies a scale factor of about 32 . Its API keeps raw panelVisits apart from extrapolated visits . Arrivalist's 2021 Lee County analysis scaled 492,897 panel trips to 9,861,477 projected US adult trips, a factor of 20.0 . Unacast defines its machine-learning visits as an estimate of "unique people with a stay at a location in a day", produced by a model with more than 150 features . This paper therefore codes the basis of any dashboard "visits" figure before quoting it.

Observed counts have their own bias. GroundTruth calls Observed Visits a "raw" observed count . Its help centre says observed visits "may be lower than actual visits" because not all users are trackable .

Declared numbers mostly enter as sales. Foursquare documents over 2 billion annual card transactions mapped to places across 450+ US chains . InMarket's Retail Sales Lift add-on uses card transactions from a subset of the same exposed and control users , and Arrivalist names Visa, Mastercard and Discover as its card sources . Exposure can be inferred as well as location. Vistar's DOOH cases infer exposure from ad-log timestamps, device location, venue type and screen location . Adsquare infers it from the proximity of mobile advertising IDs to screen coordinates while an ad is live, with no radius stated . GroundTruth's 2021 help centre says its CTV-to-store visits rely on TapAd converting IP addresses to mobile ad IDs . Foursquare and Cuebiq document linear-TV-to-visit measurement without naming the viewing-data supplier . None of the cohort A documentation opened names Samba, the TV data company where the author works, as a source of TV exposure data .

Where the observations come from

MRC's 2017 Location-Based Advertising Measurement Guidelines list GPS, Wi-Fi, IP, cell trilateration, registration, beacon, panel and bid-request location as sources. They rate beacons within metres, GPS at 10-100 m, Wi-Fi at 30-100 m and cell at ZIP or neighbourhood level, and they call mobile IP generally neither accurate nor precise . Those ratings date from March 2017 , before Apple's iOS 13 and Google's Android 10 permission changes of September 2019 .

SDK and panel supply is disclosed in units that do not compare, and mostly without dates . Placer's help centre describes tens of millions of US devices from hundreds of partner apps, about 7% of the US population. Its September 2024 deck gives 30 million active devices from 500 SDK apps on one slide and 25 million-plus on another, with neither figure defined by period . InMarket names its own apps, a partner SDK app network and unnamed third-party sources, with no proportions . Foursquare names GPS pings from its own consumer apps and vetted third parties , and it retired its City Guide app on 15 December 2024 . In the sources screened, no US location vendor discloses a panel series on one definition that spans a pre-2021 and a post-2023 figure . Chapter 2 tests H1 on that record.

Bidstream location arrives in the OpenRTB 2.6 Geo object. It carries latitude and longitude, a type (1 GPS or location services, 2 IP address, 3 user-provided), an accuracy in metres, the seconds since the fix and the IP location service used. The specification says coordinates should be passed only when they match the accuracy of the stated type, and that a postal-code centroid should not be passed . Two 2015 vendor studies measured how often the field was usable. Thinknear's vendor-run Q1 2015 index found location on 62% of ad requests and put 37% of located impressions within 100 m . Placed's 2015 analysis found that less than 1% of the business visits its panel observed generated an ad-request location within 100 m . This paper does not read either as a description of 2026 supply. Azira documents a blend of SDK integrations and location from the bid requests of over 100,000 apps, with no proportions . InMarket's GeoLink scores the location carried in ad requests before bidding . The FTC's January 2025 Mobilewalla order is the only regulator record found in the audiences stream that documents bidstream as a cohort B source . Google's exchange sends only IP-derived location, capped at 0.01 degrees . Under Google's Authorized Buyers guidelines, any precise location a buyer receives by other means may be used only to bid on that impression .

The one IP-geolocation accreditation found in the MRC communications screened has lapsed. MRC moved Digital Envoy's NetAcuity service from hiatus to non-accredited in January 2020, and no IP-geolocation service was on MRC's lists on 24 October 2026 . Platform changes touch IP location only at the edges. iCloud Private Relay maps to a roughly city-level area by default but covers only Safari, DNS and insecure HTTP traffic, leaving HTTPS in-app traffic untouched . Chrome's IP Protection was confined to Incognito third-party contexts and is being withdrawn . Some vendors refuse IP outright. GroundTruth says it rejects centroids and carrier-IP locations , and Simpli.fi says it does not use IP because of truncation .

Telco and first-party sources are named more often than they are described. T-Mobile's app-based segments have been on Vistar's DSP since May 2025, and on 5 October 2026 Vistar announced enhanced, location-enriched segments available only through it . Per AdExchanger, it combines mobile location data with app installation and usage that T-Mobile infers from network requests . Blis's 2024 strategic report cites partnerships with telco providers across North America, the UK and Europe . Among the suppliers screened, only Quadrant documents a first-party server-to-server route with explicit counts, which are global. Outlogic says "No Bidstream Data" but gives no count . "Opt-in" and "consented" are claims about the consent route. Adsquare's signals are "sourced from vetted partners with explicit, auditable consent", with no route named . No cohort B product documents a primary source, so H4 is unresolved on the documentation read . The dated clarification of its rule does not change that reading (chapter 6).

Precise and coarse

The 2017 MRC guidelines separate accuracy, meaning closeness to the true location, from precision, meaning the number of decimal places, and require vendors to disclose both . They equate two decimal places with about one kilometre, four with about ten metres and five with about one metre, and warn that decimal count must not be equated with accuracy . The table sets out the boundaries in the rules read for this paper, as current when they were read in October 2026.

RuleWhere precise endsEvidence
Maryland, Oregon, Washington (precise location information), Connecticut, VirginiaRadius of 1,750 feet
California, Civil Code 1798.140(w)Radius of 1,850 feet
The five FTC location ordersCoarse data excluded, for example ZIP code or census block with a radius of at least 1,850 feet
NAI guidance (February 2020)Two or fewer decimals, an area at least a 500 m-radius circle, or a non-unique descriptor is imprecise
Google Authorized BuyersIP-derived only, 0.01 degrees
PrebidTwo decimals, only when a rule denies transmitPreciseGeo; the default is allow
OpenRTB 2.6No truncation or rounding rule
Apple iOS 14 approximate locationRegion with a typical radius of about 5 km
Android 12 approximate location; Google Play Data safetyAbout 3 square kilometres; precise is less than 3 square kilometres

Two decimal places is the recurring line, but the bodies attach different distances to it. NAI's 500 m radius is about 6% smaller than the 1,750-foot (533 m) statutory radius . Washington's geofencing ban uses a third distance: a boundary of 2,000 feet or less around in-person health care providers . The operating-system definitions differ in kind as well as size, because Apple states a radius and Google an area . Apple says apps cannot opt out of a user's approximate choice, and region monitoring needs full accuracy . Android 12 lets users set approximate accuracy for any app, whatever it requests . The paper codes operating-system approximate fixes and truncated coordinates as coarse. Because OpenRTB sets no truncation rule, the precision of a bid request's coordinates is the sender's choice, and their decimal count does not show their accuracy .

Places, polygons, radii and dwell

The 2017 guidelines define a geofence as either a point-radius or a boundary (polygon). They define a physical visit as the intersection of device location and place, using speed or longitudinal analysis to exclude drive-bys, and note that geofences generally cannot represent multi-storey buildings . Vendors fill in the rest themselves, and the rules differ.

ProductPlaceVisit or stop ruleEvidence
Placer.aiDevice signals matched to a geofenced POIFrom 1 minute of dwell since 31 March 2024; at most once per person per POI per day
Foursquare Visits feedVenue, with place shapes in dense locationsA stop of at least two minutes; the Movement SDK FAQ says there is "no standard minimum dwell time"
Unacast machine-learning productsPolygonMultiple pings within 50 m for longer than 60 seconds
Radar SDKCircles of 10 to 10,000 m, polygons or isochronesStopped after 140 seconds within 70 m (Responsive and Continuous presets on iOS, all presets on Android); dwell thresholds configurable
GroundTruthBlueprints polygons, 4.8 million across the US and Canada; 12-metre radial fence where none existsNamed tests, no numeric threshold
Adsquare2D POI polygons, "no fuzzy radius logic"Not stated

GroundTruth asserts, without citing a study, that radial geofences measure visits "with up to 75% inaccuracy" . No cohort B documentation opened states a fix-accuracy threshold with a method or a detection error statistic. The only numeric precision claim found is Azira's unexplained "within 3 meters of precision" . Disclosed attribution windows run from 4 days (Vistar with Foursquare, for DOOH) to a 30-day look-back (Simpli.fi), and window choice alone moves a visit count materially . AdCP, a protocol for agent-driven buying, uses the same vocabulary. AdCP v3.2.6 (23 October 2026) represents point-based proximity as a radius, a travel-time isochrone or a buyer-supplied GeoJSON polygon, and identifier-based places, as schema only . The author co-leads AgenticAdvertising.org's Signals & Measurement working group, where his cell-grid RFC, AdCP issue #5969, was open when read . Chapter 10 treats that as a declared interest.

Visitation is not lift

A visit rate among exposed devices says nothing about what the ad caused until it is compared with a control. MRC's 2017 location guidelines contain no provision on visit lift, incrementality or control groups . GroundTruth's Observed Visits is the plainest case of visitation. It is an exposed-only count with no control group, crediting a visit within 14 days of exposure by last touch . GroundTruth's Cost Per Visit model bills on those verified visits .

The comparator decides the size of the number. PlaceIQ's undated A/B case for a national big-box retailer reports a Place Visit Rate of 2.75% for exposed devices against 2.13% for a standing 10% holdout, a 29% lift. Against the open population the rate is 0.67%, a 310% "open lift". The same campaign shows a 10.7-fold larger lift when the comparator changes .

Of fourteen cohort A seed products, nine document a general visit-measurement method and eight of them claim lift. Six of the eight use a matched or synthetic control (Foursquare, InMarket, Reveal, Adsquare, Cuebiq, Arrivalist), two a randomised or holdout control (Azira, Blis), and GroundTruth reports exposed-only visits with no lift claim . Blis's Smart Holdout Groups balance target and control ZIP codes by machine learning, and Blis does not describe the assignment as randomised . Vendor names for these designs overstate them. Cuebiq describes "causal machine learning to simulate a randomized control trial" with behaviourally matched controls . InMarket calls its synthetic control causal . Foursquare's product page says "incremental lift" for an output its blog and metrics page call "behavioral lift" . Under this paper's rules a matched or synthetic comparison is correlation, whatever the vendor calls it, and the vendor's term is reported beside the code.

On those counts H3 reads contradicted: seven of the nine documented methods are not holdouts, and excluding GroundTruth, six of eight are matched or synthetic . The dated clarification of 24 October 2026 fixed the decision tree and did not by itself move the verdict. The author's glossary line that footfall attribution is "correlated and modeled by default" is H3's registered rival hypothesis, not evidence, and Azira and Blis are exceptions to it . Chapter 5 codes each product, chapter 4 asks whether the projected visits agree with ground truth, and chapter 12 turns these definitions into questions a buyer can ask.

Chapter 2

Who supplies the data

Several US location vendors changed hands in 2025 and 2026, two of them to a carrier. T-Mobile bought Vistar Media and Blis in early 2025, ZeroToOne.AI bought GroundTruth in March 2026, and Infillion announced in September 2026 that it was buying Foursquare. Near Intelligence went through Chapter 11. Whether the supply underneath shrank after Apple's and Google's permission changes cannot be read from the record: no vendor in the sources screened discloses a US panel series on one definition from before 2021 to after 2023, so H1 is unresolved.

In short

T-Mobile US completed its purchases of Vistar Media on 3 February 2025 and Blis on 3 March 2025, for US$621 million and US$180 million in cash . ZeroToOne.AI announced on 25 March 2026 that it had acquired GroundTruth . Infillion, which already owns Gimbal, announced on 18 September 2026 that it would acquire Foursquare; by 24 October 2026 participants described the deal as done, but no closing record or date was found . Gravy Analytics trades as Unacast, Precisely owns PlaceIQ and Rezolve AI owns Bluedot . Near Intelligence filed for Chapter 11 in December 2023 and sold substantially all its assets to a Blue Torch vehicle; that Azira is that business is this review's inference . Vendors' panel and scale figures use incompatible units, and none forms a US series on a constant definition from before 2021 to after 2023, so H1 is unresolved on the sources screened . Some vendors document sources other than their own SDKs, but no figure shows a market-wide contraction or substitution .

The ownership map at the cutoff

The table records who owned each business on 24 October 2026, when the pages and registries were read, and the event that put it there. Each event carries one class under shared rule 11, with dates from the source that settles it; an event whose completion no opened source states is recorded as announced (question Q3) .

BusinessOwner or status at the cutoffEvent classDatesEvidence
Vistar MediaT-Mobile USAcquisition, completedAgreed 20 Dec 2024; closed 3 Feb 2025; US$621m cash
BlisT-Mobile US ("part of T-Ads" on Blis's homepage)Acquisition, completedAgreed 18 Feb 2025; closed 3 Mar 2025; US$180m cash
FoursquareInfillion, by participants' statementsAcquisition, announced; closing unverifiedAnnounced 18 Sep 2026; no closing date found
GimbalInfillionNot dated in this reviewn/a
GroundTruth (formerly xAd)ZeroToOne.AIAcquisition, announced as completedAnnounced 25 Mar 2026; counsel confirmed 24 Apr 2026
Gravy Analytics and VenntelTrade as UnacastMerger, announced; structure and completion not statedAnnounced 29 Nov 2023
Unacast's Aggregated Location Insights businessPine59Management buyout, completed per the buyerAnnounced 1 Sep 2026
PlaceIQPrecisely; product sold as "Precisely Audiences"Acquisition, completedAgreed 19 Jan 2022; completed Feb 2022
BluedotRezolve AIAcquisition, completed (related party)Agreed 4 Feb 2025; closed 20 Feb 2025
Near IntelligenceLiquidated; assets to BTC Near Holdco LLC; Azira as successor is inferredInsolvencyChapter 11 8 Dec 2023; deregistration filed 28 Mar 2024
Outlogic (formerly X-Mode)Digital EnvoyAcquisition, then rebrandReported 5 Aug 2021
HivestackPerionAcquisition, completedClosed 12 Dec 2023; US$100m cash at closing
Place ExchangeBroadsignAcquisition, announced as completedAnnounced 25 Nov 2025

Carriers and holding companies

T-Mobile owns two of the businesses in the map, and its FY2025 10-K puts the fair value of consideration at US$617 million for Vistar and US$174 million for Blis, after excluding payments that settled preexisting relationships . The filing calls Blis "a provider of advertising solutions"; the location characterisation comes from Blis's own pages, and T-Mobile states that Blis's results to 31 December 2025 were not material . Lamar Advertising received US$115.1 million in cash at the Vistar closing for its 20% stake, with up to a further US$15.1 million in escrow, per its 8-K exhibit of 20 February 2025 . Blis's About page, modified 8 October 2026, still calls it an "Independent DSP" and does not mention T-Mobile .

The carrier brings its own data, described mostly as app data. Since 10 September 2025 the Blis DSP has carried T-Mobile's US app ownership and engagement data, which Blis says it combines with movement patterns and transactions . On 5 October 2026 Vistar announced enhanced T-Mobile segments for DOOH, available only through Vistar, whose signal list now adds "location insights" . AdExchanger reported the same day that T-Mobile's data for Vistar includes mobile location data, and that for users who opted into location tracking T-Mobile can detect proximity to OOH ads; T-Mobile tied the exclusivity to tightening regulation of location data and mobile device IDs .

Infillion would hold two location product families if the Foursquare deal has closed: the Gimbal Location Platform, an SDK sold to app owners for their own users' data, and Foursquare's attribution, audience, places and SDK products . Infillion also bought Catalina (closed February 2026) and MediaMath (out of bankruptcy in 2023, for US$22 million) . Infillion's release says leadership will join "after the transaction closes", while Foursquare's homepage read "Foursquare has joined Infillion" on 24 October 2026 . Business Insider reported Dennis Crowley's account that equity holders received $0 . This paper records the event as announced, with completion resting on participants' statements . ZeroToOne.AI disclosed no seller, price or closing record for GroundTruth, and its release names debt-financing advisers .

The Unacast and Gravy combination is harder to read. Gravy Analytics, Inc., whose subsidiary is Venntel, opens its September 2026 privacy policy as "Gravy Analytics, Inc. dba 'Unacast'", and gravyanalytics.com redirects to unacast.com . On 1 September 2026 Pine59 said it was "the new home of Unacast's former Aggregated Location Insights business" after a management buyout led by two Unacast co-founders and its former CTO . Unacast's own pricing page still listed the machine-learning foot-traffic datasets and the Location Insights platform on 24 October 2026, and no Unacast statement of the sale was found in the sources opened .

Near Intelligence and Azira

Near Intelligence's collapse is coded as an insolvency . It listed on Nasdaq through a SPAC combination completed on 23 March 2023 . Its 10-Q for the first half of 2023 reported revenue of US$33.2 million, a net loss of US$36.9 million and substantial doubt about its ability to continue as a going concern . It filed Chapter 11 petitions in Delaware on 8 December 2023, with a stalking-horse credit bid of not less than US$50 million from BTC Near Holdco LLC . The court approved the sale of substantially all its assets to that buyer on 22 February 2024, the sale closed on 1 March, and a Form 15-12G deregistration was filed on 28 March 2024 .

Azira operates as Azira LLC in Pasadena and claims 13 trillion location signals and 43 million points of interest. No filing, registry record or Azira statement opened names Near, so the lineage from Near's assets to Azira is this review's inference . The Chapter 11 plan was a plan of liquidation, so on that inference Azira is the buyer's business, not a reorganised Near .

Consolidation since 2019, by class

OWNERSHIP, INSOLVENCY, REBRAND AND RETIREMENT EVENTS, 2017 TO THE CUTOFF2017201820192020202120222023202420252026cutoff 24 Oct 2026Completed acquisitionsAnnounced deals, mergersInsolvencyRebrands, splitsSDK removals, retirements15 Jun 2019: Foursquare buys Placed completed Completed acquisitions Sources: LOC-D-S12, LOC-D-S13Foursquare buys Placed16 Aug 2019: InMarket buys Thinknear completed Completed acquisitions Sources: LOC-D-S23, LOC-D-S24InMarket buys Thinknear15 Feb 2022: Precisely buys PlaceIQ completed Completed acquisitions Sources: LOC-D-S39, LOC-D-S40Precisely buys PlaceIQ12 Dec 2023: Perion buys Hivestack completed Completed acquisitions Sources: LOC-D-S44Perion buys Hivestack3 Feb 2025: T-Mobile buys Vistar completed Completed acquisitions Sources: LOC-D-S01, LOC-D-S02T-Mobile buys Vistar3 Mar 2025: T-Mobile buys Blis completed Completed acquisitions Sources: LOC-D-S01T-Mobile buys Blis6 Apr 2020: Foursquare and Factual merge announced Announced deals, mergers Sources: LOC-D-S14, LOC-D-S15Foursquare and Factual merge10 Sep 2020: InMarket buys NinthDecimal assets announced Announced deals, mergers Sources: LOC-D-S21, LOC-D-S22InMarket buys NinthDecimal assets5 Aug 2021: Digital Envoy buys X-Mode announced Announced deals, mergers Sources: LOC-D-S32Digital Envoy buys X-Mode3 Nov 2022: Advan buys SafeGraph Patterns announced Announced deals, mergers Sources: LOC-D-S41Advan buys SafeGraph Patterns29 Nov 2023: Unacast and Gravy merge announced Announced deals, mergers Sources: LOC-D-S37Unacast and Gravy merge25 Nov 2025: Broadsign buys Place Exchange announced Announced deals, mergers Sources: LOC-D-S45, LOC-D-V02Broadsign buys Place Exchange25 Mar 2026: ZeroToOne.AI buys GroundTruth announced Announced deals, mergers Sources: LOC-D-S28, LOC-D-S27, LOC-D-S29ZeroToOne.AI buys GroundTruth18 Sep 2026: Infillion to buy Foursquare* announced Announced deals, mergers Sources: LOC-D-S19, LOC-D-S20, LOC-U-S07, LOC-U-V02Infillion to buy Foursquare*8 Dec 2023: Near files Chapter 11 insolvency filing Insolvency Sources: LOC-D-S03Near files Chapter 111 Mar 2024: Near assets sold to Blue Torch completed Insolvency Sources: LOC-D-S04, LOC-D-S03Near assets sold to Blue Torch15 Jun 2017: xAd becomes GroundTruth rebrand or split Rebrands, splits Sources: LOC-D-S26xAd becomes GroundTruth5 Aug 2021: X-Mode becomes Outlogic rebrand or split Rebrands, splits Sources: LOC-D-S32X-Mode becomes Outlogic23 Feb 2022: Spectus split from Cuebiq rebrand or split Rebrands, splits Sources: LOC-D-S36, LOC-D-S35Spectus split from Cuebiq22 Mar 2024: Near business as Azira rebrand or split Rebrands, splits Sources: LOC-D-V01Near business as Azira15 Dec 2020: Apple and Google bar X-Mode SDK platform SDK removal SDK removals, retirements Sources: LOC-D-S34, LOC-G-V04, LOC-G-V05Apple and Google bar X-Mode SDK23 Feb 2021: Cuebiq sunsets its own SDK retired SDK removals, retirements Sources: LOC-D-S34Cuebiq sunsets its own SDK1 Jan 2023: SafeGraph Patterns retired retired SDK removals, retirements Sources: LOC-D-S42SafeGraph Patterns retired15 Dec 2024: Foursquare City Guide app retired retired SDK removals, retirements Sources: LOC-D-S16Foursquare City Guide app retiredcompletedannouncedinsolvency filingrebrand or splitplatform SDK removalretiredEach event is dated by the source that settles it (shared rule 11). * Infillion announced on 18 September 2026 that it would acquireFoursquare; by 24 October Foursquare’s homepage and its co-founder said the deal had happened, but no closing release, filing or date wasfound. Broadsign’s release says it has acquired Place Exchange; ZeroToOne.AI’s says it has acquired GroundTruth; neither gives terms. Near’splan of liquidation took effect on 27 March 2024 and its equity was cancelled. The X-Mode SDK removal (December 2020) is dated from tradepress, with no platform statement. Cuebiq kept an open-source SDK after retiring its own. Kochava’s data business moved to Collective DataSolutions after June 2023; the move is undated and not plotted.
Five companies were sold or agreed to be sold in 2025 and 2026, among them Vistar, Blis, GroundTruth and Foursquare. Acquisitions, mergers, the Near insolvency, rebrands, splits, SDK removals and product retirements in the location universe since 2017, from filings, releases and trade reports (stream D, corrected by its verifier and the review rounds). T-Mobile completed its purchases of Vistar Media on 3 February 2025 and of Blis on 3 March 2025, transferring US$621 million and US$180 million in cash.Units: dates · Scope: companies and products in the vendor universe, 2017 to the cutoff · Sources Events are classified, not counted as market exits; no event found documents a failure of a location metric as its cause. Funding rounds, marketplace listings and regulatory orders are in other figures and tables.Data: data/figure-data.json#events

Q3 is a coding question, and its rule reads no event as evidence that location data or a method failed unless a source establishes the cause. Foursquare bought Placed from Snap in June 2019, for US$66.9 million of purchase consideration in Snap's filing . Telenav sold Thinknear to inMarket on 16 August 2019 for a 14.5% member interest valued at US$15.6 million . InMarket bought NinthDecimal's assets in a deal reported on 10 September 2020, not in 2019 as the seed list had it . Advan Research bought SafeGraph's Patterns business in November 2022, a product retirement for SafeGraph . Qualcomm acquired Skyhook, an early Wi-Fi positioning supplier, in May 2022 . Media and Games Invest agreed in January 2020, through its subsidiary gamigo, to buy substantially all the assets of Verve Wireless, and renamed itself Verve Group SE on 13 June 2024, a rebrand .

Neither merger in the record has a completion date in the sources opened. Foursquare and Factual announced theirs on 6 April 2020 . Unacast and Gravy announced theirs on 29 November 2023 with no structure stated . Cuebiq's clean room was split out as Spectus in February 2022, a restructuring . On 24 October 2026 spectus.ai redirected to cuebiq.com; whether Spectus has been folded back is an inference from the redirect, not an established event .

Several events touch supply directly. Apple and Google barred apps from using X-Mode's SDK in December 2020, which this review found only in trade reporting . Cuebiq announced on 23 February 2021 that it was sunsetting its proprietary SDK in favour of a clean-room product, keeping an open-source version . Foursquare retired its City Guide app on 15 December 2024 and the web version on 28 April 2025 . Its consumer apps supply the check-ins it uses as visit ground truth and its first-party panel , and the retirement page does not say whether City Guide contributed to that panel . Lifesight's 2026 homepage names no footfall or location product, coded as a pivot by inference . Arity announced on 16 October 2026 that it would acquire INRIX's assets, expected to close in 2026 .

Panels in incompatible units

Every scale figure found carries its own definition. The table keeps each with its date and unit as published ; none forms a US series on one definition from before 2021 to after 2023 .

VendorFigure as publishedUnit and dateEvidence
SafeGraph28,914,920 opted-in devices, by carrierOne release, July 2020; not a monthly series
InMarket"About 100 million unique devices" sending location each yearFTC complaint, January 2024; each year from 2016
InMarket"200 million+ Location-based consumers" and other figuresCurrent pages, no period
Foursquare100 million monthly US devices; 500 million worldwide; 250 million US devices of "aggregated coverage"May 2019; April 2020; September 2026
Placer.ai"Over 20 million active devices" to "roughly 30 million mobile devices"May 2022 to September 2026; one monthly basis
Gravy and UnacastMore than 17 billion signals from around a billion devices daily; "more than 1 billion monthly devices across 180+ countries"FTC release, December 2024; product page, undated; global
Advan"45M U.S. & 65M global devices"At access, 24 October 2026; no period
GroundTruth95 million "active monthly users"June 2017; no current US figure
Blis"370m opted-in global planning and measurement panel"August 2021; global
Near1.6 billion "unique user IDs"March 2023; no geography

The figures cannot be read as trends. Foursquare's 100 million US devices in 2019 and 250 million in 2026 look like growth, but the 2026 term is undefined and may include partner or bidstream data . Placer's own figures range from about 7% to about 9% of the US population, and only a city fact sheet gives a monthly basis . Placer also restates its history when it changes its model, so its series read at two dates can differ for the same past period .

Where the supply comes from

Several vendors document sources other than an SDK of their own, without proportions . Unacast says it chose to license data "instead of collecting location data through our own SDK", from aggregators representing SDKs across tens of thousands of apps . Azira's measurement panel blends SDK integrations with bidstream location from the bid requests of over 100,000 apps . Foursquare names its own apps and vetted third-party partners, plus card transactions mapped to places . Foursquare also infers TV exposure by joining viewership data with ad run-logs , without naming the viewing-data supplier; no opened cohort A documentation names Samba, the TV data company where the author works . Placer documents background location from partner apps that carry its SDK, and no source opened documents bidstream use .

Regulators' records describe aggregation too . The FTC alleged that Gravy collected no data directly from consumers and bought from suppliers who may draw on the mobile advertising marketplace . Its Mobilewalla order bans collecting data from real-time bidding exchanges for purposes other than taking part in the auctions, which documents an allegation, not an admission .

Foursquare adjusts its projection weights for technical changes such as an OS update and names iOS 13 among the causes of step changes in raw visits; the documentation opened gives no size or direction for them . Cuebiq's CEO cited privacy and security risk for the SDK sunset; the article, not Cuebiq, linked the move to Apple's tracking changes . Chapter 3 dates the permission changes themselves.

Marketplaces and resale

Location data also moves through marketplaces. Foursquare documented AWS Data Exchange from 13 November 2019 and Snowflake from 8 February 2021 . Placer delivers through its API, bulk feeds, private Snowflake sharing and the Bloomberg Terminal; this review found no public marketplace listing for Placer in the searches logged . Outlogic licenses an "Observation Panel", attribution data and audiences through Snowflake, AWS S3, a REST API, Eyeota and Adsquare . Datarade's foot-traffic category, headed "40 Foot Traffic Data Providers" on 24 October 2026, adds sellers not in the seed list, with self-reported figures . At least three location sellers screened, Unacast, Veraset and Complementics, also sell links between mobile advertising IDs and hashed emails or IPs . Marketplace discovery is incomplete: this review found no Databricks listing for five named vendors in the searches logged, and the universe sweep did not screen the Snowflake Marketplace or AWS Data Exchange search pages .

H1, coded by the rule

H1 states that SDK-sourced precise location supply to US vendors contracted after the 2019 to 2021 permission changes and that vendors substituted other sources. The registered rule needs either two vendors' series falling on a constant definition, or a filing or official statement attributing a supply reduction to a named platform change, and at least one vendor documenting a shift of primary source away from SDK supply. Vendor commentary without a figure does not support on its own, and absence of a comparable series is unresolved, not contradicted. Foursquare's iOS 13 note gives neither a size nor a direction . In the filings, statements and vendor pages opened, no US vendor discloses a series on one definition that spans a pre-2021 and a post-2023 figure, so H1 is unresolved on this evidence . Cuebiq's partial SDK sunset is a documented shift away from own-SDK supply, with no panel figure . Read literally, InMarket's flat 100 million devices a year from 2016 would count against contraction for that vendor, but it is one rounded allegation, not a series . The absence holds only for the sources screened. Two vendors' disclosed US series on one definition from before 2021 to after 2023, or a filing attributing a supply reduction to a named platform change, would let the rule decide it (chapter 13).

Chapter 3

What Apple and Google changed

Between 2019 and 2021 Apple and Google split background location from foreground use, added a one-time grant and let users hand apps an approximate location instead of a precise one. Google Play also put background location under review and now bars the sale of device location. The platforms' own pages date each change. What the changes did to US SDK supply is another matter. In the sources screened, no filing, official statement or independent measurement puts a number on it. The one platform figure found counts permission choices, and the vendors that name a change give no size.

In short

Apple shipped Allow Once in iOS 13 on 19 September 2019 and approximate location in iOS 14 on 16 September 2020 . App Tracking Transparency (ATT) became mandatory with iOS 14.5 on 26 April 2021 . Android 10 (3 September 2019) separated background location, Android 11 (from 8 September 2020) added a one-time grant and Android 12 (pushed to AOSP on 4 October 2021) added approximate location . Google Play's policy, read on 24 October 2026, prohibits selling device location and never permits it solely for advertising or analytics . The later changes are narrower: privacy manifests enforced from 1 May 2024, a WWDC24 model that ties Always authorization to a session started in the foreground, Private Relay for Safari and insecure app traffic, and Chrome's IP Protection, listed for retirement on 17 October 2025 . The December 2020 removal of X-Mode's SDK from both app stores rests on trade reporting, not on a platform statement . Google's statement that over half of Android 10 users chose "While app is in use" is the only effect figure a platform attributes to a change, and it measures grants, not supply . Foursquare, Near and a trade article on Cuebiq name platform changes without a figure, which the Q4 rule codes asserted . In the sources screened, nothing attributes a quantified change in US SDK-sourced location supply to a named Apple or Google permission change .

How the changes are dated

The registered Q4 rule dates a change only from the platform's own documentation, and keeps announcement, release and enforcement dates apart. It codes an effect documented when a filing, official statement or independent measurement attributes it to the change, asserted when vendor commentary names the change without a figure, and coincident when a disclosed series moves at the same time with no attribution. A change whose effect no source attributes carries no code, and that absence is not evidence of no effect . The platforms' pages are the settling record for dates. They are the platforms' own statements, and this paper does not treat them as independent evidence of what a change did .

PlatformChangeAnnouncedReleased or effectiveEnforcedEvidence
AppleiOS 13: Allow Once, background tracking alerts, Wi-Fi and Bluetooth protections3 June 201919 September 2019n/a
GoogleAndroid 10: ACCESS_BACKGROUND_LOCATION, allow only while in useNot stated3 September 2019n/a
GooglePlay background-location approval19 February 2020Projected 3 August 2020 (new apps), 2 November 2020 (existing)Existing apps deferred to 2021 on 8 September 2020
GoogleAndroid 11: one-time grant, Allow all the time only in SettingsNot statedRollout from 8 September 2020n/a
AppleiOS 14: approximate location22 June 202016 September 2020n/a
AppleApp Tracking Transparency22 June 2020; deferred 3 September 202026 April 2021 (iOS 14.5)26 April 2021
AppleiCloud Private Relay (public beta, iCloud+)Not stated20 September 2021 (iOS 15)n/a
GoogleAndroid 12: approximate locationNot statedAOSP 4 October 2021n/a
GooglePlay Data safety section6 May 2021Visible 26 April 2022Mandatory after 20 July 2022
ApplePrivacy manifests and required-reason APIsWWDC23; "spring 2024" on 7 December 2023; dated 29 February 2024Warnings from 13 March 2024Uploads rejected from 1 May 2024
AppleWWDC24 authorization model (CLServiceSession)WWDC24iOS 18, 16 September 2024n/a
GooglePrivacy Sandbox and IP Protection retirement17 October 2025No dates givenn/a
APPLE AND GOOGLE LOCATION-PERMISSION AND POLICY CHANGES, 2019 TO 2027201920202021202220232024202520262027cutoff 24 Oct 2026Apple: iOS releasesApple: App Store rulesGoogle: Android releasesGoogle: Play and Chrome19 Sep 2019: iOS 13: Allow Once, background alerts OS release with a change Apple: iOS releases Sources: LOC-G-S01, LOC-G-S02, LOC-G-S03iOS 13: Allow Once, background alerts16 Sep 2020: iOS 14: approximate location OS release with a change Apple: iOS releases Sources: LOC-G-S04, LOC-G-S05, LOC-G-S06iOS 14: approximate location20 Sep 2021: iOS 15: Private Relay beta OS release with a change Apple: iOS releases Sources: LOC-G-S19, LOC-G-S17iOS 15: Private Relay beta16 Sep 2024: iOS 18: session-based Always OS release with a change Apple: iOS releases Sources: LOC-G-S14, LOC-G-S15iOS 18: session-based Always15 Sep 2025: iOS 26 release, no location change found Apple: iOS releases Sources: LOC-G-S15iOS 2614 Sep 2026: iOS 27 release, no location change found Apple: iOS releases Sources: LOC-G-S15, LOC-G-V02iOS 2722 Jun 2020: ATT announced announced Apple: App Store rules Sources: LOC-G-S04ATT announced26 Apr 2021: ATT required for all apps store or policy rule in force Apple: App Store rules Sources: LOC-G-S07, LOC-G-S08, LOC-G-S09ATT required for all apps1 May 2024: privacy manifests enforced (no location API) store or policy rule in force Apple: App Store rules Sources: LOC-G-S11, LOC-G-S13, LOC-G-V01privacy manifests enforced (no location API)3 Sep 2019: Android 10: background permission OS release with a change Google: Android releases Sources: LOC-G-S21, LOC-G-S22Android 10: background permission8 Sep 2020: Android 11: one-time grant OS release with a change Google: Android releases Sources: LOC-G-S24, LOC-G-S25Android 11: one-time grant4 Oct 2021: Android 12: approximate option OS release with a change Google: Android releases Sources: LOC-G-S26, LOC-G-S27Android 12: approximate option19 Feb 2020: Play background-location review announced Google: Play and Chrome Sources: LOC-G-S23Play background-location review3 Aug 2020: review starts for new apps store or policy rule in force Google: Play and Chrome Sources: LOC-G-S23review starts for new apps20 Jul 2022: Data safety form required store or policy rule in force Google: Play and Chrome Sources: LOC-G-S34, LOC-G-S35Data safety form required17 Oct 2025: Sandbox and IP Protection retired announced Google: Play and Chrome Sources: LOC-G-S37, LOC-G-V03Sandbox and IP Protection retired27 Jan 2027: location button (announced Apr 2026) takes effect after the cutoff Google: Play and Chrome Sources: LOC-G-S32, LOC-G-S30location button (announced Apr 2026)OS release with a changestore or policy rule in forceannouncedrelease, no location change foundtakes effect after the cutoffDates are from the platforms’ own pages: release dates for OS changes, effective dates for store rules, announcement dates where nothing tookeffect. iOS 26 and iOS 27: no change to the location permission found in the Apple pages screened. Privacy manifests gate required-reasonAPIs, none of which is a location API. Google’s 2020 background-location review was projected for 3 August 2020 for new apps; enforcement forexisting apps was deferred to 2021. Android 13 to 16 were not screened. Chrome’s IP Protection, listed for retirement on 17 October 2025,applied only to third-party requests in Incognito; whether it reached Stable is not established. The Play location button applies to appstargeting Android 17 from 27 January 2027.
Most platform location-permission changes date from 2019 to 2021; Apple’s last was in iOS 18, and Google’s next documented change takes effect in January 2027. Apple and Google location-permission and policy changes since 2019, from the platforms’ release notes, developer pages and policy posts (stream G, corrected by its verifier). No filing, platform statement or independent measurement in the sources screened attributes a quantified change in US SDK location supply to any of these changes.Units: dates · Scope: Apple and Google platform documentation, 2019 to the cutoff · Sources Timing is not effect: a coincidence in time between a platform change and a vendor’s supply is recorded as a coincidence (Q4 rule). Google Play’s ban on selling device location has no settled start date and is not plotted.Data: data/figure-data.json#platform

Apple

Apple announced a one-time location option and background-use information on 3 June 2019 and shipped them in iOS 13 on 19 September 2019, as Allow Once, background tracking alerts and Wi-Fi and Bluetooth protections against location inference .

iOS 14, released on 16 September 2020, let users give an app approximate location instead of precise. Apple's WWDC20 session says apps cannot opt out. A reduced-accuracy fix is quantised to a region with a typical radius of about five kilometres, a couple of kilometres in dense cities and ten or more in rural areas, recomputed about four times an hour. Region monitoring requires full accuracy . Under this paper's definitions (Chapter 1), an approximate fix is coarse location . This review found no Apple statistic on how many users choose it .

ATT is a tracking rule, not a location permission. Apple announced it on 22 June 2020 as an iOS 14 requirement, deferred it on 3 September 2020 to "early next year" and made it mandatory for all apps on 26 April 2021 with iOS 14.5. Apple's definition of tracking includes sharing user or device data with data brokers .

Privacy manifests followed. Apple introduced them, with SDK signatures and required-reason APIs, at WWDC23. On 29 February 2024 it dated the requirement: warning emails from 13 March 2024 and, from 1 May 2024, rejection of uploads that use a required-reason API without an approved reason. Tracking domains declared in a manifest are blocked unless the user has granted ATT permission . Whether any location API is a required-reason API is not established here, because the category list could not be read . Radar's iOS SDK manifest, last changed on 1 June 2024, shows what a location vendor declares: precise and coarse location collected and linked to the user, tracking set to false, and purposes limited to app functionality and analytics . That is the vendor's own declaration.

At WWDC24 Apple introduced CLServiceSession. Under it, Always authorization is effective only while the app holds a session started in the foreground, and approximate location is delivered only every 15 to 20 minutes. iOS 18 shipped on 16 September 2024 . The 2020 figure of four recomputations an hour and the 2024 figure for delivery are both Apple's, and this review does not reconcile them . iOS 26 shipped on 15 September 2025 and iOS 27 on 14 September 2026. Apple's Core Location change log lists no change after June 2024, and the Apple pages screened show no change to the user-facing location permission in either release. The WWDC25 and WWDC26 session listings were not opened .

iCloud Private Relay acts on IP, not on the location permission. It shipped as a public beta with iOS 15 on 20 September 2021 for iCloud+ subscribers who enable it. It replaces the client IP with a relay IP that maps by default to a roughly city-level area, chosen from a four-character geohash of roughly 800 km2, or only to country and time zone. It covers Safari, DNS queries and insecure HTTP app traffic, and leaves HTTPS in-app traffic and its IP geolocation untouched . No Apple adoption figure was found, so the share of traffic affected is unknown .

Google

Android 10, released on 3 September 2019, made background location a separate permission, ACCESS_BACKGROUND_LOCATION, and let users allow location only while an app is in use. Apps targeting Android 9 or lower had background access added automatically. Wi-Fi and Bluetooth scanning began to require fine location for apps targeting Android 10, and MAC addresses were randomised by default .

Android 11 began rolling out on 8 September 2020. It added a one-time grant, "Only this time", and removed the background option from the runtime dialog, so "Allow all the time" can be set only in Settings. Apps targeting Android 11 must request background location separately, and unused apps have their permissions reset . Android 12, pushed to AOSP on 4 October 2021, lets users grant only approximate location even when an app asks for precise, in the dialog or in Settings for any app. Google documents approximate location as accurate to within about 3 square kilometres .

Google Play moved alongside the OS. On 19 February 2020 it announced that background location would need approval, with a projected timeline, subject to change, of 3 August 2020 for new apps and 2 November 2020 for existing ones. On 8 September 2020 it said it would not enforce the policy for existing apps until 2021 . The final 2021 date was not read from a Google page . The current policy limits all device location, foreground and background, to functions central to the app's core purpose, never permits it solely for advertising or analytics, and reserves background access for critical features .

The Play policies, as read on 24 October 2026, list device location as personal and sensitive user data and prohibit selling it, where a sale is a transfer to a third party for money. Developers must ensure their SDK providers do not sell it. The Permissions policy adds "Don't sell device location" . The pages carry no last-updated dates, so when the sale clause entered is not established . The FTC's January 2024 complaint records a paid SDK market: the X-Mode SDK sat in more than 300 apps, and X-Mode paid developers per device whose location it collected .

The Data safety section was pre-announced on 6 May 2021, shown to users from 26 April 2022 and mandatory after a grace period ending 20 July 2022. Declarations must cover data collected through third-party SDKs and location inferred from IP address. They define approximate location as an area of at least 3 km2 and precise location as less than that . The labels are self-declared, and the threshold differs from the radius definitions in state laws (Chapter 7) .

On the buying side, Google's Authorized Buyers guidelines (last updated 15 May 2026) state that Google does not share precise location through the programme. Precise location a buyer receives by other means may be used only to bid on that impression and kept no longer than that needs. Program Data may not be sold, and non-aggregated Program Data may be kept for at most 18 months . The guidelines bind Google's exchange only . Prebid coarsens coordinates only when a rule or privacy module denies precise geo, its default is to allow, and its Android mobile SDK sets no precision limit by default . Chapter 6 takes up bidstream-derived location.

Chrome's IP Protection was designed for Incognito mode only, for third-party requests to listed domains, through a two-hop proxy whose IPs represent coarse location with a public city-level geofeed. Google said it would reach Chrome Stable no sooner than July 2025 . On 17 October 2025 Google announced the retirement of the Attribution Reporting API, Protected Audience and Topics on Chrome and Android, of SDK Runtime and of IP Protection, among others, with no retirement dates. CHIPS, FedCM and Private State Tokens continue . Google's documentation classed IP Protection by 14 August 2026 as scheduled for phase-out with no date, and whether it ever reached Stable is not established .

The X-Mode SDK removal

In December 2020 Apple and Google barred apps in their stores from using X-Mode's SDK. This review found the event only in trade reporting, from AdExchanger in February 2021, and opened no statement by either platform . Under the Q4 rule the date therefore stands as reported, not as documented by the platforms. It is coded a platform SDK removal under Q3, not a regulatory event . The FTC's January 2024 complaint against X-Mode Social and Outlogic does not mention the removal . Chapter 7 covers the order.

What sources attribute to the changes

SourceChange namedWhat it statesQ4 codeEvidence
Google, 19 February 2020Android 10 location optionsOver half of users select "While app is in use"; many apps asking for background location did not need itDocumented, for permission grants; no vendor panel
Foursquare methodology documentationiOS 13, OS updatesNames iOS 13 among causes of step changes in raw visits and reweights to offset them; no sizeAsserted
Near Intelligence S-4/A, February 2023iOS 14 approximate location, iOS 14 and 15 opt-in measures, Android 12Lists them under "key trends around the lack of precise location data"; no figure for its own supplyAsserted
Trade article on Cuebiq, 23 February 2021ATT, set beside the move by the articleCuebiq sunsets its proprietary SDK for a clean room; its CEO cites privacy and security riskAsserted; the link to ATT is the article's
Working-paper abstract, April 2022ATTCollection frequency from iOS devices fell for one multi-app providerDocumented for direction only (independent measurement); no size
SafeGraph sampling rate, academic readingNoneDips 2020-2021 and recovers in 2022; authors cite the pandemicCoincident at most
Telenav 10-Ks, FY2019 and FY2020NoneNo mention of iOS 13 or location permissionsNo effect coded

The one figure a platform attaches to a change is about choices. Google said on 19 February 2020 that on Android 10 "over half of users select 'While app is in use'" when offered the new options . It describes user decisions, not the volume of observations reaching SDK vendors, and cannot be turned into a supply change. No equivalent Apple figure was found .

Vendors that name a change give no size. Foursquare adjusts its normalised-visit weights for "changes to how we calculate a visit in our SDK due to an OS update", and names iOS 13 as one cause of step changes in raw visits . Near's registration statement treats the platform changes as market trends and attributes no change in its own supply to them . Cuebiq's sunset of its proprietary SDK in February 2021 is a documented partial shift away from its own SDK supply, with no panel figure. The ATT link comes from the article, not from Cuebiq .

The independent evidence is thin and indirect. An April 2022 working-paper abstract, using data from more than 7 million iOS and Android devices, reports that collection from iOS devices fell after ATT, both because devices went unobserved and because observed devices sent fewer pings. It names no vendor and gives no size in the abstract read . In this paper's reading it attributes a direction to ATT, which is a tracking rule rather than a location permission . SafeGraph's residing-device sampling rate fell from 8.1% in 2019 to 7.2% in 2020 and 6.6% in 2021, then rose to 8.5% in 2022. The authors attribute the fall to the pandemic and do not discuss the permission changes, so the series is at most coincident with them .

The bounded finding

In the sources screened by the cutoff, this review found no filing, official platform statement or independent measurement that attributes a quantified change in US SDK-sourced location supply to a named Apple or Google permission change. Telenav, which sold its Thinknear advertising business to inMarket under an agreement dated 8 August 2019, does not mention iOS 13 or location permissions in its FY2019 and FY2020 10-Ks. EDGAR full-text searches for 10-Ks pairing location data with ATT, iOS 13 or background location returned no location vendor . The search has limits. Foursquare, Placer.ai, InMarket, GroundTruth and Blis are private and file no 10-K or 10-Q reports, the filings these searches covered (Placer Labs has filed Form D notices of private offerings), and the stream that ran these searches did not screen vendor blogs . Under the Q4 rule, an absence of attribution is not evidence of no effect.

The absence matters for H1. No US vendor in the sources opened discloses a panel series on one definition from before 2021 to after 2023, so H1 is unresolved on this evidence (Chapter 2) . Published validation has the same gap in time. Every independent SafeGraph ground-truth comparison found uses data from 2018 to 2020, so it describes panels before or during the changes, not at the cutoff (Chapter 4) .

What the documentation does establish is where the changes reach. The OS permissions govern what an SDK may collect, and approximate grants deliver coarse location by design . Radar's SDK, for example, requests an accuracy level from the OS, and what it receives depends on the device, the environment and the user's choice . The IP measures cover Safari and insecure app traffic for subscribers who opt in, and Incognito third-party requests in Chrome, which is being withdrawn . Outside Google's exchange, bid requests may carry device coordinates under each exchange's own terms, and Prebid coarsens them only when a publisher rule or privacy module denies precise geo . A buyer can ask a vendor which permission level its panel devices granted, and whether its source mix changed after 2020, with figures (Chapter 12).

Chapter 4

Do the numbers match the ground?

The test that would settle it is missing from the record screened. In the sources screened by the cutoff, no independent study compares a vendor's projected retail visits with door counts or transactions across many places and months, and no vendor publishes a held-out validation with error statistics on the pages opened. The independent checks that exist are narrow and old: a 2018 polling-place audit of SafeGraph's panel, park and trail counts from 2018 to 2021, and one trail-site check of Placer.ai. H2 is unresolved overall, with adverse historical evidence for SafeGraph's 2018 panel.

In short

In the sources screened by the cutoff, this review found no independent comparison of any named vendor's projected retail visits with door counts or transactions across many places and months, and no vendor publishes a held-out validation with error statistics on the pages opened . Census comparisons show SafeGraph's device counts tracking population closely at county level and less closely at tract level; they test who is in the panel, not whether visits are counted correctly . A 2018 audit against North Carolina's voter file found lower coverage at polling places with older and with more non-white voters . In Yellowstone, SafeGraph visits at the two most-visited points of interest correlated with official monthly visits at 0.85 and 0.88; at one Minnesota recreation area, Placer.ai's total ran 30.5% above trail counters in a comparison that is not like for like . Every independent SafeGraph ground-truth comparison found uses 2018-2020 data, so published validation does not describe the panels as they were at the cutoff . Azira's vendor-asserted correlation of 0.85 and median absolute percent error of 10%, the only such comparison in the cohort A documentation opened, comes with no design, sample, period or places . The bidstream accuracy series found are vendor-run and date from 2014 to 2019, and no peer-reviewed measurement with published statistics was found . In randomised Facebook benchmarks, matching and regression methods mostly overstated lift . H2 is unresolved overall, with adverse historical evidence for SafeGraph's 2018 panel and use .

H2 says that published visit estimates from US location-measurement and location-intelligence products agree with independent ground-truth counts (door counters, transactions, official visitor counts) within the error the vendor states. Its registered rule counts two kinds of test: a comparison with a published method by a party without a financial interest, and a vendor comparison with a held-out design and published method. Support is recorded per product and per place type, and it does not carry to a different panel vintage. Absence of accessible comparisons codes as unresolved, not contradicted (Chapter 13).

MRC's 2017 location guidelines set the industry's own bar: they encourage first-party "ground truth" validation and set a general expectation of less than 5% error on primary reported characteristics, with disclosure above that . Projected visits, as Chapter 1 defines them, are observed panel counts scaled to a population by a model. Placer.ai's visit numbers are projections of this kind, and its own example scales 74.8 thousand panel visits to 2.4 million . Studies the searches did not surface could exist .

INDEPENDENT COMPARISONS OF PANEL COUNTS WITH GROUND TRUTH, BY REFERENCE TYPECensus populationPark or trail countersPolling-place turnoutRetail door counts ortransactionsSafeGraph Patterns Census population: 2018–22 Park or trail counters: 2018–20 Polling-place turnout: 2018 Retail door counts or transactions: None found in the sources screened census: Li et al. 2024 (county r 0.986 urban, 0.934 rural, 2019); parks: Liang et al. 2022, Kupfer et al. 2021; polling: Coston et al. 2021 Sources: LOC-B-S02, LOC-B-S03, LOC-B-S04, LOC-B-S05, LOC-B-S01SafeGraph PatternsSafeGraph Patterns Census population: 2018–222018–22SafeGraph Patterns Park or trail counters: 2018–202018–20SafeGraph Patterns Polling-place turnout: 20182018SafeGraph Patterns Retail door counts or transactions: None found in the sources screenedAdvan Weekly Patterns Census population: None found in the sources screened Park or trail counters: 2019–23 Polling-place turnout: None found in the sources screened Retail door counts or transactions: None found in the sources screened NPS visitation, ten parks, r 0.875 by visual check Sources: LOC-B-S07Advan Weekly PatternsAdvan Weekly Patterns Census population: None found in the sources screenedAdvan Weekly Patterns Park or trail counters: 2019–232019–23Advan Weekly Patterns Polling-place turnout: None found in the sources screenedAdvan Weekly Patterns Retail door counts or transactions: None found in the sources screenedPlacer.ai Census population: None found in the sources screened Park or trail counters: 2021 Polling-place turnout: None found in the sources screened Retail door counts or transactions: Vendor claim; no design or result published one trail site, +30.5% over counters; accuracy page names transactions and revenues, no result Sources: LOC-B-S06, LOC-B-S34Placer.aiPlacer.ai Census population: None found in the sources screenedPlacer.ai Park or trail counters: 20212021Placer.ai Polling-place turnout: None found in the sources screenedPlacer.ai Retail door counts or transactions: Vendor claim; no design or result published Shown as: vendor claimvendor claimStreetLight Census population: None found in the sources screened Park or trail counters: 2021 Polling-place turnout: None found in the sources screened Retail door counts or transactions: None found in the sources screened same site, +43.5% over counters Sources: LOC-B-S06StreetLightStreetLight Census population: None found in the sources screenedStreetLight Park or trail counters: 20212021StreetLight Polling-place turnout: None found in the sources screenedStreetLight Retail door counts or transactions: None found in the sources screenedCuebiq Census population: period not stated Park or trail counters: None found in the sources screened Polling-place turnout: None found in the sources screened Retail door counts or transactions: None found in the sources screened UW 2022 device-to-population bias, 11 MSAs, vintage not stated Sources: LOC-B-S12, LOC-B-S11CuebiqCuebiq Census population: period not statedperiod not statedCuebiq Park or trail counters: None found in the sources screenedCuebiq Polling-place turnout: None found in the sources screenedCuebiq Retail door counts or transactions: None found in the sources screenedVeraset (Mexico) Census population: 2020 Park or trail counters: None found in the sources screened Polling-place turnout: None found in the sources screened Retail door counts or transactions: None found in the sources screened 2,478 municipalities against the 2020 census Sources: LOC-B-S08Veraset (Mexico)Veraset (Mexico) Census population: 20202020Veraset (Mexico) Park or trail counters: None found in the sources screenedVeraset (Mexico) Polling-place turnout: None found in the sources screenedVeraset (Mexico) Retail door counts or transactions: None found in the sources screenedAzira Census population: None found in the sources screened Park or trail counters: None found in the sources screened Polling-place turnout: None found in the sources screened Retail door counts or transactions: Vendor claim; no design or result published white paper: median absolute error 10% against sales and counters; no design Sources: LOC-E-S18AziraAzira Census population: None found in the sources screenedAzira Park or trail counters: None found in the sources screenedAzira Polling-place turnout: None found in the sources screenedAzira Retail door counts or transactions: Vendor claim; no design or result published Shown as: vendor claimvendor claimUnacast Census population: None found in the sources screened Park or trail counters: None found in the sources screened Polling-place turnout: None found in the sources screened Retail door counts or transactions: Vendor claim; no design or result published R-squared 91.6% against one unnamed retailer; no places, period or sample Sources: LOC-UNACAST-S16, LOC-UNACAST-S11UnacastUnacast Census population: None found in the sources screenedUnacast Park or trail counters: None found in the sources screenedUnacast Polling-place turnout: None found in the sources screenedUnacast Retail door counts or transactions: Vendor claim; no design or result published Shown as: vendor claimvendor claimIndependent comparison (cell: data period)Vendor claim; no design or result publishedNone found in the sources screenedCells give the period of the data compared. SafeGraph: county and tract populations 2018–2022 (Li et al.; urban-tract r-squared fell from0.651 to 0.375), NPS and counter series 2018–2020 (Liang et al., Kupfer et al.), in-person turnout at 558 North Carolina polling places in2018 (Coston et al.; SafeGraph supplied the data and feedback). Advan: NPS visitation 2019 to January 2023, by visual check. Placer.ai andStreetLight: one Minnesota trail site, summer 2021, 30.5% and 43.5% above counters, not like for like. Vendor claims: Placer.ai namestransactions and store revenues as references without results; Azira reports a 10% median absolute error with no design; Unacast an R-squaredof 91.6% against one unnamed retailer. A 2016 NBER paper links device foot-traffic proxies to firm-level sales without naming the vendor; itis not place-level.
No independent comparison with retail door counts or transactions was found for any named vendor; the third-party checks that exist use census, park and polling-place counts. Each panel or vendor against four kinds of reference count. A third-party comparison is one with a published method by a party other than the vendor; it counts as independent only where its funding is stated, and four of the studies charted (Kupfer, Leslie, Choi, UW 2022) state none. The retail column holds only vendor claims. The third-party comparisons that exist are historical and narrow: the newest data end in January 2023, so no comparison covers a panel vintage sold at the cutoff.Units: data period of each comparison · Scope: comparisons found in the sources screened by the cutoff; US unless marked · Sources Absence is bounded to the searches logged in stream B and its verifier. Agreement with census population validates coverage, not visit counts. H2 stays unresolved overall (LOC-B-F31).Data: data/figure-data.json#ground_truth

Who is in the panel

Census comparisons test who is in a panel, not whether its visits are counted correctly . SafeGraph's own 2019 analysis (a vendor blog and notebook) imputed each device's demographics from its home census block group and compared them with national census totals (r = 0.99 for education and income), and compared device counts with county population (r = 0.97; a block-group correlation of 0.176 per Li et al. 2024). It concluded the panel was "well-sampled across demographic categories" and did not test bias in place-specific visit inferences .

An independent census comparison for 2018-2022 put SafeGraph's monthly sampling rate at 7.5% on average, with monthly values from 4.5% to 14.5% across the national, urban and rural series. In 2019, device counts tracked population closely by county (Pearson r 0.986 urban, 0.934 rural) and moderately by tract (r above 0.683 urban, above 0.830 rural), and the urban-tract fit weakened to r-squared 0.375 by 2022 . Hispanic residents were under-represented from March 2020 to July 2021, low-income and low-education groups slightly under-represented, more so during the pandemic, with the pattern reversed at state level in 2022, and most group biases fell within about plus or minus 0.05; rural units were sampled at higher rates than urban ones at tract and block-group level from April 2019 .

Aggregate flows agree with other aggregates, but no ground truth exists for them. SafeGraph-derived county population flows for March-May 2020 correlated with pre-pandemic commuting flows from the American Community Survey (ACS) at 0.974 to 0.985, and with another vendor's mobility indices in five metros at 0.92 or above. The authors state that no ground truth exists for these flows .

Other panels show bias that changes with place and source. The only Veraset coverage study found, a June 2026 preprint on 2,478 Mexican municipalities, finds users concentrated in larger, wealthier and better-connected places, with spatially clustered bias that differs from Facebook's single-app data . Two 2025 preprints find bias in all ten US cities studied but specific to each city, and find that multi-app UK datasets do not necessarily reduce bias relative to single-app sources; the US authors say this raises serious questions about general debiasing approaches . For Cuebiq, a 2017 Federal Highway Administration case study found biases by traveller age and income, and a 2022 University of Washington analysis of 11 metros found the direction of racial bias varying by metro .

Polling places: coverage bias by place

SafeGraph's 2018 panel under-covered polling places with older and more non-white voters. An independent audit tested its point-of-interest data (about 47 million US devices) against North Carolina's 2018 general-election voter file. Polling places with older and with more non-white voters had lower coverage: rank correlations of coverage with the share of voters over 65 of -0.14 (p < 0.001) and with the share of non-white voters of -0.11 (p = 0.0067) . Election-day traffic tracked turnout in rank (0.383, p < 0.001), but place-level estimates were noisy: the root-mean-squared error was 1,375 voters, and polling places that registered 20 marginal SafeGraph devices had roughly 300 to 2,300 actual voters .

Allocating a resource by SafeGraph traffic rather than by actual voters would have under-allocated by 37% to the oldest and most non-white group of polling places and over-allocated by 33% to the youngest and whitest group (both p < 0.05) . This is the adverse evidence in the H2 reading. It covers SafeGraph's 2018 panel and this use, not other products or later vintages .

Parks, trails and one Placer.ai check

Most of the independent ground-truth comparisons found use parks and trails, which keep official counts . A peer-reviewed study of six western national parks compared SafeGraph records with National Park Service (NPS) statistics for 2019-2020 and concluded that device data capture visitation patterns at finer granularity; the abstract read reports no correlation statistic . In Yellowstone, SafeGraph Patterns visits from January 2018 to November 2020 correlated with NPS monthly visits at r = 0.88 and 0.85 for the two most-visited points of interest, with a trail counter's daily counts at 0.76 (2018) and 0.77 (2019), and with park-wide gate vehicle counts at 0.79 in 2019 but 0.47 in 2020, when the compared facility imposed indoor capacity limits . The same study found only 40 of the 80 SafeGraph points of interest inside the park valid, visitor demographics imputed from the ACS differing significantly from the visitor survey on education and income, and no way to assign a home block group to short-term international visitors, 23% of visitors per NPS surveys . Inference: a correlation shows that two series rise and fall together; it does not show that their levels agree.

One later panel has a park check. A 2025 preprint using Advan Weekly Visit Patterns (about 35 million US devices from about 1,000 apps) for January 2019 to January 2023 reports a Pearson correlation of 0.875 with NPS visitation for the ten most-visited parks, a comparison the authors call qualitative and based on visual inspection .

In the only third-party comparison of Placer.ai found, a University of Minnesota Extension case study whose funding is not stated (April 2024) at one recreation area, Placer.ai estimated 13,233 visits and StreetLight 14,544 for 29 May to 6 September 2021, 30.5% and 43.5% above the 10,138 recorded by trail counters. The authors found no statistically significant difference, but the comparison is not like for like: polygons differ, counters cover only the cross-country trails, and events are handled differently . The platforms showed weekends 7 times busier than weekdays, against 2.1 times in the counter averages . Placer.ai's inferred visitor demographics differed significantly from the intercept survey's: 30.8% with a bachelor's degree or higher and 21.8% with household income over US$100,000, against 62% and 61% .

Vintage and restatement

Every independent SafeGraph ground-truth comparison found uses data from 2018-2020, before or during the iOS 13 and 14, App Tracking Transparency and Android 12 changes. The only later third-party comparisons are the Advan park series and the Minnesota case, neither with its funding stated, so published validation does not describe the panels as they existed at the cutoff . The panels moved in the meantime: SafeGraph's sampling rate peaked at 13.4% in May 2022 and dropped to 4.9% in July 2022, a fall the authors say "may relate" to a data-provider disruption . A working-paper abstract (April 2022) reports that one multi-app provider's iOS data collection fell after App Tracking Transparency (Chapter 2) .

Vendors also change the past. Placer.ai's Data Version 2.0 (31 March 2024) updated all historical data from 1 January 2017, and its accuracy page says de-biasing adjustments happen "usually no more than once a year" and "can sometimes impact previously run numbers". A Placer.ai series read at two dates can differ for the same past period .

What vendors say about their own accuracy

The vendor record is assertions without method. Of the documentation opened on 24 October 2026 for the fourteen cohort A products, only Azira's undated white paper reports a comparison with an independent reference: a vendor-asserted median absolute percent error of 10% and a correlation of 0.85 between extrapolated visits and "ground truth sales data and foot traffic counters", with no study design, sample, period or places disclosed . No product publishes such a comparison as a documented study .

VendorWhat it publishesReference namedStatistic and methodEvidence class
AziraWhite paper, undatedSales data and foot-traffic countersCorrelation 0.85, median absolute percent error 10%; no design, sample, period or placesVendor assertion
Placer.aiHome page and help centreBaseball attendance, transactions, store revenues, conference attendees, vehicle counters"+92% accuracy" on the home page; no result, sample or statisticVendor assertion
UnacastTwo postsOne unnamed clothing retailer; 2019 plant headcountsR-squared "of 91.6% or higher", no places, period or holdout; four of five plants "within 20%"Vendor assertion
GroundTruthAudit posts, 2017-2019Receipts from 10,000 matched panelists"94.4% visit accuracy"; no report, period, method or error statisticCommissioned
FoursquareTrend checkPublic financial statements, transaction trendsNo places, period or statisticVendor assertion
InMarketValidation statementsComscore; unnamed "truth sets"No report, date or scopeVendor assertion
Huq (Germany)Footfall page, 6 August 2026"Hundreds of authoritative external sources"Median MAPE 14.5%; references, sites and period unnamedVendor assertion

Several of these measure something other than visit counts. GroundTruth's audit checks whether recorded visits are confirmed, not whether visit counts match a reference, and its help pages later claim "99% accurate as verified by Numerator" . Unacast's plant comparison uses headcount rather than visits . Advan's 2019 "99.5% accuracy of geofences" is a claim about geofence geometry . GroundTruth asserts, without a cited study, that radial geofences measure visits "with up to 75% inaccuracy" . Foursquare's "Third-party verified" item is a Forrester Total Economic Impact study commissioned by Foursquare (June 2022), not a validation . Its visit model trains on check-ins, and a 2013 third-party study of 244 users, funding not stated, found check-ins covered about 10% of the places users visited, with about 75% of check-ins matching no GPS-detected visit .

Third-party and production uses do not fill the gap. A site-selection vendor's blog reports that Placer.ai visit trends and six chains' SEC-reported traffic or transaction figures "agreed on direction 9 times out of 12" across 12 retailer-quarter comparisons . The Federal Reserve Bank of Chicago's weekly retail index lists SafeGraph and Advan Research among its sources and benchmarks to Census retail sales; that is documented production use, not a published validation of visit counts . Geopath reports that its reach model aligns with its own mobile input data to within ±5%, which is not a comparison with an independent count (Chapter 9) . Under the registered rule, a vendor comparison without a held-out design or published method leaves a product unresolved .

Bidstream location: historical and vendor-run

The public series on bidstream location accuracy found in the sources screened are vendor-run and date from 2014 to 2019 . Thinknear's Location Score Index reported in 2014 that 34% of location-bearing impressions were within 100 metres of the user, and its Q1 2015 edition, on more than one billion impressions, put 37% within 100 m and 10% beyond 100 km . A May 2016 edition put 32% within 100 m, the lowest industry score since tracking began . Placed's 2015 analysis of exchange bid requests against its own panel found that 27% carried any location, that 91% of observed business visits generated no ad request and that about 73% of bid requests occurred in transit . Location Sciences, which sold a verification product, said in September 2019 that only 14% of 550 million impressions it verified carried high-quality GPS signals . Cuebiq's 2017 paper cites a 2015 MMA report for "less than 33%" of exchange location data being accurate within 100 metres; neither the stream nor its verifier could read the report .

Verification vendors have their own interests. Location Sciences' 2019 verification of Blis was a paid engagement; in March 2021 Location Sciences stated that Blis threatened legal action after Verify reported "data manipulation", and Adweek reported that Blis denied the allegations . This review found no peer-reviewed measurement of bidstream location accuracy with published statistics, on web searches only; the ACM, IEEE, USENIX and PETS databases were not searched directly. The 2017 ADINT study showed that ads bought for about US$1,000 could localise a device to about 8 metres once it stayed about 5 minutes . Google's Authorized Buyers documentation (updated 17 September 2026, read on 24 October 2026) says its bid-request location comes only from IP geolocation, with latitude and longitude precision limited to 0.01 degrees . The author's essays argue that a mobile impression's location carries real error; that is his position, not evidence. His geographic cell-grid proposal, AdCP issue #5969, which he opened and which was open when read on 24 October 2026, sits in the AgenticAdvertising.org working group he co-leads and has a stake in the answer .

The causal benchmarks

Agreement with ground truth is one question; whether a visit lift is causal is another, coded under H3 in Chapter 5. In the randomised benchmarks, observational methods miss the experimental lift, usually by overstating it . Fifteen US Facebook campaigns run as randomised trials in 2015 found matching and regression methods on rich individual data mostly overestimating lift, and in half of the studies purchase lift was off by a factor of three across all methods. Two coauthors are affiliated with Facebook and the study runs on Facebook's own data; the two Kellogg academics declare no financial interest . Across 663 Facebook experiments, median RCT lifts of 29%, 18% and 5% by funnel stage compared with 173%, 176% and 64% from stratified propensity-score matching, and the authors conclude they could not reliably estimate a campaign's causal effect .

Randomisation does not make the problem easy. Across 25 field experiments with US retailers and brokerages, the median confidence interval on return on investment was over 100 percentage points wide, and informative experiments can need more than 10 million person-weeks . A randomised experiment with 1.6 million customers of a major retailer on Yahoo! measured a 5% purchase increase from online ads, 93% of it in stores, while a cross-sectional observational estimate on the same data understated the effect, with a negative bias three times the experimental effect . Ghost ads and geo experiments, both from Google-affiliated authors, are randomised designs with published methods that location attribution can borrow . Randomised field experiments of location-targeted promotions also exist, with store-level outcomes . Inference: none of the benchmarks screened tests visit lift measured by a location panel; the nearest ones measure in-store purchases matched by customer record and promotions redeemed on location .

H2, coded

H2 stays unresolved overall, and no single verdict is given across products and data vintages . SafeGraph's 2018 panel carries adverse historical evidence for one place type and use . Placer.ai has one third-party trail-site check, funding not stated, that is not like for like, and Advan one visual park comparison . For the other products in the sources screened, the record holds coverage studies, vendor assertions or nothing . No product meets the supported branch: no independent comparison, and no held-out vendor comparison with a published method, tests a named product against an error the vendor states .

What study would settle it

One way to close the current retail gap would be an independent study with this design; the registered rule would also accept a vendor-run comparison with a held-out design and a published method. Take a named product's projected weekly visits for a few hundred retail places of more than one type, and the door counts or transactions for the same places and weeks, supplied by the retailers. Fix the model version before the data arrive and hold out places and later weeks. Report error in levels as well as correlation in patterns, by place type, region and income band, with the vendor's stated error alongside. Repeat after the next model restatement.

The study table lists the 26 study records coded from independent, academic, commissioned and vendor work, one row per study and outcome, with design, sample, sponsor, vintage and uncertainty.

Chapter 5

How visit lift is measured

Most US visit-lift products compare exposed devices with a modelled or matched control, not with a group held out from the campaign. Of the nine cohort A products that document a default method, seven use no holdout, so H3 is contradicted. The comparator decides the number: one campaign reported 29% lift against its holdout and 310% against the open population. Every product that documents the basis of its visit totals projects them, though three also report observed counts.

In short

Of fourteen cohort A seed products, nine document a general visit-measurement method that governs their ordinary reporting, on documentation read on 24 October 2026 . Six use a matched or synthetic control (Foursquare, InMarket, Reveal, Adsquare, Cuebiq, Arrivalist), two a randomised or holdout control (Azira's PSA holdout and Blis's geographic holdout), and GroundTruth reports exposed-only visits with no lift claim . Seven of the nine documented methods are non-holdout; of the eight that claim lift, six are matched or synthetic, so H3 is contradicted under either count . One undated PlaceIQ case reports a 29% lift against a standing holdout and a 310% "open lift" against the open population for the same campaign . Azira is the only vendor whose opened public pages disclose numeric minimum-sample and significance rules . Disclosed attribution windows run from 4 days to a 30-day look-back . Where the basis is documented, visit totals are projected (Foursquare, InMarket, GroundTruth Projected Visits, Azira), with observed counts alongside at GroundTruth, Azira and InMarket; for nine visit numbers, Arrivalist's arrival counts among them, the basis is not disclosed . No opened cohort A documentation names Samba, the author's employer, as a source of TV exposure data . Among the products opened, only GroundTruth states a payment model, Cost Per Visit .

H3 asks whether the visit-lift numbers that US location-attribution products report rest, by default, on randomised or held-out control groups. The rival hypothesis, from the author's glossary, is that footfall attribution is correlated and modelled by default; it is a hypothesis, not evidence. The registered test codes each cohort A product's documented default as randomised or holdout (ghost ads, PSA holdouts and geo-experiments included), matched or synthetic, or exposed-only, and H3 is contradicted when more than half of the products with a documented default use a matched or exposed-only design (chapter 13). A clarification dated 24 October 2026, written after extraction, fixed the decision tree: below four codable products, or at exactly half, the reading is unresolved, a product-wide method description counts as the default even without the word "default", geographic holdouts count as holdouts, and a product that makes no lift claim is reported in a separate strict count. The clarification did not move the verdict; better sources did. This chapter uses the paper's terms from chapter 1: visitation counts visits after exposure, lift is a difference against a control, and a matched comparison is not causal evidence.

What each product counts

Visit definitions are thin in the public record. GroundTruth's Observed Visits counts a user's visit to the brand or "drive-to" location within 14 days of exposure to a GroundTruth ad, credited by last touch, and shows only visits verified after a 7-day period; its help centre says observed visits "may be lower than actual visits" . Its places are Blueprints, polygons traced from satellite and street-view imagery in in-store, on-lot and retail-block layers; one GroundTruth article of 25 February 2026 counts "4.8M Blueprints" and another of 3 March 2026 "over 5 million" . GroundTruth asserts, without a cited study, that radial geofences measure visits "with up to 75% inaccuracy" . Azira draws polygons by hand from satellite imagery and builds its panel from SDK integrations and bidstream location signals from the bid requests of over 100,000 apps, with no panel size and no SDK-to-bidstream split stated . Under this paper's definitions, location taken from a bid request is inferred location . Adsquare matches lat/long to 2D POI polygons with "no fuzzy radius logic" . Foursquare Attribution documents no visit-definition thresholds , and Blis publishes no visit definition and no source for its footfall outcome .

Where the basis is documented, the visit totals are scaled. Foursquare weights its panel to census block groups and applies "projection weighting" that scales matched panelists to each publisher's delivered impressions . InMarket's console defines Overall Projected Store Visits as exposed device visits rated up by a device-to-DMA ratio, and Incremental Projected Store Visits as that total multiplied by the LCI Lift; only "Exposed Device Visits" are panel observations . An incremental visit in an LCI report is therefore a projection multiplied by a matched-control lift . GroundTruth's Projected Visits applies the visitation of a per-campaign panel of impressed devices to all impressed devices, appears once a campaign usually reaches 40 Observed Visits and 350,000 impressions, and reports no uncertainty . Azira projects total visits by a Poisson detection model in which each observed device stands for 1/P(Detection) devices, only above about 1,000 observed visits and with the multiplier capped at 20x . Across cohort A, the basis of the visit numbers is not disclosed for Blis, Reveal, Adsquare, Cuebiq, Vistar, Kochava, Lifesight and Precisely . Chapter 4 covers how such numbers are validated.

H3: the default control is modelled

Nine of the fourteen seed products document a general method; five document none . Vistar is a partner wrapper, Kochava lists MediaLift synthetic control as one selectable option, Precisely and Unacast have no named attribution product, and Lifesight's location module is not on its current site . Under the clarified rule, D is 9 and N is 14.

ProductVendor's description of the comparatorH3 codeWindowDocumented minimums and uncertaintyVisit basis
Foursquare Attribution"Modeled control group" on 10+ attributes; 2022 post: regression adjustment to a synthetic control, then difference-in-differences Matched or synthetic14-day example window plus 7 days of reconciliation Feasibility score, no numeric minimum or significance rule Projected
InMarket LCI (also Campaign Incrementality)1:1 audience-matched control on eight traits (undated console); synthetic control from historical visitation (July 2026 post) Matched or syntheticTwo weeks after versus two weeks before exposure 10 million or 25 million impressions; standard error; ">95%" confidence (legacy console, read once, now behind a sign-in) Projected
Reveal Net Lift Study (OOH)Synthetic control by propensity-score matching from a "persistent panel of 60M US DAUs" Matched or syntheticNot statedConfidence intervals and p-values; no level stated as a rule Not disclosed
Adsquare AttributionSimulated "Synthetic Control Condition" in place of control groups; US not named as a market Matched or syntheticNot statedNone stated Not disclosed
Cuebiq measurementBehaviourally matched control ; "causal machine learning to simulate a randomized control trial" Matched or syntheticNot statedNone stated Not disclosed
Arrivalist MediaInsightsMatched control of cardholders not exposed Matched or syntheticNot statedNone; headline statistics render as zero placeholders Spend lift declared; arrivals not stated
Azira MeasurementRandomised PSA holdout on 10-15% of impressions; synthetic control as the alternative Randomised or holdout7 days (QSR), 14-30 days (auto) About 1,000 observed visits and 100,000 exposed devices; 99% intervals; two-tailed t-test Observed and projected
Blis Smart Holdout GroupsMachine-balanced pairs of zip codes, one control and one target, with unserved buffer zones Holdout (assignment not documented as random)Not statedNone stated Not disclosed
GroundTruth Observed and Projected VisitsNo control Exposed-only, no lift claim14 days, last touch, plus 7-day verification Projected Visits shown from about 40 Observed Visits and 350,000 impressions; no uncertainty Observed and projected

Seven of the nine documented methods are non-holdout, so M + E is 7 against a threshold of more than 4.5, and H3 is contradicted . In the strict lift-claim count, which drops GroundTruth because it makes no lift claim, six of eight are matched or synthetic, and H3 is contradicted there too . Adsquare's US availability is unconfirmed; dropping it leaves six non-holdout methods of eight . Blis's pair designation is not documented as random , and coding it as a matched geographic design would make the count eight of nine without changing the reading. The rival line does not hold for every product: Azira and Blis document holdouts . Vendor documentation can lag practice, and a randomised design available on request does not count as the default under H3 . No randomised or holdout option appears in Foursquare's opened documentation , and every lift design InMarket and its partners describe is matched or modelled .

COHORT A PRODUCTS BY DOCUMENTED DEFAULT CONTROL DESIGN FOR VISIT LIFT6Matched or synthetic controlcounts against H3Foursquare Attribution Matched or synthetic control (counts against H3) modelled control, regression adjustment Sources: LOC-E-S01, LOC-FOURSQUARE-S19, LOC-FOURSQUARE-S22Foursquaremodelled control, regressionadjustmentInMarket LCI Matched or synthetic control (counts against H3) 1:1 audience-matched control Sources: LOC-E-S04, LOC-INMARKET-S11, LOC-INMARKET-S14InMarket1:1 audience-matched controlReveal Mobile VISIT Local Matched or synthetic control (counts against H3) propensity-score synthetic control Sources: LOC-E-S16Reveal Mobilepropensity-score syntheticcontrolAdsquare Footfall Attribution Matched or synthetic control (counts against H3) synthetic control condition; US availability not shown Sources: LOC-E-S22Adsquaresynthetic control condition; USavailability not shownCuebiq advertising measurement Matched or synthetic control (counts against H3) behaviourally matched control Sources: LOC-E-S27Cuebiqbehaviourally matched controlArrivalist Matched or synthetic control (counts against H3) matched group of unexposed cardholders Sources: LOC-E-S30Arrivalistmatched group of unexposedcardholders2Randomised or holdoutcounts for H3Blis outcome measurement Randomised or holdout (counts for H3) geographic holdout; assignment not documented as random Sources: LOC-E-S14, LOC-BLIS-S07, LOC-BLIS-S08, LOC-BLIS-S09Blisgeographic holdout; assignmentnot documented as randomAzira attribution Randomised or holdout (counts for H3) randomised PSA control, the default in an undated white paper Sources: LOC-E-S18Azirarandomised PSA control, thedefault in an undated white paper1Exposed-only, no controlcounts against H3GroundTruth visit measurement Exposed-only, no control (counts against H3) Observed and Projected Visits; no control, no lift claim Sources: LOC-E-S09, LOC-GROUNDTRUTH-S19, LOC-GROUNDTRUTH-S42GroundTruthObserved and Projected Visits; nocontrol, no lift claim5No default documentednot counted in H3Unacast footfall attribution No default documented (not counted in H3) no attribution product found Sources: LOC-E-S21Unacastno attribution product foundLifesight footfall attribution No default documented (not counted in H3) location module not on current site Sources: LOC-E-S25Lifesightlocation module not on currentsiteVistar Media attribution No default documented (not counted in H3) partner wrapper (InMarket, Foursquare) Sources: LOC-E-S08Vistarpartner wrapper (InMarket,Foursquare)Kochava visit attribution No default documented (not counted in H3) MediaLift synthetic control is one selectable option Sources: LOC-E-S28KochavaMediaLift synthetic control isone selectable optionPrecisely PlaceIQ attribution No default documented (not counted in H3) no named attribution product found Sources: LOC-E-S33Precisely PlaceIQno named attribution productfoundH3 is contradicted when more than half of the products with a documented default use a matched or exposed-only design. Documented defaults: 9;non-holdout: 7 of 9 (77.8%). Excluding GroundTruth, which reports visits without a lift claim, 6 of 8 are matched or synthetic. A matchedcomparison is not causal evidence under this paper’s rules, whatever the vendor calls it.
Seven of the nine documented cohort A visit-measurement methods use no randomised or holdout control; of the eight that claim lift, six use a matched or synthetic control. The 14 cohort A products in the register, by the control design their documentation gives as the general method for visit measurement, eight of them with a lift claim (final wording of LOC-E-F28, every code re-derived on 24 October 2026). Six use a matched or synthetic control and one reports exposed-only visits; of the two holdout designs, Azira’s randomised PSA control is documented as its default in an undated white paper, and Blis’s geographic holdout is machine-balanced, with no documented random assignment. Five products document no default.Units: products · Scope: cohort A products in the product register, US, at the cutoff · Sources Codes describe documented defaults, not the design of any delivered study; a vendor may run a holdout on request. The count is bounded to the 14-row register.Data: data/figure-data.json#control

Vendors describe these designs in stronger terms than the designs support. Foursquare's product page calls its output "incremental lift" while its blog and metrics page call it "behavioral lift" , a term no opened page defines . InMarket calls its synthetic-control Visit Lift causal . Adsquare says its model "removes reliance on traditional control groups" . Under this paper's codes, language that describes a matched or synthetic design as simulating or replacing a randomised trial does not move it out of the matched class .

The two holdouts

Azira's methodology page (footer 2025) is the only cohort A document opened in stream C that names a randomised control as the default: 10-15% of impressions serve public-service creative as a PSA holdout . Its own Domestos case from Rize, Turkey reports an exposed footfall rate of 1.672% against a control rate of 1.168%, presented as a 43% increase in store traffic, without stating the control design, window or dates . A buyer therefore cannot tell from that published result which of Azira's two designs produced it . The Google-affiliated authors of ghost ads designed the method to measure lift without PSA controls, which they say become invalid under performance-optimised delivery .

Blis announced the US rollout of Smart Holdout Groups on 11 July 2024 and the global release on 9 October 2024, and says footfall lift is "Only available in the US" . Areas are scored on seven data points including demographics, household characteristics and income, similar areas are paired with one designated control and one target, and buffer zones built from Blis movement data are left unserved and unmeasured . On its product page, launch releases and technology page, Blis publishes no visit definition, outcome source, minimum sample, significance rule, confidence interval or projection method for it, and states that its measurement "can be independently verified" . The geographic experiment is a published design: Google's 2011 method assigns non-overlapping regions at random to treatment or control . Blis's documents do not say its designation is random . The 55% "store visit uplift (control vs exposed)" in Blis's US restaurant case was published on 12 September 2019, about five years before Smart Holdout Groups were announced .

The comparator decides the number

On one PlaceIQ campaign, changing the comparator multiplies the lift by 10.7. In that undated case for a national big-box retailer, exposed devices visited at a Place Visit Rate of 2.75% against 2.13% for a standing 10% holdout never served a PlaceIQ ad, a 29% lift; against the open population, at 0.67%, the same campaign shows a 310% "open lift" . The document says how the holdout is maintained but not how it is selected, and it does not show whether PlaceIQ, now owned by Precisely, runs the design today . Precisely's audience product page documents no named PlaceIQ attribution product .

Published lift figures rarely carry the comparator's rate. Foursquare's linear-TV QSR case reports 1.32% behavioral lift with 3.4M+ incremental and 58.9M total attributed store visits, and its product page reports a "23% lift in in-store visits among exposed users versus the control group", none with exposed and control rates, sample, period or control construction . InMarket reports 121 of 126 TikTok campaigns with "statistically significant lift" (2024; a footnote gives a base of 121) and a 26% incremental visit lift against a 23% benchmark for an unnamed dining chain (2026), with no design, base or uncertainty beyond its own descriptions . Vistar's Foursquare-measured retail case (August 2021 to January 2022) reports a 6.51% lift in visitation "compared with non-exposed consumers" without describing the control . Simpli.fi, which is not a seed product, defines its 31.76% "Geo-Conversion Lift" as the difference between visitors who received an ad and visitors who did not, with no matching described . Cuebiq's benchmarks show how vintage and definition move the norm: its 2017 paper put retail uplift at 10-30% , while its 2022 report, on 2020-21 campaigns, put the medium retail band at 1.01-7.61% .

In the academic record, observational estimates miss experimental lift by wide margins, and not always in the same direction. On 15 US Facebook campaigns run as randomised trials, matching and regression methods mostly overestimated lift relative to the experiments . Across 663 Facebook experiments, median randomised lifts of 29%, 18% and 5% by funnel stage compared with 83%, 58% and 24% from double machine learning and 173%, 176% and 64% from stratified propensity-score matching . Those are online outcomes on platform data, not store visits . In a randomised Yahoo! experiment with 1.6 million retail customers, a cross-sectional observational estimator showed a negative bias three times the size of the experimental effect, so it understated the effect .

Samples, significance and windows

Azira is the only vendor whose opened public pages disclose numeric minimum-sample and significance rules: about 1,000 observed visits and 100,000 exposed devices, 99% confidence intervals and a two-tailed t-test . InMarket's LCI console states minimums of 10 million impressions for mobile app and 25 million for mobile web or desktop per measured dimension, a standard error and a ">95%+" confidence rule , but stream C placed that glossary behind a sign-in and could not verify it from a public route . Reveal discloses confidence intervals and p-values without a numeric minimum, Vistar states only that it requires "enough scale", and Foursquare, Cuebiq, Adsquare, Blis, Simpli.fi and GroundTruth state none on the pages opened . Foursquare releases reports once results are "statistically viable", a criterion it does not define . Scale matters: across 25 randomised retail and brokerage experiments, the median confidence interval on return on investment was over 100 percentage points wide, and informative experiments can need more than 10 million person-weeks .

Windows vary as much as controls. Disclosed windows run from 4 days (Vistar with Foursquare, DOOH) through 7 days for QSR and 14-30 days for auto (Azira), 14 days plus a 7-day verification lag (GroundTruth), two weeks before and after exposure (InMarket), to a 30-day look-back (Simpli.fi) . In one 2017 Cuebiq campaign, 37% of exposed visitors arrived within 2.6 days and 14% between 10.5 and 13 days, so the window alone moves a visit count materially .

A formula that does not compute

Azira's white paper defines lift as (exposed rate - control rate) / control rate, then computes incremental visits as "Exposed Group Lift * Exposed Group Devices" . Read literally, that multiplies a relative lift by a device count. Under the paper's own definition, incremental visits are (exposed rate - control rate) x exposed devices . InMarket's console has a related problem: it gives two denominators for LCI Lift on the same page, "Visits" in the glossary and "(Exposed Visits + Control Visits)" in the calculations . A buyer who recomputes a reported incremental figure needs the formula actually applied.

TV to visit

No opened cohort A documentation names Samba as a source of TV exposure data . The author is employed by Samba, so this finding records only what the measurement vendors' documentation says . Foursquare infers TV exposure by joining viewership data with ad run-logs and names no viewing-data supplier . Cuebiq takes linear TV exposure from broadcast partners' impression logs at household level, without naming them . GroundTruth's help centre (2021, not since updated) says CTV-to-store visits rely on TapAd converting IP addresses to mobile ad IDs, an extra match before the location step . Blis's privacy centre lists Samba TV among its ad-effectiveness partners with Cuebiq, Foursquare, InMarket, Kochava and Lifesight, and no source says which, if any, supplies Smart Holdout Groups' footfall outcomes . Samba TV's consumer site refers business visitors to samba.com, which this review did not open . CTV or TV is a named channel for Foursquare, InMarket, Azira, Blis, Cuebiq and Arrivalist; a listed channel is a claimed capability, not evidence of production measurement in it .

Who pays

GroundTruth is the only product whose opened pages state a payment model: Cost Per Visit, introduced in spring 2017, under which "marketers only pay for ads that result in a store visit"; among the other thirteen products the opened pages state no payer or fee . A November 2024 case reports an auto dealers' association paying "only for verified visits" for "over 1,200 visits" in a month, with no cost, impressions or control . Inference: under Cost Per Visit the seller of the media also counts the exposed-only visits it bills on, and this review found no independent audit of that billing . Vistar's activation guide says its partner studies "require a feasibility test and have varying minimums and costs", and that it offers device ID passback for free . Foursquare documents no pricing . InMarket's visit-lift measurement reaches buyers through partner platforms (TikTok from 2024, Reddit for all US advertisers from 12 November 2024, Vistar for US DOOH, Basis from 27 May 2026) as well as its own console and exports . Its Maestrø beta, announced on 18 June 2026, includes a fully managed "Guaranteed iROAS" offer ; inference: a vendor that guarantees a return and measures it sits on both sides of the guarantee .

No lift, incrementality or attribution metric of a location product is recorded in the 35 MRC communications from January 2020 to October 2026 screened by name or on the current lists; both MRC location accreditations on record since 2020 covered data sets . MRC's 2017 location guidelines contain no provision on visit lift, incrementality or control groups . Foursquare's Visits data-set accreditation was granted in 2020, suspended in October 2022 and revoked in December 2022, and its own 2020 release said Attribution had not been audited or accredited . Chapter 8 has the assurance record.

What would change the reading

H3 would move if the matched-default vendors documented a randomised or holdout control as their ordinary design, or if Azira and Blis published results that state which design produced them. A buyer can ask for the same things now: the control's construction and visit rate beside the exposed rate, the window, the minimum sample and significance rule, whether the visit totals are observed or projected, and the formula that turns a lift into incremental visits. Chapter 12 turns these into questions.

Chapter 6

How location audiences are built

A location audience is a set of devices that a vendor says were at a place, or are at one when the ad is served. Vendors document the shapes they draw and the time windows they use. The documentation opened gives no current source mix, no fix accuracy with a method and no test of whether a segment reaches the people it names. On that record H4, the registered test of bidstream against SDK sourcing, cannot be decided.

In short

Foursquare Audience qualifies devices on past visits, with high, medium and low frequency buckets and a look-back of up to 18 months; Foursquare Proximity is a real-time radius with no look-back . No cohort B documentation opened by 24 October 2026 states a fix-accuracy threshold with a method or a detection error statistic . H4 is unresolved: in the documentation opened, no product documents a primary source; Foursquare and InMarket disclose several sources without naming a primary one, and Azira and GroundTruth disclose blends without proportions . Bidstream appears as a documented source in the FTC's Mobilewalla order, on Azira's data page, in GroundTruth's help centre and on Vistar's partner page for GroundTruth . Sensitive-place handling sits in vendor privacy documents as self-attested policy, alongside FTC orders that impose programmes on InMarket, Mobilewalla, and Kochava with Collective Data Solutions . In the documentation opened, this review found no independent on-target or accuracy validation of a location audience with a published design . T-Mobile's enhanced, location-enriched audience segments, announced on 5 October 2026, are available for out-of-home (OOH) targeting only through Vistar Media, which T-Mobile owns; its app-based segments have been there since May 2025 .

How a device qualifies

The segment rules opened state a place geometry (a polygon or a radius) and a time window, and some state a frequency count; this chapter reads each rule on those terms (chapter 1). Foursquare Audience, live in 2026, builds segments from past visitation with location-specific frequency buckets and a recommended look-back of 3 to 6 months, and is sold off the shelf on The Trade Desk, LiveRamp and DV360 . Its minimum segment size is 5,000 devices in the FAQ and 10,000 on the requirements page, and it is priced at US$1.50 CPM "in most scenarios", against US$0.75 for Proximity .

ProductWhat qualifies a deviceTime window and frequencyEvidence
Foursquare AudiencePast visits to a place3 to 6 months recommended, up to 18; high, medium and low frequency buckets
Foursquare ProximityInside a radius geofence, validated against the impression's lat/longReal time, no look-back
GroundTruth Ads ManagerTarget Locations (city to business address or lat/long); Target by Audience (historic visitation); Target Neighborhoods (trade-area lookalikes); Target On-Premise (In Store, On Lot, Retail Block, Radial)On-Premise is real time and mobile only; Target by Audience uses historic visitation
Adsquare ID-Precise AudiencesMobile advertising ID (MAID) segments from "verified visits, offline purchases"; home and work at postcode levelLook-backs of 14, 30, 90 and up to 180 days
Adsquare Geo-Contextual AudiencesNo device ID; a postcode, H3 cell or polygonScored by the hour
Simpli.fi Addressable Geo-FencingAny device seen within parcel plat lines, up to one million addresses per campaignUp to 30 days, "variable recency settings"
InMarket GeoLinkBlock-level geo-audiences, point-of-interest geofences, past store visitorsGeofences in real time; retargeting on past visits

Precision is asserted by geometry, not by a threshold. The one numeric figure found is Azira Audiences' "within 3 meters of precision", with no method. GroundTruth On-Premise is "strictly inside the physical building walls", Simpli.fi uses parcel plat lines, Adsquare offers "precise polygons or custom radii" alongside postcode and H3 cells, and GroundTruth also sells coarse ZIP, state and DMA options . GroundTruth names the tests it applies to each location signal and visit, among them stale, outlier, drive-by speed and open-store hours, and rejects centroids and carrier-IP locations, but publishes no numeric threshold for dwell, horizontal accuracy or speed . Foursquare Proximity is delivered where "your ad platform is able to validate that a user is within the radius boundaries of the geofence by matching the lat/long of the impression" . This paper infers, from that wording alone, that delivery rests on the coordinate carried in the bid request.

GroundTruth and InMarket also sell catalogues built by models. Since ZeroToOne.AI's acquisition, GroundTruth sells "Predictive AI Audiences" from the acquirer's model, built from visitation, interests, transactions, digital engagement and demographics. They are marketed at "over 90%" predictive accuracy with no published definition, and the catalogue went from an "initial" 40 segments in June 2026 to "1,500+" in October 2026 . InMarket sells 10,000+ syndicated segments and GeoType personas built by machine learning on 1,000+ attributes . A Vistar-hosted GroundTruth page states one example segment with both a frequency and a window: "Visitors who visited general clinics at least 1 time in the past 120 days nationwide" .

Where the location comes from: H4

H4 is unresolved: in the documentation opened, no cohort B product documents a primary source of location . H4 says that location-based audience and targeting products sold in the US at the cutoff rest mainly on bidstream or IP-derived location rather than on SDK- or panel-observed location. As registered, it is unresolved if fewer than four cohort B products document a primary source or if the bidstream-or-IP and SDK-or-panel counts are equal, and blends without proportions are excluded from both counts. A clarification dated 24 October 2026, written after extraction in response to external review rounds 2 and 2b, counts only products documenting one of those two families as primary (b for bidstream or IP, s for SDK or panel), makes H4 unresolved if b + s is below four or b equals s, and lists products with other primary sources, blends without proportions or no source separately. It is a substantive change to the population, and H4 is unresolved under both readings (chapter 13). A verifier's two SDK-primary codes do not stand after review .

ProductSources its own documents nameH4 codeEvidence
Foursquare AudienceIts own apps, with opt-in precise or background location; SDK and API partners that "may license data to us"; data suppliers, brokers and ad networksSeveral sources, primary not established
InMarket AudiencesIts own apps (CheckPoints, ListEase, Key Ring, Subscription Stopper, Out of Milk), a partner SDK app network, unnamed "trusted & certified third-party sources"Several sources, primary not established
Azira Audience"premium SDK, bid-stream, and verified consumer transactions"Blend, proportions not disclosed
GroundTruth Ads ManagerPrivacy policy: SDKs and scripts, publishers, service providers, consumer data resellers. Help centre: WeatherBug, direct app partnerships, SDK integrations and the bid-streamBlend; one proportion, from 2018
BlisStream F could not read the product pages; the audience page read for the profile names no collection route; the company notice names GPS and IP-derived location from data partners, SSPs, exchanges and clientsNot disclosed for the product
Adsquare, Mobilewalla, Simpli.fi, Reveal, Precisely Audiences"Vetted partners", third-party ad-tech providers, GPS or "anonymized mobile signals", with no collection routeRoute not stated
Broadsign Ads (registered; US availability unconfirmed, so outside the count)Native Touch data "pulled from active application SDKs and APIs"SDK via a named partner; outside the count

GroundTruth's only proportion, "90% of our location signals" from WeatherBug, app partnerships and SDK integrations, sits in a help article last edited in April 2018 . GroundTruth's privacy policy, effective 2 April 2026, does not use the words bid request or bidstream . The regulator records describe both routes before the orders. The InMarket complaint described collection through InMarket's own apps and through third-party apps using its SDK , and the FTC alleged that Mobilewalla collected bidstream data, an allegation rather than a finding .

Bidstream, where it is documented

The FTC's Mobilewalla order (Docket C-4811), issued 13 January 2025 and announced as final on 14 January on a 4-1 vote, bars Mobilewalla from collecting or retaining information it accesses in online advertising auctions for any purpose other than participating in them. It is the only regulator record in stream F that documents bidstream as a cohort B location source . Mobilewalla's business notice, updated 9 January 2026, says all its data comes from third-party ad-tech information providers and names the movement-data fields (MAID, latitude and longitude, IP, timestamp) without saying whether they come from SDKs or bid requests . The same notice says Mobilewalla sold personal information to clients and ad-tech partners in the last year, and its site sells Audience Segments and "Location-Based Marketing" with no stated precision class .

Azira's privacy policy, updated 6 August 2025, names bid requests it receives when acting as a DSP, alongside third-party providers, data brokers and app-collected movement data . InMarket's GeoLink applies a machine-learned "Location Score" to the location carried in ad requests before bidding, so InMarket's targeting uses bidstream location as a filtered input alongside SDK data . Blis's August 2021 press kit cited "18 billion" ad requests a day and a "Smart Pin" filter that discards about 80% of raw location data . Simpli.fi says it uses "GPS data paired with plat lines" and rejects IP because of truncation, without saying where the GPS fixes come from .

OpenRTB 2.6 lets a request state whether its location came from GPS, IP or the user, with accuracy in metres and the age of the fix . Google's Authorized Buyers documentation, last updated 17 September 2026, says bid-request location comes only from IP geolocation, with lat and lon limited to 0.01 degrees . Thinknear's vendor-run index put 32% to 37% of location-bearing impressions or location data within 100 metres of the user in its 2014 to 2016 editions, and a reseller deck advertising the Q4 2017 index shows 37% on an unlabelled slide (chapter 4) .

Sensitive places: vendor policies and FTC orders

None of the cohort B product pages opened describes sensitive-place suppression, but vendor privacy documents do. Foursquare commits to the Network Advertising Initiative (NAI) enhanced standard and lists 13 sensitive-place categories. Mobilewalla says it does not knowingly collect visits to places of worship, shelters, treatment centres or reproductive health clinics, and Azira describes a programme that removes sensitive locations from its datasets. These are self-attested statements with no verified enforcement . GroundTruth's help-centre guidelines, updated 28 September 2026, define Consumer-Protected places (1-mile minimum; no device-level collection), Healthcare-Protected places (0.4-mile minimum for healthcare ads in WA, NY, CT, NV and CA; visits not tracked) and Prohibited places (no location targeting; visits not measured), each with a published category list . GroundTruth's privacy notice that it "may sell your sensitive personal data" is a state-law disclosure and does not show that it sells sensitive-place visits .

InMarket's FTC order, final on 1 May 2024, prohibits it from selling or licensing precise location data, as the order defines it, and, separately, from using, selling, licensing, transferring or sharing any product that categorises or targets consumers on sensitive location data . Its sensitive-location ban covers the locations InMarket's own programme identifies, in nine categories; the order excludes coarse data at a radius of at least 1,850 feet and runs 20 years from issuance . Mobilewalla's order covers ten categories with only a conversion exception and no direct-relationship consent exception . The FTC's 4 May 2026 release on the Kochava settlement says Collective Data Solutions "has taken over Kochava's data broker business" and will be barred from selling sensitive location data without affirmative express consent . On 24 October 2026, Collective Data Solutions' own site offered data feeds including "precision location (protected by Privacy Block)", audience targeting and competitor conquesting . InMarket documents its own sensitive-place handling only as company-level statements, among them suppression of sexual and reproductive healthcare providers and NAI membership . At 30 June 2026 InMarket's privacy policy says it does not sell precise geolocation "in the plain language sense", while its state-law notice says it "sold (or shared for interest-based advertising)" coarse and precise geolocation to third-party partners and uses precise location to build audience segments . This paper does not assess compliance with any order ; chapter 7 reads the orders and H5.

State laws change what vendors sell, by the vendors' own account. GroundTruth says that for locations in Maryland, Oregon, Virginia, New Jersey and Connecticut, from dates it gives between 1 October 2025 and 1 October 2026, visit tracking, On-Premise and Neighborhood targeting, radius targeting below 1 mile and audience building from new precise location signals are unavailable . Foursquare requires a separate New York, Washington and Connecticut set with a minimum 3,000-foot radius for national Trade Desk Proximity segments, "to follow state privacy laws" . The statutes read for this paper define precise geolocation by a radius of 1,750 or 1,850 feet , so both vendors' minimums are wider than those radii.

Activation routes and channels

GroundTruth Ads Manager documents six channels: mobile, CTV and OTT, desktop and tablet, audio, digital out-of-home (DOOH) and direct mail. Azira's Advance DSP also documents six, so the two tie for the widest documented channel set among the products opened . Azira, Vistar and Simpli.fi activate through their own platforms, while Foursquare, Adsquare, Reveal and Mobilewalla name external DSPs or marketplaces . Foursquare's eligible-platforms page lists 26 activation platforms for Audience, including Meta, TikTok, Roku, Spotify and Vistar Media, and Vistar says over 2,300 Foursquare audiences are available in its DOOH DSP . InMarket claims activation on "any" DSP and names one external DSP, Basis . Blis activates through its own DSP and, from 17 June 2025, PMG's Alli Marketplace . Outside its own platform, the only named route for GroundTruth audiences is Vistar's programmatic DOOH integration . On The Trade Desk, Vistar's taxonomy is available through auction packages and private marketplaces, and third-party audiences must contain mobile device IDs .

The accuracy statements that travel with these segments are vendor assertions without method. They include GroundTruth's "over 90% predictive accuracy", Foursquare's "industry's most accurate location-based datasets", InMarket's 3.7x against Wordstream display benchmarks, and Azira's 80-90% addressability. InMarket also says its data is "Comscore verified and Location Sciences certified" but publishes no certificate or scope . Location Sciences audited several InMarket audiences in the first half of 2020 and rated them "Optimal"; the certifier's announcement does not say who paid for those audits, and no later audit or renewal was found . In March 2021 the same certifier stated that Blis had threatened legal action after its Verify product reported "data manipulation"; Adweek reported that Blis denied the allegations . Chapter 11 scores cohort B on this record.

Geofencing for local advertisers

Geofencing and geo-conquesting reach US local advertisers through at least three routes with different mechanics . GroundTruth Ads Manager sells real-time On-Premise and "Pure Geographic" delivery to anyone inside a boundary, plus retargeting of a competitor's past visitors, with no minimum spend . Simpli.fi's Addressable Geo-Fencing turns up to one million street addresses into parcel-level fences drawn from property-tax and land-survey records, then follows "any device seen within those plat lines" with mobile, video and CTV ads for up to 30 days through a cross-device graph . Reveal's Geofencing Solutions captures MAIDs at "your locations, competitor locations, and audience hotspots" for The Trade Desk, LiveRamp, Basis and social platforms, and names no source of device location . In Simpli.fi's case studies a visit counts when a served device later enters a Conversion Zone around the store, an exposed-only design, and "Geo-Conversion Lift" compares visitors who received an ad with visitors who did not, with no matching described . Under this paper's rules that is a visitation comparison, not incremental lift (chapter 5).

Telco data enters DOOH targeting

Vistar's own guide documents DOOH audience targeting from "aggregated and anonymized location data" plus third-party partners: Epsilon, Eyeota, InMarket and Affinity Answers . T-Mobile's app-ownership and engagement segments have been on Vistar's self-service DSP since 6 May 2025 . On 5 October 2026, Vistar announced enhanced T-Mobile segments that add "location insights", available only through the Vistar DSP; T-Mobile turns them into area-level audience scores that Vistar matches to screens . Vistar's older T-Mobile partner page describes the segments as "built from app ownership data" from devices on T-Mobile's network . AdExchanger, relaying T-Mobile's account, reported that its data for Vistar also includes mobile location data used to estimate inventory impressions, and for users who opted into location tracking T-Mobile can detect proximity to OOH ads and retarget on other channels . T-Mobile's Jess Zhu attributed the exclusivity to tightening regulation of location data and mobile device IDs . The same carrier owns Blis, whose DSP has carried T-Mobile US app data since 10 September 2025 .

Vistar's wording and its legal notice point in different directions. The audience guide says DOOH targeting works "without ever relying on personal information", while the Services Privacy Notice says Vistar receives device location histories tied to device identifiers and sells and shares personal information . On an undated page, Broadsign Ads names its mobility supplier and route: Native Touch data from "active application SDKs and APIs", collected once phones enter defined boundaries and turned into six targeting groups and over 190 personas per screen, with no panel size, consent route or region . Broadsign's measurement page, by contrast, shows its partners as logos and documents no provider . GroundTruth's DOOH product, launched through Place Exchange on 9 October 2025, captures mobile device IDs within viewing range of a screen when an ad plays and reuses them for retargeting . Chapter 9 sets out the DOOH sources in full.

A buyer can ask each seller for the segment rule (geometry, dwell, window and frequency), the source mix behind it and any on-target test (chapter 12).

Chapter 7

What the law now forbids

Five FTC orders now bind the US location data companies they name, and only one, InMarket's, bans selling precise location data as such. The other four bar selling or using sensitive location data, and the X-Mode and Gravy orders do not ban selling precise location as such. Five states have since banned the sale of precise geolocation itself: Maryland, Oregon, New Jersey (from 30 June 2026), Virginia and, from 1 October 2026, Connecticut. At the cutoff three of the five ordered companies still document current offers of precise location to third parties, so H5, the regulatory-withdrawal hypothesis, is contradicted. This review reads product sets, not compliance, and nothing in it finds that any company breached its order.

In short

The FTC's orders against X-Mode/Outlogic and InMarket (April 2024) and against Gravy Analytics with Venntel and Mobilewalla (January 2025) run 20 years; the Kochava order, entered by a federal court on 25 June 2026 after almost four years of litigation, runs ten . InMarket's order bans selling or licensing precise location data, as it defines it; the X-Mode and Gravy orders do not ban the sale of precise location, and the Mobilewalla and Kochava terms reach sensitive location data . Gravy told Norway's regulator that an intruder, who contacted it on 4 January 2025, obtained "some files"; the "millions of smartphones" figure is the intruder's claim . Maryland (1 October 2025), Oregon (1 January 2026), New Jersey (30 June 2026), Virginia (1 July 2026) and Connecticut (1 October 2026) ban the sale of precise geolocation defined by a 1,750-foot radius; Washington bans geofences around in-person health care, and California defines precise geolocation by 1,850 feet . In the searches logged, the one state attorney-general lawsuit against an alleged location data broker found for 2023 to 2026 is Texas's against Allstate and Arity . Under the registered rule H5 is contradicted: Outlogic, Collective Data Solutions for Kochava and Gravy trading as Unacast document precise-location offers, Mobilewalla does not state the precision of what it licenses, and InMarket documents no such product .

Five orders, one sale ban

Only the InMarket order bans selling precise location data; the other four reach sensitive location data . The table reads each from the FTC's own record or, for Kochava, the court order.

OrderDatesWhat it bansExceptionClean-upTerm
X-Mode Social and Outlogic (C-4802)Proposed January 2024; issued 11 April 2024; final 3-0-2, announced 12 AprilSelling, licensing, transferring, sharing, disclosing or using sensitive location data (seven categories of Sensitive Locations); not precise location as suchDirect-relationship consentHistoric Location Data deleted in 60 days unless consented, or deidentified or rendered non-sensitive within 90; Data Products deleted in 9020 years
InMarket (C-4803)Issued 29 April 2024; final 3-0-2, announced 1 May 2024Selling or licensing precise Location Data for any valuable consideration; products that categorise or target consumers on sensitive location data (nine categories)Carve-out for compliance useOwn-app Historic Location Data deleted in 90 days unless the consumer consents to retention; third-party data deleted, deidentified or rendered non-sensitive in 120; segments built on it deleted in 12020 years
Gravy Analytics and Venntel (C-4810)Complaint and proposed order 3 December 2024; issued 13 January 2025; final 5-0, announced 14 JanuarySelling, disclosing or using sensitive location data (eight categories, adding military installations); not precise location sold to commercial customersDirect-relationship consent; security, federal national-security and federal law-enforcement emergency uses fall outside Location DataHistoric Location Data deleted in 60 days unless, within 90, consent records are obtained or the data deidentified or rendered non-sensitive20 years
Mobilewalla (C-4811)Issued 13 January 2025; final 4-1, announced 14 January, Commissioner Holyoak dissentingUsing or selling sensitive location data (ten categories); collecting or retaining ad-auction data for any purpose other than taking part in the auctionConversion to non-sensitive or non-location data only; no consent exceptionHistoric Location Data deleted in 90 days; Data Products in 12020 years
Kochava and Collective Data Solutions (D. Idaho, 2:22-cv-00377)Announced 4 May 2026 (Commission vote 2-0); entered 25 June 2026Selling, sharing or disclosing sensitive location data without affirmative express consent, in the FTC's descriptionConsent limited to data used for a service the consumer directly requestedHistorical Location Data deidentified or rendered non-sensitive in 90 days unless consent records are obtained10 years
FTC LOCATION ORDERS: WHAT EACH BANS, AND WHAT EACH COMPANY DOCUMENTS AT THE CUTOFFWhat theorder bansSensitivecategoriesCoarsecarve-outTermIssued orenteredH5: stillsells preciseX-Mode Social / Outlogic (C-4802) What the order bans: Bans sale of sensitive location data only Sensitive categories: 7 Coarse carve-out: 1,850 ft Term: 20 years Issued or entered: 11 Apr 2024 H5: still sells precise: H5: documents selling precise geolocation Sources: LOC-H-S02, LOC-H-S01, LOC-H-S30, LOC-H-S31X-Mode Social / Outlogic (C-4802)X-Mode Social / Outlogic (C-4802) What the order bans: Bans sale of sensitive location data only Shown as: sensitive onlysensitive onlyX-Mode Social / Outlogic (C-4802) Sensitive categories: 77X-Mode Social / Outlogic (C-4802) Coarse carve-out: 1,850 ft1,850 ftX-Mode Social / Outlogic (C-4802) Term: 20 years20 yearsX-Mode Social / Outlogic (C-4802) Issued or entered: 11 Apr 202411 Apr 2024X-Mode Social / Outlogic (C-4802) H5: still sells precise: H5: documents selling precise geolocation Shown as: yesyesInMarket Media (C-4803) What the order bans: Bans sale of all location data Sensitive categories: 9 Coarse carve-out: 1,850 ft Term: 20 years Issued or entered: 29 Apr 2024 H5: still sells precise: H5: no such product documented Sources: LOC-H-S04, LOC-H-S05, LOC-H-S03, LOC-H-S32, LOC-H-S33InMarket Media (C-4803)InMarket Media (C-4803) What the order bans: Bans sale of all location data Shown as: all location dataall location dataInMarket Media (C-4803) Sensitive categories: 99InMarket Media (C-4803) Coarse carve-out: 1,850 ft1,850 ftInMarket Media (C-4803) Term: 20 years20 yearsInMarket Media (C-4803) Issued or entered: 29 Apr 202429 Apr 2024InMarket Media (C-4803) H5: still sells precise: H5: no such product documented Shown as: no product foundno product foundGravy Analytics, Venntel (C-4810) What the order bans: Bans sale of sensitive location data only Sensitive categories: 8 Coarse carve-out: 1,850 ft Term: 20 years Issued or entered: 13 Jan 2025 H5: still sells precise: H5: documents selling precise geolocation Sources: LOC-H-S07, LOC-H-S06, LOC-H-S34, LOC-H-S35, LOC-H-S36Gravy Analytics, Venntel (C-4810)Gravy Analytics, Venntel (C-4810) What the order bans: Bans sale of sensitive location data only Shown as: sensitive onlysensitive onlyGravy Analytics, Venntel (C-4810) Sensitive categories: 88Gravy Analytics, Venntel (C-4810) Coarse carve-out: 1,850 ft1,850 ftGravy Analytics, Venntel (C-4810) Term: 20 years20 yearsGravy Analytics, Venntel (C-4810) Issued or entered: 13 Jan 202513 Jan 2025Gravy Analytics, Venntel (C-4810) H5: still sells precise: H5: documents selling precise geolocation Shown as: yesyesMobilewalla (C-4811) What the order bans: Bans sale of sensitive location data only Sensitive categories: 10 Coarse carve-out: 1,850 ft Term: 20 years Issued or entered: 13 Jan 2025 H5: still sells precise: H5: sells lat/long, precision not stated Sources: LOC-H-S09, LOC-H-S08, LOC-H-S37, LOC-H-S38Mobilewalla (C-4811)Mobilewalla (C-4811) What the order bans: Bans sale of sensitive location data only Shown as: sensitive onlysensitive onlyMobilewalla (C-4811) Sensitive categories: 1010Mobilewalla (C-4811) Coarse carve-out: 1,850 ft1,850 ftMobilewalla (C-4811) Term: 20 years20 yearsMobilewalla (C-4811) Issued or entered: 13 Jan 202513 Jan 2025Mobilewalla (C-4811) H5: still sells precise: H5: sells lat/long, precision not stated Shown as: precision unstatedprecision unstatedKochava, Collective Data Solutions What the order bans: Bans sale of sensitive location data only Sensitive categories: 5 Coarse carve-out: 1,850 ft Term: 10 years Issued or entered: 25 Jun 2026 H5: still sells precise: H5: documents selling precise geolocation Sources: LOC-H-S11, LOC-H-S10, LOC-H-S39, LOC-H-S40, LOC-H-S41, LOC-H-S16Kochava, Collective Data SolutionsKochava, Collective Data Solutions What the order bans: Bans sale of sensitive location data only Shown as: sensitive onlysensitive onlyKochava, Collective Data Solutions Sensitive categories: 55Kochava, Collective Data Solutions Coarse carve-out: 1,850 ft1,850 ftKochava, Collective Data Solutions Term: 10 years10 yearsKochava, Collective Data Solutions Issued or entered: 25 Jun 202625 Jun 2026Kochava, Collective Data Solutions H5: still sells precise: H5: documents selling precise geolocation Shown as: yesyesGeneral Motors, OnStar (C-4828) What the order bans: Bans disclosure to consumer reporting agencies Sensitive categories: Not applicable (outside H5) Coarse carve-out: not coded Term: 20 years* Issued or entered: 13 Jan 2026 H5: still sells precise: Not applicable (outside H5) Sources: LOC-X-S01, LOC-V-X-S01General Motors, OnStar (C-4828)General Motors, OnStar (C-4828) What the order bans: Bans disclosure to consumer reporting agencies Shown as: to CRAs, 5 yearsto CRAs, 5 yearsGeneral Motors, OnStar (C-4828) Sensitive categories: Not applicable (outside H5) Shown as: n/an/aGeneral Motors, OnStar (C-4828) Coarse carve-out: not codednot codedGeneral Motors, OnStar (C-4828) Term: 20 years*20 years*General Motors, OnStar (C-4828) Issued or entered: 13 Jan 202613 Jan 2026General Motors, OnStar (C-4828) H5: still sells precise: Not applicable (outside H5) Shown as: n/an/aBans sale of all location dataBans sale of sensitive location data onlyBans disclosure to consumer reporting agenciesH5: documents selling precise geolocationH5: sells lat/long, precision not statedH5: no such product documentedNot applicable (outside H5)The coarse carve-out is the orders’ example of data that is not location data (a zip code or census block with a radius of at least 1,850feet; InMarket also excludes data deleted within 48 hours); it is not a threshold for precise. Mobilewalla is also barred from collecting orretaining auction data for any other purpose. Kochava’s order was entered by the District of Idaho and bars sale and disclosure, not thedefendants’ own use. The X-Mode and Gravy orders also require a record of prior consent for collecting, using or disclosing any location data.* GM/OnStar: a 20-year order with a five-year ban on disclosing geolocation and driver-behaviour data to consumer reporting agencies and aconsent requirement for third-party disclosure; GM is outside H5’s five companies. H5 is coded from each company’s own current pages;compliance with the orders is not assessed.
Only InMarket’s order bans selling location data outright, and three of the five ordered companies still document selling precise geolocation. The five FTC location orders of 2024–2026 and the GM/OnStar order of January 2026, from the orders and the FTC’s releases, with each ordered company’s documented product set at the cutoff coded against H5 (final wording of LOC-H-F23). Outlogic, Collective Data Solutions for Kochava, and Gravy Analytics trading as Unacast document the sale or licensing of precise geolocation to third parties; Mobilewalla documents licensing device-linked latitude and longitude without stating its precision; InMarket documents no such product. Under the preregistered rule, H5 is contradicted.Units: order terms; categories; feet; years · Scope: FTC orders on location data, January 2024 to the cutoff, US · Sources Sensitive-location category counts are the numbered items in each order’s definition and are not comparable across orders as a measure of strictness. Status-sensitive: product pages read in October 2026.Data: data/figure-data.json#ftc

None of the orders defines "precise" by a radius. All five instead exclude coarse data, giving zip code or census block location with a radius of at least 1,850 feet as the example . The Kochava order also leaves out of Precise Location Data any data used for security purposes, federal national security, or a law-enforcement response to an imminent risk of death or serious bodily harm . The Gravy order puts its national-security carve-out in the definition of Location Data instead .

The orders reach supply as well as sales. X-Mode/Outlogic and Gravy must run a Supplier Assessment Program, and from 90 days after the effective date neither may collect or use Location Data without a record of the consumer's consent . InMarket must run a Sensitive Location Data Program and an SDK Supplier Assessment Program that confirms consent for SDK-supplied data . Mobilewalla's case was the first in which the FTC alleged that collecting consumer data from real-time bidding exchanges was unfair; that documents an allegation that bidstream was among Mobilewalla's sources, not an admission or a finding . Gravy and Venntel neither admit nor deny the allegations .

Kochava fought for almost four years

Kochava's order came after almost four years of federal litigation . The FTC sued in the District of Idaho on 29 August 2022, and the court granted Kochava's first motion to dismiss, with leave to amend, on 4 May 2023 . The complaint described a data sample covering more than 61 million unique mobile devices in one week . The First Amended Complaint followed on 5 June 2023, and the court denied the motion to dismiss it on 3 February 2024 . Kochava then moved its data-broker business into a subsidiary, Collective Data Solutions (CDS), and a Second Amended Complaint naming CDS was filed on 15 July 2024. The court denied the motion to dismiss that one on 3 February 2025, and the stipulated order was announced on 4 May 2026 and entered on 25 June 2026 . The former kochava.com/collective address now serves an app product page with no Collective content .

Connected cars sit outside H5

On 14 January 2026 the FTC announced a final order against General Motors and OnStar, proposed on 16 January 2025, that bans GM for five years from disclosing consumers' geolocation and driver-behaviour data to consumer reporting agencies . It is a connected-vehicle case and lies outside the five companies H5 covers .

What Gravy confirmed about its breach

The Gravy incident is a security incident, not an enforcement action . In an undated notice to Norway's Datatilsynet, Gravy Analytics, a Unacast subsidiary, said the intruder told it on 4 January 2025 of unauthorised access to its AWS cloud storage, apparently through a misappropriated access key . It said the intruder obtained some files whose contents and personal-data status were under investigation, that it was still assessing whether the incident was a reportable personal data breach, and that its data-processing platform was operational again by 9 January 2025 . Unacast's Texas registration, submitted on 9 January 2026, adds that a small subset of copied data, "covering primarily a few days around New Year's 2025", was briefly posted on a dark web forum .

The widely cited scale, "several terabytes" and "historical location data of millions of smartphones", is the hacker's claim on a closed-access Russian-language forum, first reported by 404 Media . In the sources read, the only other figure is security researcher Baptiste Robert's statement that his copy of the leaked dataset held more than 30 million location data points, by a method he did not publish . 404 Media found much of the location data was inferred from IP addresses .

Five states now ban the sale

Five states ban the sale of precise geolocation, New Jersey among them since 30 June 2026 ; Washington bans geofences around health care; California defines the term and runs a deletion system .

StateInstrumentWhat it barsRadiusEffective
MarylandOnline Data Privacy Act (2024 ch. 455, SB 541)Sale of sensitive data, which includes precise geolocation, with no consent exception; geofences within 1,750 feet of mental health or reproductive or sexual health facilities1,750 ft1 October 2025
OregonOregon Laws 2025 ch. 251 (HB 2008), amending ORS 646A.578Sale of personal data that identifies a consumer's or linked device's present or past location, or of data on a consumer known to be under 161,750 ft1 January 2026
New JerseyP.L.2026, c.25 (A5328 1R), amending P.L.2023, c.266Sale of sensitive data, including precise geolocation, by any controller regardless of consumer count; sale or licensing of sensitive data by data brokers and data collectors, with ten listed exemptions1,750 ft30 June 2026, immediately; the public registry follows after 270 days
VirginiaCode 59.1-578(A)(6), added by 2026 Acts ch. 820 (SB 338)Selling or offering for sale precise geolocation data, with no consent exception1,750 ft1 July 2026
ConnecticutPublic Act 26-64 (SB 4)Sale of any consumer's precise geolocation data by a controller or third party, replacing the consent-to-sell rule in force from 1 July 20261,750 ft1 October 2026
WashingtonMy Health My Data Act (2023 ch. 191, ESHB 1155)Geofences around in-person health care entities to identify or track consumers, collect consumer health data or send messages2,000 ft geofence; 1,750 ft precise locationGeofence ban 23 July 2023; health-data duties 31 March 2024
CaliforniaCivil Code 1798.140(w) and (ae); Delete ActPrecise geolocation is sensitive personal information; data brokers register each January and process DROP deletion requests1,850 ftDROP from 1 August 2026
STATE RULES ON PRECISE GEOLOCATION, BY EFFECTIVE DATE2023202420252026cutoff 24 Oct 2026Mechanism · radiusWashington, My Health My Data Act, sec. 10 Effective 23 Jul 2023 geofence ban, health care, 2,000 ft Sources: LOC-H-S22WashingtonMy Health My Data Act, sec. 1023 Jul 2023geofence ban, health care2,000 ftWashington, My Health My Data Act, secs. 3–9 Effective 31 Mar 2024 consent rule, health data, 1,750 ft Sources: LOC-H-S22WashingtonMy Health My Data Act, secs. 3–931 Mar 2024consent rule, health data1,750 ftMaryland, Online Data Privacy Act (ch. 455) Effective 1 Oct 2025 sale ban + geofence ban, 1,750 ft Sources: LOC-H-S19MarylandOnline Data Privacy Act (ch. 455)1 Oct 2025sale ban + geofence ban1,750 ftOregon, HB 2008 (ch. 251), ORS 646A.578 Effective 1 Jan 2026 sale ban, 1,750 ft Sources: LOC-H-S20, LOC-H-S21OregonHB 2008 (ch. 251), ORS 646A.5781 Jan 2026sale ban1,750 ftConnecticut, PA 25-113, consent to sell Effective 1 Jul 2026 to 1 Oct 2026 consent rule (replaced), 1,750 ft Sources: LOC-H-S23ConnecticutPA 25-113, consent to sell1 Jul 2026 to 1 Oct 2026consent rule (replaced)1,750 ftNew Jersey, P.L.2026, c.25 (A5328 1R) Effective 30 Jun 2026 sale ban, 1,750 ft Sources: LOC-NFA-S02New JerseyP.L.2026, c.25 (A5328 1R)30 Jun 2026sale ban1,750 ftVirginia, Code 59.1-578(A)(6) (2026 ch. 820) Effective 1 Jul 2026 sale ban, 1,750 ft Sources: LOC-H-V01, LOC-H-V02VirginiaCode 59.1-578(A)(6) (2026 ch. 820)1 Jul 2026sale ban1,750 ftConnecticut, PA 26-64 (SB 4) Effective 1 Oct 2026 sale ban, 1,750 ft Sources: LOC-H-V03, LOC-H-V04ConnecticutPA 26-64 (SB 4)1 Oct 2026sale ban1,750 ftCalifornia, Civil Code 1798.140(w) In force at access; effective date not coded definition, right to limit, 1,850 ft Sources: LOC-H-S24CaliforniaCivil Code 1798.140(w)in force at access; effective date not codeddefinition, right to limit1,850 ftsale bangeofencing banconsent rule or definitionBars run from the effective date to the cutoff. Maryland’s ban covers sensitive data, which includes precise geolocation, with no consentexception; section 2 of its chapter makes section 14-4612 apply only to processing from 1 April 2026, which does not postpone the ban.Connecticut’s PA 26-64 replaced the consent-to-sell rule of PA 25-113 and requires data brokers to register before selling from 1 January2027. California defines precise geolocation at 1,850 feet and gives a right to limit its use, but bans no sale. Colorado, New Hampshire,Montana and other states were not opened. A law in effect has no documented effect until a source shows one.
5 states ban the sale of precise geolocation, all from dates between October 2025 and October 2026, each at 1,750 feet. US state rules on precise geolocation opened in stream H, with the corrections of its verifier and the review rounds applied: Virginia’s Code 59.1-578(A)(6) (effective 1 July 2026) and Connecticut’s Public Act 26-64 (effective 1 October 2026) ban the sale of precise geolocation, joining Maryland (1 October 2025), Oregon (1 January 2026) and New Jersey (P.L.2026, c.25, 30 June 2026). Washington’s My Health My Data Act bans geofences of 2,000 feet or less around health care entities and has done so since 23 July 2023.Units: effective dates; feet · Scope: state statutes opened by the cutoff, US · Sources Only the states listed were opened; other states with precise-geolocation definitions were not swept. Virginia’s effective date rests on the legislature’s bill history; each act’s coverage thresholds and exemptions apply.Data: data/figure-data.json#states

Maryland's ban is subject to the act's coverage thresholds and exemptions, and a clause that limits one section to processing from 1 April 2026 does not postpone the sale ban . Virginia still requires consent for other processing of precise geolocation . Washington treats precise location that could indicate an attempt to obtain health services as consumer health data .

GroundTruth says that for locations in Maryland, Oregon, Virginia, New Jersey and Connecticut, visit tracking, radius targeting below one mile and audience building from new precise signals are unavailable, and attributes this to state precise-geolocation laws . For national segments on The Trade Desk, Foursquare requires a separate New York, Washington and Connecticut set with a minimum 3,000-foot radius "to follow state privacy laws" . Placer names Washington's act and Nevada's SB 370 as reasons it withholds reports on in-person health care locations . All three are vendor assertions .

What state attorneys general have done

Texas has brought the only state attorney-general lawsuit against an alleged location data broker found for 2023 to 2026, in the researcher's 14 searches and the verifier's 8 . On 13 January 2025 the Attorney General announced a suit in Montgomery County against Allstate, two Allstate insurers and three Arity entities, under the Texas Data Privacy and Security Act, the Texas Data Broker Law and the Insurance Code . The state alleges that Arity paid app developers to embed its SDK, naming Life360, and collected location and driving-behaviour data from over 45 million consumers without notice or consent; it calls the suit the first enforcement by a state attorney general under a comprehensive privacy law . The petition pleads a Data Broker Law count against Arity, and the case remains in litigation . Arity sells an advertising product, Arity Audiences, and on 16 October 2026 announced an agreement to buy substantially all of INRIX's assets . In those searches no state attorney-general lawsuit against an advertising-technology company over location data was found .

The other state actions found concern a carmaker, Google and one advertiser . Texas sued General Motors and OnStar on 13 August 2024 over driving data that included GPS coordinates, and Arkansas, Nebraska and Iowa followed between February 2025 and February 2026; all four suits are allegations . California's Attorney General and four district attorneys settled with GM for US$12.75 million over sales of location and driving data to Verisk and LexisNexis Risk Solutions, with final judgment entered on 12 May 2026 . State attorneys general have settled with Google over deceptive location tracking at least six times between October 2022 and October 2025, from Indiana's US$20 million to Texas's US$1.375 billion, which also resolves incognito-browsing and biometric claims . In 2017 Massachusetts bound Copley Advertising not to geofence at or near Massachusetts health care facilities to infer health status, after Copley had geofenced reproductive-health and methadone clinics in other states . California's March 2025 sweep of the location data industry is an investigation, not a lawsuit .

What the registries show

The data broker registries record what companies declare . In California's file of 603 registrants that operated as data brokers in 2025, 115 self-report collecting precise geolocation, among them Collective Data Solutions, Outlogic, InMarket, Mobilewalla, Unacast and Venntel; Kochava Inc. is not listed . Unacast and Venntel also answer yes to past-year sale or sharing with the federal government and other state governments . On 24 October 2026 the Texas register's 456 records included Outlogic, Collective Data Solutions, Unacast and Venntel but not Mobilewalla, InMarket or Kochava . Vermont's revised statute requires disclosure of precise-geolocation collection from 1 January 2027, and Connecticut requires data brokers to register from the same date . A registration is a filing about collection in a past year, not evidence of what a company sold at the cutoff or an assurance of compliance .

H5 is contradicted

H5 predicted that the five ordered companies would no longer sell precise-location or sensitive-location data products in the US at the cutoff. A clarification dated 24 October 2026, added after extraction following external review, sets precedence: one verified current US offer to sell or license precise location data to third parties contradicts H5, a current public offer is the test rather than proof of a sale, and a statutory notice of sales in the past twelve months is not on its own a current offer, and continued licensing is not a finding of an order breach . The verdict does not depend on the clarification, because the original contradicted branch is met .

Company at the cutoffWhat its own pages documentReading
Outlogic (X-Mode)It may "receive and sell the precise latitude and longitude coordinates of your mobile device"; data to license through data exchanges, platform partners or direct, via Snowflake, AWS S3 and a REST API; audiences through Eyeota and Adsquare; filtering of sensitive health-based locations in specific statesPrecise offer
Collective Data Solutions (Kochava)"Data Feeds: License premium data including ... precision location (protected by Privacy Block)", with Privacy Block marketed as blocking health clinics, religious institutions and schoolsPrecise offer
Gravy Analytics dba Unacast (with Venntel)Location Data, Foot Traffic Data and MAID-to-hashed-email linkages; device-level location data for the US and abroad; Venntel sells location products to national-security buyersPrecise offer
MobilewallaMovement data with MAID, latitude and longitude, IP and timestamp; personal information sold to clients and ad-tech partners in the past year; no precision class for what is soldUnclear
InMarketDoes "not sell (in the plain language sense of that word) or license to customers" precise geolocation, while its state-law notice lists precise geolocation "sold (or shared for interest-based advertising)" to Third Party PartnersNo such product

Unacast's offer survived a split. On 1 September 2026 Pine59 announced it had taken over Unacast's former Aggregated Location Insights business in a management buyout, yet Unacast's own pages still market device-level location data on 24 October 2026 . InMarket's reading rests on its home page and privacy policy, the only InMarket pages read for H5 .

The contradiction is about product sets, not breaches . Because the X-Mode and Gravy orders do not ban selling precise location outside sensitive places, Outlogic's and Unacast's offers are not on their face outside those orders, and compliance with any order is not assessed . Each of the companies that sells documents some sensitive-location suppression, from Outlogic's state filtering to CDS's Privacy Block and Unacast's PrivacyCheck, and each is the company's own statement . Outlogic and InMarket also appear on the signatory page, last updated March 2025, of the NAI's Precise Location Enhanced Standards, a self-regulatory code . Chapter 6 reads the audience products these companies sell, and chapter 11 scores the regulatory record under the privacy-posture dimension.

The instruments read

The instrument lists the state laws and registries read for this chapter. Each row describes the primary text as read; none is legal advice.

Rules and governance instruments

Official sources only for the rule text; industry guidance is marked as practice, not law. Nothing here is legal advice.

JurisdictionInstrumentWhat it requiresEffectiveScopeLaw or practiceSrc
MarylandOnline Data Privacy Act of 2024 (Ch. 455, SB 541)Controller may not sell sensitive data, which includes precise geolocation data; no geofence within 1,750 ft of mental health or reproductive or sexual health facilities for consumer health data2025-10-01controllers subject to the actsale ban + geofencing ban
OregonOregon Laws 2025 ch. 251 (HB 2008), amending ORS 646A.578Controller may not sell personal data accurately identifying a consumer's or linked device's present or past location within 1,750 ft, or personal data of a consumer under 162026-01-01controllers subject to ORS 646A.570-589sale ban
WashingtonMy Health My Data Act (2023 c 191, ESHB 1155), sec. 10Unlawful to implement a geofence (2,000 ft or less from perimeter) around an in-person health care entity to identify or track consumers, collect consumer health data or send them messages2023-07-23any persongeofencing ban
WashingtonMy Health My Data Act (2023 c 191), secs. 3-9Consumer health data (including precise location information, 1,750 ft, that could indicate an attempt to obtain health services) collected or shared only with consent or as necessary for a requested service2024-03-31 (small businesses 2024-06-30)regulated entities and small businessesconsent rule
ConnecticutPublic Act 25-113 (SB 1295), sec. 9 amending CGS 42-520Controller shall not sell the sensitive data of a consumer (includes precise geolocation data) without the consumer's consent (superseded for sale by Public Act 26-64 from 1 October 2026)2026-07-01controllers subject to CTDPAconsent rule
ConnecticutPublic Act 25-113 (SB 1295), sec. 15 amending CGS 42-529aNo collection of a known minor's precise geolocation unless strictly necessary, with a signal shown for the duration2026-07-01controllers offering online services to minorscollection limit
VirginiaConsumer Data Protection Act, Code 59.1-575 (definitions)Precise geolocation data (1,750 ft) is sensitive data; the sale ban is in 59.1-578(A)(6), listed separately2023-01-01 (not read here)controllers subject to VCDPAconsent rule (by definition only)
CaliforniaCCPA/CPRA, Civil Code 1798.140(w) and (ae)Precise geolocation (radius 1,850 ft) is sensitive personal information subject to the right to limit use; no sale bancurrent at accessbusinesses subject to CCPAdefinition + limit-use right
CaliforniaDelete Act data broker registry and DROPData brokers register January 1-31 each year; must process DROP deletion requests from 2026-08-012026-08-01 (DROP processing)registered data brokersregistry + deletion mechanism
New JerseyP.L.2026, c.25 (A5328 1R), amending P.L.2023, c.266No controller may sell sensitive data, including precise geolocation, regardless of consumer count; no data broker or data collector may sell or license sensitive data (ten listed exemptions)2026-06-30 (immediately; public registry provision after 270 days)Controllers, data brokers and data collectors; precise geolocation within 1,750 feetsale ban
VirginiaCode 59.1-578(A)(6), added by 2026 Acts ch. 820 (SB 338)A controller shall not sell or offer for sale precise geolocation data concerning a consumer2026-07-01controllers subject to VCDPAsale ban
ConnecticutPublic Act 26-64 (SB 4), secs. 14 and 15 amending CGS 42-520 and 42-521No controller and no third party shall sell any consumer's precise geolocation data (communications content and utility smart-meter data excepted)2026-10-01controllers and third parties subject to CTDPAsale ban
Machine-readable copy: data/rules.csv.

Chapter 8

Who checks the numbers

On 24 October 2026 none of the eleven accredited and under-review lists of the Media Rating Council (MRC) carried a US visit or visit-lift metric, so H6 is contradicted on that reading. Two location data sets held MRC accreditation from 2020, Foursquare's and GroundTruth's, and both lost it. MRC's only location standard dates from March 2017 and says nothing about lift. The rest of the assurance on offer is self-regulation, specification text and vendor statements, and Geopath, which publishes the US out-of-home audience currency, is on no MRC list opened.

In short

MRC's only location-specific standard is the Location-Based Advertising Measurement Guidelines, final Version 1.0 of March 2017, with no later update on MRC's index on 24 October 2026 . The text contains no provision on visit lift, incrementality or control groups . MRC's September 2018 presentation reported one accredited location service among six applicants, unnamed . Foursquare's Visits data set was accredited in July 2020 and revoked in December 2022 . GroundTruth's data set was accredited in July 2021 and later revoked after it withdrew, in a month the records leave unconfirmed . Both covered data sets, not a lift or attribution metric . On 24 October 2026 no visit, visitation, foot-traffic or location-determination metric was on any of MRC's six accredited or five under-review lists, so under the registered rule H6 is contradicted on that reading . The Network Advertising Initiative's (NAI) precise-location enhanced standards had four signatories on a page last updated March 2025: Cuebiq, Foursquare, InMarket and Outlogic . InMarket and Outlogic are under FTC orders . OpenRTB 2.6 sets no rule on truncating coordinates, so exchanges and publisher configuration set precision . Geopath appears on no MRC list opened, and MRC's out-of-home accredited list is empty .

What the 2017 guidelines require

MRC issued the Location-Based Advertising Measurement Guidelines in draft for 30 days of public comment in November 2016 and finalised them on 29 March 2017, sponsored with IAB and the Mobile Marketing Association (MMA). MRC's standards index on 24 October 2026 lists them as issued March 2017 with no later update . They cover how device and user location is assigned for physical visitation and ad exposure on mobile and static devices, including desktop and connected TV, and treat place measurement as the reference for visitation and targeting. They are guidance and a benchmark for voluntary third-party audit, not a certification .

The text separates accuracy, closeness to the true location, from precision, the number of decimal places, and requires both to be disclosed. A geofence is either a point radius or a boundary polygon. A physical visit is the intersection of device location and place, with speed or longitudinal analysis to exclude drive-bys, and the guidelines note that geofencing generally cannot represent multi-storey buildings . Two decimal places of latitude and longitude place a device within about one kilometre, four within about ten metres and five within about one metre. The text warns that decimal count must not be equated with accuracy, encourages first-party ground-truth validation and sets a general expectation of less than 5% error on primary reported characteristics, with disclosure above that .

On sources, the guidelines list GPS, Wi-Fi, IP, cell trilateration, registration data, beacons, panels and ad or bid-request location, and characterise mobile IP as generally neither accurate nor precise. Bid-request location should pass validation edit rules, and zip, DMA or state centroids should not stand for precise location unless reported at market level. Vendors using ad or bid-request data should disclose the active devices they observe daily, weekly or monthly and the number of measured visits . Projections need a fully disclosed universe, and mixed assignment methods should be disclosed by share, along with whether assignment is probabilistic or deterministic . The guidelines also require clear opt-in for location collection and a privacy policy stating why location is collected and how it is shared .

The guidelines recommend annual third-party certification of every digital location-based measurement product used in buying and selling, without requiring it. Conformance to them ("built to MRC guidelines") and MRC accreditation are therefore distinct states, and only accreditation appears on MRC's lists .

What they leave out

The 2017 text has no occurrence of "lift", "control group" or "incremental". MRC treats foot traffic as an outcome, and incrementality including randomised controlled trials, in its separate Outcomes and Data Quality Standards of September 2022, which require foot-traffic outcomes to follow the 2017 location guidelines . The location standard governs how a visit is counted, and whether advertising caused it falls under the general outcomes standard . In the 35 MRC communications from January 2020 to October 2026 screened by name for nine location vendors, and on the current lists, no lift, incrementality or attribution metric of a location product is recorded . Of the nine cohort A products that document a general visit-measurement method, seven use no holdout; of the eight that claim lift, six use a matched or synthetic control (chapter 5) .

The accreditation record

MRC's own 2017 text noted that some US location products had then been "accredited by the MRC in some fashion", without naming them . Its September 2018 presentation reported one accredited location service among six applicants, also unnamed . The records screened name three location services, and the table adds Epsilon's outcomes entry, which is not a visit metric .

ServiceScope in MRC's recordGrantedEndedEvidence
Unnamed location serviceOne of six applicants accreditedBy September 2018Not stated
Digital Element NetAcuity (Digital Envoy)IP geolocationNot in the records screenedMoved from hiatus to non-accredited, January 2020
Foursquare (formerly Placed) Visits data setLocation information reported in Visits data setJuly 2020Suspended October 2022; revoked December 2022
GroundTruth Location, Place, and Visit data setData setJuly 2021Hiatus at its request, September 2023; revoked after withdrawal, reported 26 July 2024, month unconfirmed
Epsilon Correlated Outcomes (online and offline)Desktop, mobile web, mobile in-app; not a visit metricContinued 1 October 2025Current
MRC ACTIONS ON LOCATION AND VISIT METRICS, 2018 TO 24 OCTOBER 2026201820192020202120222023202420252026MRC presentation, Sept 2018 (unnamed service) 26 Sep 2018: 'Location – 6 Applicants; 1 Accredited' Corrections ledger R2-114 Sources: LOC-NFA-S01MRC presentation, Sept 2018unnamed service26 Sep 2018: 'Location – 6 Applicants; 1 Accredited' MRC presentation, Sept 2018'Location – 6 Applicants; 1 Accredited'Digital Envoy NetAcuity (IP geolocation) 15 Jan 2020: hiatus to non-accredited, Jan 2020 Sources: LOC-A-S21Digital Envoy NetAcuity (IP geolocation)15 Jan 2020: hiatus to non-accredited, Jan 2020 Digital Envoy NetAcuity (IP geolocation)hiatus to non-accredited, Jan 2020Foursquare Visits data set 15 Jul 2020: granted Jul 2020 15 Oct 2022: suspended Oct 2022 15 Dec 2022: revoked Dec 2022 accredited 15 Jul 2020 to 15 Oct 2022 not accredited 15 Oct 2022 to 15 Dec 2022 Sources: LOC-A-S16, LOC-A-S18Foursquare Visits data set15 Jul 2020: granted Jul 2020 Foursquare Visits data setgranted Jul 202015 Oct 2022: suspended Oct 2022 Foursquare Visits data setsuspended Oct 202215 Dec 2022: revoked Dec 2022 Foursquare Visits data setrevoked Dec 2022GroundTruth Location, Place, Visit data set 15 Jul 2021: granted Jul 2021 15 Sep 2023: six-month hiatus Sept 2023 26 Jul 2024: revoked; reported 26 Jul 2024* accredited 15 Jul 2021 to 15 Sep 2023 not accredited 15 Sep 2023 to 26 Jul 2024 (end open) Sources: LOC-A-S17, LOC-A-S19, LOC-A-S20GroundTruth Location, Place, Visit data set15 Jul 2021: granted Jul 2021 GroundTruth Location, Place, Visit data setgranted Jul 202115 Sep 2023: six-month hiatus Sept 2023 GroundTruth Location, Place, Visit data setsix-month hiatus Sept 202326 Jul 2024: revoked; reported 26 Jul 2024* GroundTruth Location, Place, Visit data setrevoked; reported 26 Jul 2024*Any visit or location metric 24 Oct 2026: none on 11 lists, 24 Oct 2026 Sources: LOC-A-S05, LOC-A-S06, LOC-A-S07, LOC-A-S08, LOC-A-S09, LOC-A-S10, LOC-A-S11, LOC-A-S12, LOC-A-S13, LOC-A-S14, LOC-A-S15Any visit or location metric24 Oct 2026: none on 11 lists, 24 Oct 2026 Any visit or location metricnone on 11 lists, 24 Oct 2026accreditednot accredited (suspended or hiatus)grantedsuspended or hiatusrevokednone on any list* MRC’s communication of 26 July 2024 reports GroundTruth’s accreditation revoked after its withdrawal from the process; the row is labelledFebruary inside the April–June report, so the effective month is unconfirmed. MRC’s September 2018 presentation (slide 9, ACA ExecutiveForums) reports one accredited location service among six applicants without naming the service or the metric (corrections ledger R2-114).Lists opened on 24 October 2026: 6 accredited-services lists and 5 services-under-review lists; visit or location entries found: 0.
No visit or location metric is on any of MRC’s eleven lists; both visit data sets MRC accredited, in 2020 and 2021, have since lost accreditation. Every MRC action on a location, place, visit or IP-geolocation metric found in MRC’s communications from January 2020, plus MRC’s September 2018 presentation, and the state of its lists on 24 October 2026. Foursquare’s Visits data set was accredited in July 2020, suspended in October 2022 and revoked in December 2022; GroundTruth’s Location, Place, and Visit data set was accredited in July 2021, went on a six-month hiatus at its request in September 2023 and was reported revoked in July 2024. Foursquare said its Attribution product was not audited.Units: dated MRC actions · Scope: MRC accredited-services and services-under-review lists and communications, US · Sources Communications before January 2020 were not screened apart from the September 2018 presentation (LOC-NFA-S01), which names no service. Status-sensitive: lists read on 24 October 2026.Data: data/figure-data.json#mrc

MRC granted Foursquare's accreditation in July 2020, suspended it in October 2022 and revoked it in December 2022, per its communications of 13 October 2020 and 24 January 2023. Because of the 2018 slide, the 2020 grant is not established as the first location accreditation . Foursquare's 2020 release said Attribution "has not been audited or accredited by the MRC" .

GroundTruth's accreditation came in July 2021, as MRC recorded on 20 October 2021, and covered a data set, not a visit-lift or attribution metric . In September 2023 MRC granted a six-month hiatus at GroundTruth's request, during which the service was not accredited. MRC later recorded the accreditation as revoked "due to withdrawal from the MRC accreditation process", in a row labelled February inside its April to June 2024 communication of 26 July 2024 . The effective month is unconfirmed . GroundTruth's own pages still present the accreditation as current. Its August 2021 release carries no hiatus or revocation notice, and a comparison page last modified on 9 November 2023 says in the present tense that GroundTruth is "Accredited by the Media Rating Council (MRC)" for its place, location and visitation datasets .

Digital Envoy's NetAcuity, the only other MRC-accredited location-determination service found in the communications screened, became non-accredited in January 2020 after Digital Envoy chose not to proceed with a new audit. No IP-geolocation service was on MRC's lists on 24 October 2026 . Epsilon's Correlated Outcomes is the only accredited outcomes metric on MRC's digital list. Its letter cites impression, invalid-traffic and data-integration standards, not the location guidelines, and does not define offline outcomes as store visits, so it does not satisfy H6 .

H6, coded by the rule

Under the registered rule, H6 is contradicted on MRC's lists as read on 24 October 2026 . H6 states that at least one US footfall or visit-measurement product holds current MRC accreditation of its visit or visit-lift metric at the cutoff. The registered rule codes it contradicted when MRC's lists at the cutoff carry no accredited visit, visitation or visit-lift metric for any product. Lapsed or withdrawn accreditations are reported with their dates and do not change the verdict, and audits in progress confirmed by MRC are reported separately.

On 24 October 2026, none of MRC's six accredited-services lists and none of its five under-review lists carried a visit, visitation, foot-traffic or location-determination metric. The closest entries under review are Kevel's "Conversions and incrementality" and Kroger's attributed and incremental sales. MRC's April to June and July to September 2026 communications record no location or visit action . The rule dates the verdict to the cutoff, 24 October 2026; a later change will be logged as a dated correction (chapter 13).

Read vendor by vendor, the lists give the same answer. On 24 October 2026 Blis, Foursquare, GroundTruth, InMarket, Placer, Unacast and Vistar appeared on neither MRC's accredited nor its under-review digital list . InMarket's assurance claims (Comscore verification, Location Sciences certification and a Forrester TEI study) are not accreditations . Location Sciences' certification of InMarket audiences dates from 2020, and no later audit, renewal or report was found, although InMarket's 2026 data page still says "Location Sciences certified" . Placer's documented certifications are information-security ones .

Self-regulation: the NAI

The NAI's Precise Location Enhanced Standards were first issued on 22 June 2022 with Cuebiq, Foursquare and PlaceIQ as signatories, and reissued as "Updated and effective October 2024". The signatory page in the PDF, last updated March 2025, shows four logos: Cuebiq, Foursquare, InMarket and Outlogic. Within US activities the standards bar using or transferring activity correlated to a known sensitive point of interest (11 definitive and 2 non-definitive categories), and uses for law enforcement, national security or bounty hunting, subject to exceptions . PlaceIQ, an initial signatory, is not among the four .

NAI's 2020 Code defines precise location information as data from technology able to determine a device's actual physical location with reasonable specificity, and requires opt-in consent for its use in tailored advertising. NAI's February 2020 guidance describes three ways to make location imprecise: two or fewer decimal places, an area at least as large as a circle of 500 m radius, or a non-unique general descriptor of the place .

Two of the four signatories are under FTC orders . InMarket's order, finalised in May 2024, bars it from selling or licensing precise location data and from products that categorise or target consumers on sensitive location data . The X-Mode order binding Outlogic, issued in April 2024, bars uses of sensitive location data and does not ban the sale of precise location data as such . Outlogic's own site says the company may "receive and sell the precise latitude and longitude coordinates" of a device . Foursquare's privacy policy says that, as a participant in the standards, it does not use or share activity correlated with 13 listed sensitive-place categories, a vendor statement . Unacast cites NAI membership "in good standing" with "annual reviews", a self-regulatory status with no public product-scoped result . Chapter 7 covers the orders.

Who sets coordinate precision

The specification does not. OpenRTB 2.6's Geo object carries latitude and longitude as floats, a type for the source (1 GPS or location services, 2 IP address, 3 user-provided), accuracy in metres, seconds since the fix and the IP location service. Coordinates should be passed only if they match the accuracy of the stated type, and a postal-code centroid should not be passed. The 2.6 text has no rule on truncating or rounding coordinates .

Precision is set downstream. Google's Authorized Buyers documentation, last updated 17 September 2026, states that its bid-request location comes only from IP geolocation and that Google limits latitude and longitude to 0.01 degrees, a description of its own exchange . Prebid's documented coarsening happens only when a publisher rule or a configured privacy module denies the transmitPreciseGeo activity. Prebid Server then truncates to two decimals and masks part of the IP address. The default is allow, and the Prebid Mobile Android SDK sets no precision limit by default . Across these documents two decimal places is the recurring boundary between precise and coarse, but the bodies attach different distances to it. NAI's 500 m radius is about 6% smaller than the 1,750-foot radius in several state laws . MRC's 2017 text warns that decimal count must not be equated with accuracy . In this paper's reading, a two-decimal rule therefore bounds precision, not accuracy.

OpenRTB remains the baseline in production: Google documents bid requests whose geo type is always IP, with coarse accuracy . Hierarchical geographic cells are not part of AdCP at the cutoff versions. Issue #5969, which proposes them, was opened by the author and was open with milestone 3.4.0 when read on 24 October 2026 . It is a declared interest and a rival framing, not evidence, and chapter 10 records the protocol states and the author's role in the working group.

IAB guidance

IAB's location-data guidance found by the cutoff runs from the gated Mobile Location Data Buyer's Guide (July 2014) and the February 2016 Mobile Location Data Guide for Publishers to the April 2017 Location-based Marketing Playbook for Retailers. The playbook is buyer-facing. It asks whether device data come "through panels or pass through ad exchanges" and how store-visit-lift control groups are selected. No IAB or IAB Tech Lab location guide later than April 2017 was found in the sources screened . Verve is among the playbook's listed contributors, and Verve Group is the author's former employer . Media and Games Invest agreed in January 2020 to buy substantially all of Verve Wireless's assets and renamed itself Verve Group SE in June 2024 .

IAB published a Digital Out-Of-Home (DOOH) Measurement Guide on 8 July 2025, behind a free-account gate. IAB's blog of that day says it covers attribution through "synthetic control groups and matched market testing". The blog does not mention MRC, Geopath or OpenRTB . Under this paper's rules a matched comparison is not causal evidence.

Geopath: a currency without MRC accreditation

On 24 October 2026 MRC's out-of-home accredited list was empty, its only out-of-home service under review was JCDecaux's Proof of Plays metric, and Geopath appeared on no MRC list opened. In the sources screened, the US out-of-home audience currency is not MRC-accredited . Geopath publishes the audience estimates US out-of-home trades on, as annual planning datasets. The 2026 dataset went into preview on 30 September 2026 and, per its 19 October post, becomes the default transactional planning dataset on 12 November 2026, after the cutoff . It is a not-for-profit governed by a tripartite board of advertisers, agencies and media companies. Its own page says it was established in 1934 as the Traffic Audit Bureau for Media Measurement, which conflicts with the 1933 in the author's essay .

Geopath did help write MRC's standard for the medium: the Out-of-Home Measurement Standards, final December 2025, were developed with DPAA, Geopath and OAAA, and they name mobile location among deterministic inputs and require services to ascertain the accuracy of third-party data . Geopath's methodology overview says it is not designed to provide a comprehensive statistical validation and reports no confidence intervals . Its reach and frequency model is self-reported to align with observed data within ±5%, with no provider, sample or validation method named . In March 2026 Geopath and the OAAA announced an Ipsos-supported pilot in the second half of 2026, a transition beginning in 2027 and full adoption in 2028 . Chapter 9 reads its data sources.

What assurance covers

For location in the US, the MRC record holds a 2017 standard with no lift provision, two revoked data-set accreditations and no current visit metric . Everything else a buyer is shown is a different kind of assurance: NAI self-regulation, exchange documentation, vendor certifications and pages that still describe a revoked accreditation . A buyer can ask for the MRC letter and check its date, metrics and environments against the current list. Chapter 11 scores independent assurance on that basis, and chapter 12 turns it into questions.

Chapter 9

Out-of-home runs on mobility data

US out-of-home trades on an audience currency built from smartphone location panels, and the programmatic sellers on top of it add more mobility data for targeting and attribution. Geopath names its sources, but its panel figures date from 2023 documentation and its own pages say they offer no comprehensive statistical validation. Three of six US DOOH products and currencies coded name their location sources, and only Geopath states a panel size. No DOOH footfall product or case screened documents a randomised or holdout control. Geopath and the OAAA have picked Ipsos to support a pilot of a successor system, and no document found by the cutoff says what data it will use.

In short

Geopath's 31 May 2023 methodology names MotionWorks device panels, Teralytics/Streetlytics and HERE for roadways, and Claritas among its demographic sources, with no proportions . Its pages describe more than 100 million unique US devices a month culled to seven to ten million qualified devices a week, a documentation-dated figure with no observation vintage . A 19 October 2026 post names Bentley Systems as roadside data provider, and the 2026 Planning Dataset becomes the default on 12 November 2026, after the cutoff . Geopath's likelihood-to-see impressions are opportunity-to-see counts adjusted by a visibility model , its ±5% accuracy claim compares a model with the mobile data it was trained on , and on 24 October 2026 it appeared on no MRC list opened . An Ipsos-supported pilot was announced to launch in the second half of 2026, with transition from 2027 and full adoption in 2028; no document on the pilot's data sources was found by the cutoff . Of six US DOOH products and currencies coded under Q2, three name their location sources and one states a panel size . Of six DOOH footfall-attribution products or cases screened, none documents a randomised or holdout control . OpenRTB's qty object carries a DOOH impression multiplier and the measurement vendor's domain, but no field for its mobility source . T-Mobile has owned Vistar since 3 February 2025, and since 5 October 2026 its enhanced segments, now with "location insights", have been sold for DOOH only through the Vistar DSP .

The currency and its inputs

Geopath's methodology documentation, published on 31 May 2023, names MotionWorks device panels, Teralytics/Streetlytics and HERE Maps for roadways, HERE Maps for vehicle travel, and government agencies, MotionWorks and Claritas for demographics, without proportions . Under the Q2 coding rule Geopath is coded source disclosed . Geopath says it was established in 1934 as the Traffic Audit Bureau for Media Measurement and is a not-for-profit governed by a tripartite board of advertisers, agencies and media companies . It is a currency body, not an accreditor or verifier .

The documentation is a set of Confluence pages . A "Mobile Device Location & Movement Patterns" page says source data from multiple location SDK aggregators cover more than 100 million unique US devices a month and that Intermx culls them to a sample of seven to ten million qualified devices a week . Each record carries a device ID, a UTC timestamp, coordinates and horizontal precision in metres, and imprecise sightings are removed under no stated numeric threshold . The Mobile Device Panel page of the same date describes a weekly panel of GPS-sighted devices active about eight hours a day with a consistent Census Block Group home, culled by Standard Data . A Movement Patterns page records AirSage origin-destination matrices for the 2019-2020 methodology and a 2021 expansion contracted to Standard Data . These device counts are a documentation-dated disclosure with no stated observation vintage, not a current audited panel count . Whether MotionWorks still supplies the panel in 2026 is not stated in any document found .

The dataset in use at the cutoff has no published source list later than 2023 . Geopath's 2026 Planning Dataset went into preview on 30 September 2026, and its 19 October 2026 post names Bentley Systems as roadside data provider and credits "updated data sources" without listing them . That dataset becomes the default transactional planning dataset on 12 November 2026, a plan at the cutoff . This review found no statement of sources later than the 2023 list for the dataset in use at the cutoff .

US DOOH CURRENCY AND SSP PRODUCTS: MOBILITY SOURCE AND PANEL DISCLOSURESource named in owndocumentationKind of source namedPanel size with a periodGeopath audience currency Source named in own documentation: Stated in the documentation Kind of source named: SDK or device panel Panel size with a period: Stated in the documentation 7–10M qualified devices weekly from more than 100M US devices monthly, 31 May 2023 documentation Sources: LOC-I-S02, LOC-I-S03, LOC-I-S04, LOC-A-S46, LOC-I-V01Geopath audience currencyGeopath audience currency Source named in own documentation: Stated in the documentation Shown as: yesyesGeopath audience currency Kind of source named: SDK or device panelSDK or device panelGeopath audience currency Panel size with a period: Stated in the documentation Shown as: yesyesVistar Media attribution Source named in own documentation: Stated in the documentation Kind of source named: SDK or device panel Panel size with a period: A count with no period or definition InMarket 'nearly 200M+' users, no period Sources: LOC-I-S17, LOC-I-S18Vistar Media attributionVistar Media attribution Source named in own documentation: Stated in the documentation Shown as: yesyesVistar Media attribution Kind of source named: SDK or device panelSDK or device panelVistar Media attribution Panel size with a period: A count with no period or definition Shown as: count, no periodcount, no periodVistar Media audience targeting Source named in own documentation: Stated in the documentation Kind of source named: Several kinds, incl. bidstream Panel size with a period: Not stated Sources: LOC-I-S19, LOC-I-S20, LOC-I-S21, LOC-I-V05Vistar Media audience targetingVistar Media audience targeting Source named in own documentation: Stated in the documentation Shown as: yesyesVistar Media audience targeting Kind of source named: Several kinds, incl. bidstream Shown as: panel, bidstream, otherpanel, bidstream, otherVistar Media audience targeting Panel size with a period: Not stated Shown as: not statednot statedPlace Exchange PerView Source named in own documentation: Not stated Kind of source named: Device data, origin not stated Panel size with a period: Not stated Sources: LOC-I-S22, LOC-I-S23Place Exchange PerViewPlace Exchange PerView Source named in own documentation: Not stated Shown as: not statednot statedPlace Exchange PerView Kind of source named: Device data, origin not stated Shown as: device IDs, origin unstateddevice IDs, origin unstatedPlace Exchange PerView Panel size with a period: Not stated Shown as: not statednot statedBroadsign foot-traffic studies Source named in own documentation: Not stated Kind of source named: Device data, origin not stated Panel size with a period: Not stated Sources: LOC-I-S24Broadsign foot-traffic studiesBroadsign foot-traffic studies Source named in own documentation: Not stated Shown as: not statednot statedBroadsign foot-traffic studies Kind of source named: Device data, origin not stated Shown as: device IDs, origin unstateddevice IDs, origin unstatedBroadsign foot-traffic studies Panel size with a period: Not stated Shown as: not statednot statedPerion (Hivestack) footfall lift Source named in own documentation: Not stated Kind of source named: Device data, origin not stated Panel size with a period: Not stated Sources: LOC-I-S27, LOC-I-S29Perion (Hivestack) footfall liftPerion (Hivestack) footfall lift Source named in own documentation: Not stated Shown as: not statednot statedPerion (Hivestack) footfall lift Kind of source named: Device data, origin not stated Shown as: device IDs, origin unstateddevice IDs, origin unstatedPerion (Hivestack) footfall lift Panel size with a period: Not stated Shown as: not statednot statedStated in the documentationA count with no period or definitionNot statedSDK or device panelSeveral kinds, incl. bidstreamDevice data, origin not statedGeopath: MotionWorks device panels, Teralytics/Streetlytics and HERE for roadways, in documentation of 31 May 2023, with 7–10 millionqualified devices weekly drawn from more than 100 million US devices monthly and no observation period stated; its 19 October 2026 post namesBentley Systems as roadside provider. Vistar attribution names InMarket (‘nearly 200M+ permission-based users’, no period) andFoursquare/Placed; Vistar’s partner pages name GroundTruth first-party, third-party and bidstream data and Adsquare mobile location data.Talon is excluded (coded only from a UK-hosted global page); Route (UK) and COMMB (Canada) are attributes; GroundTruth’s attribution on PlaceExchange names its own data but is a partner product.
Three of six US DOOH products name their mobility source, and only Geopath states a panel size with a period. Question Q2 coding of US DOOH audience currency, SSP and measurement products: the mobility source named in the product’s or operator’s own documentation, the kind of source, and whether a panel size is stated with a period (final wording of LOC-I-F23). A partnership announcement establishes a relationship, not a dependence. Place Exchange, Broadsign and Perion describe device data without naming where it comes from.Units: coding · Scope: US DOOH currency, SSP and network products, documentation read by the cutoff · Sources Geopath’s figures are documentation-dated (2023), not a current audited panel count; its 2026 dataset becomes the default on 12 November 2026, after the cutoff.Data: data/figure-data.json#dooh

What a Geopath impression is

A Geopath impression is a projected, visibility-adjusted estimate . Its core outputs are likelihood-to-see impressions, audience composition, and reach and frequency . Opportunity-to-see counts are adjusted by its proprietary visual acuity index (VAI) model for the probability of noticing the unit . Composition comes from treating a device's longest-dwell location as its home and applying census-block demographics, computed as an annual average by hour of day . The VAI model's inputs and parameters are not on the pages read . Under the Q1 coding the impressions are projected: panel observations scaled to a population and adjusted for visibility . Route's eye-tracking adjustment is the Great Britain counterpart of the VAI .

Geopath's reach-and-frequency approach, introduced with its 2023 data release, is "centered around observed mobile location data from smartphone applications and connected cars" and is self-reported to align with that data "with ±5% accuracy" . The "observed data" is the same mobile-derived panel measure the model is trained on, so the ±5% is agreement between a model and its own input, not with an independent count . The page names no provider, sample size or validation method . Geopath's methodology overview says it is not designed to provide a comprehensive statistical validation and reports no confidence intervals . In the sources screened by the cutoff, this review found no independent validation of Geopath reach and frequency .

On 24 October 2026, MRC's Out-of-Home accredited list was empty, the only OOH service under review was JCDecaux's Proof of Plays metric, and Geopath appeared on no MRC list opened . MRC's Out-of-Home Measurement Standards (final December 2025, developed with DPAA, Geopath and OAAA) treat location data as foundational where persons are not measured directly . They require services to ascertain the accuracy of third-party data, with disclosure when a source cannot be independently verified, and name "mobile location" among the deterministic inputs for adjusting likelihood-to-see to audience . Chapter 8 sets out the standards record.

The Ipsos pilot

On 31 March 2026, Geopath and the OAAA announced that their modernisation "began in early 2025" and that Ipsos had been selected to support an industry pilot launching in the second half of 2026 . The pilot is to be followed by a transition to a next-generation framework beginning in 2027 and "full adoption in 2028"; the release names no data sources . Between that release and the cutoff, this review found no Geopath or Ipsos document describing the pilot's data sources, panel or method in the sources screened . Ipsos's 12 May 2026 session page mentions the pilot without method, and Geopath's 30 September 2026 dataset post does not mention it .

Ipsos already recruits and processes the sample for Route, Great Britain's out-of-home currency for adults 15+ . Route combines passive GPS tracking of a recruited, consented sample of c.7,000 participants a year with volumetric counts and Lumen eye-tracking, and uses no third-party smartphone SDK panel . Route is an international attribute and earns no US score, and no document found says whether the US pilot will follow its design . No COMMB methodology page with data sources could be read by the cutoff, so Canada's currency is coded not disclosed .

Which sellers name their sources

Programmatic is a minority of DOOH spend on WOO's figures. Its study, aggregated by PwC and announced on 5 June 2026, puts global programmatic DOOH at about US$1.4 billion of revenue in 2025, 7% of total DOOH expenditure, with the Americas (not US-only) at US$670 million and 14.2% penetration . The data were submitted by 11 SSPs, and PwC "has not independently verified the information which it received from respondents"; the announcement says nothing about audience or mobility data .

ProductMobility source namedPanel size with periodQ2 code
Geopath (currency)MotionWorks panels, SDK aggregators; roadway and demographic suppliers7–10M qualified devices weekly, in 2023 documentationSource disclosed
Vistar attributionInMarket SDK data; Foursquare and PlacedNot statedSource disclosed
Vistar audience targetingPartner pages: GroundTruth, Adsquare, Foursquare, PlaceIQ, T-MobileNot statedSource disclosed; dependence not documented
Place Exchange PerView"Daily updated mobile data", provider unnamedNot statedNot disclosed
Broadsign measurementPartner logos onlyNot statedNot disclosed
Perion (Hivestack)"Anonymised device-level location data"Not statedNot disclosed

Of these six US products and currencies, three name their location sources in their own or the operator's documentation, and only Geopath states a panel size with a period . A not-disclosed code means not readable in public documentation at the cutoff, not independence from mobility data, and gated buyer pages may disclose more . Two products outside the six name a source. Broadsign Ads' audience targeting, registered but outside this US count because its US availability is unconfirmed, names Native Touch data "pulled from active application SDKs and APIs" . GroundTruth's DOOH attribution with Place Exchange uses GroundTruth's own "location and purchase data" . Broadsign announced its acquisition of Place Exchange on 25 November 2025, and Perion completed its acquisition of Hivestack on 12 December 2023 .

Vistar documents its partners in a public directory . The directory, read on 24 October 2026, tags 18 partners for US audience segments and six USA-tagged foot-traffic partners: Accretive, Arrivalist, Cuebiq, Foursquare, InMarket and Spotzi . Its partner pages describe GroundTruth's data as "first-party data, third-party partnerships, and bid stream data", Adsquare's as including "mobile location data" and InMarket's as "200M+ location-based users", with no proportions or precision class . Under the Q2 rule a partnership announcement establishes the relationship, not the dependence . InMarket's "nearly 200M+ permission-based users" has no period, geography or definition of users, and the same page gives two transaction figures, ~$122B+ and $2.5T+ .

Exposure is inferred from where a device was, and the documents opened state no full rule for it. Place Exchange describes a "patented process of capturing exposed mobile IDs for consumers in the viewshed of every screen at the time of ad play" and names no provider for them . GroundTruth counts a DOOH view when a device enters a screen's mapped viewshed "for the appropriate amount of time", with no time stated . Adsquare, in an interview, describes inferring exposure from the proximity of mobile advertising IDs to screen coordinates while an ad is live, with no radius stated . Vistar's 2022 case says exposure for studies uses "ad log timestamps, device location, venue type and screen location", and Vistar publishes no distance, dwell or line-of-sight rule .

The multiplier in the bid

OpenRTB 2.6 carries the audience estimate into the auction in its qty object . Its multiplier is the quantity of billable events deemed to occur ("a DOOH opportunity may be considered to be 14.2 impressions"), with a source type and, for vendor-provided values, the measurement vendor's domain . AdCOM lists the source types as unknown, measurement vendor, publisher and exchange . Neither document records the vendor's mobility source, panel or method, and neither enumerates multiplier vendors; one web search for a vendor list found none . In The Trade Desk, Vistar's audience impressions are "the result of impression multiplier calculations provided by SSPs & media owners", which its guide says "are commonly sourced from verification partners like Route and Geopath", while plain impressions count ad plays . Geopath and Route are currency bodies, not verifiers . Inference: a bid can carry a panel-derived audience count without saying which panel produced it .

Footfall attribution without a holdout

Of six DOOH footfall-attribution products or cases screened (four US, one UK, one global), none documents a randomised or holdout control: none is randomised or holdout, one asserts a matched control, two use unexposed comparisons and three do not disclose a control . With three of six undisclosed, fewer than four document a design, so H3's decision tree applied to this DOOH subset alone gives unresolved . H3 itself is tested on cohort A, which Chapter 5 reads as contradicted: seven of nine documented methods are non-holdout . H3's dated clarification of 24 October 2026 fixed that decision tree and by itself did not move the verdict.

Hivestack's study for Zoom Media UK and Gillette (London, November 2022, 115 screens) compared devices seen in a screen geofence while the ad played with devices in the same geofence when it did not . It reported a "2.12x lift" and 8,574 "Modeled incremental walk-ins", scaled by the ratio of an unnamed data partner's phone access to the GB population . That is a non-randomised time-split comparison, not a holdout . Perion's current page offers footfall lift "comparing exposed audiences with a matched control group" without a provider or matching method, and an undated Perion blog names Foursquare, Cuebiq, PlaceIQ and Adsquare as pre-integrated providers . Broadsign's Decathlon case reports "a 46% total increase in store footfall" and "an incremental 8 percentage point lift" against "non-exposed control groups"; only the second is described as incremental, and the control's formation is not disclosed .

Vistar documents no attribution method of its own at the cutoff . Its activation guide says it "works with trusted industry leaders" for studies that "require a feasibility test and have varying minimums and costs", and vistarmedia.com/measurement returned HTTP 404 . It has sold foot-traffic studies through rotating third parties since at least January 2019 . In two OAAA-hosted cases measured by Foursquare, Target's reported a 6.51% visitation lift over a four-day look-back "compared with non-exposed consumers", and Jack in the Box's an 8.8% lift, neither describing the control . Whether the 533,000 Target visits are observed or projected is not stated, and Vistar's visit basis is coded not disclosed . GroundTruth's Place Exchange release calls "more than half" of a national retailer's more than 42,000 exposed-consumer visits incremental with no control design described . On 24 October 2026 no Vistar metric was found on MRC's accredited or under-review lists .

The channel's guidance recommends matched designs and mentions holdouts as an aid. IAB's July 2025 DOOH Measurement Guide, gated on IAB's site but publicly retrievable as a PDF and read in the final live sweep, recommends synthetic-control and matched-market or matched-store tests for incrementality and says combining synthetic models with geographic holdouts can reduce contamination of the control group . That is guidance, not evidence that any of the six products above uses a holdout by default. Vistar's material does contain a randomised design, in a creative test . Its 23 September 2026 study with Omnicom Media and Annalect randomised 7,200 consumers in the Netherlands to a control creative or one of three store-locator placements and measured stated visit and purchase intent, which is declared, not a visit . The author earlier worked at Hearts & Science, an Omnicom Media agency.

A model on a model?

The author's essay "Measurement, on the Street's Terms" argues that a DOOH footfall or lift study is "a model on a model" . This chapter treats that as a rival framing to test. Where the layers are documented, it mostly holds. The audience behind a multiplier is a projected, visibility-adjusted estimate . Exposure is inferred from device proximity to a screen . Several documented visit bases are projected, as in Hivestack's modelled walk-ins and the projected store visits of Foursquare Attribution and InMarket LCI .

Two limits apply. Some inputs are panel observations, not models: InMarket's exposed device visits and GroundTruth's Observed Visits are coded observed . And for Vistar the basis is not disclosed, while Place Exchange, Broadsign and Perion do not name their sources, so for those products the framing can be neither confirmed nor rejected from public documents .

The carrier in the stack

T-Mobile US agreed on 20 December 2024 to acquire Vistar Media and completed the deal on 3 February 2025, transferring US$621 million in cash . At the 13 January 2025 announcement the parties described more than 1.1 million digital screens from nearly 370 OOH media owners . Lamar received US$115.1 million at closing for its 20% stake . T-Mobile also completed its acquisition of Blis on 3 March 2025 .

T-Mobile's app-ownership and engagement segments have been on Vistar's self-service DSP since 6 May 2025, and on 5 October 2026 Vistar announced enhanced segments that add "location insights", available exclusively through the Vistar DSP . Whether those insights are network-derived or app-permission location is not stated . AdExchanger, relaying T-Mobile's account, reported that the data include mobile location used to estimate inventory impressions, and that for users who opted into location tracking T-Mobile can detect proximity to OOH ads and retarget on other channels . T-Mobile tied the exclusivity to tightening regulation of location data and device IDs, and called DOOH measurement "on our road map to look into for next year" . Those are an interested party's statements, relayed by trade press .

Vistar's own documents disagree about what it handles. Its audience guide says DOOH targeting works "without ever relying on personal information", while its Services Privacy Notice (1 July 2026) says it receives device location histories tied to device identifiers and sells and shares personal information . On California's 2026 Data Broker Registry, Vistar declared "Yes" to collecting precise geolocation, after declaring "No" in the 2025 file . The FCC's US$80,080,000 forfeiture against T-Mobile concerns its carrier location programme before Vistar was acquired, not Vistar; the carriers' certiorari petition was distributed for the 6 November 2026 conference, after the cutoff .

AdCP v3.2.6, the agentic buying protocol, accepts Geopath-prefixed venue IDs and gives geopath and route as example measurement_source values, and its foot_traffic metric carries no field declaring the control design . The author's RFC #5969 for geographic cells (21 July 2026) is open in the AdCP working group he co-leads and has no protocol state ; chapter 10 treats it as a declared interest.

Chapter 10

Can an agent buy by place?

An agent can describe a place in AdCP in far more detail than any agent has been shown to buy one. Version 3.2.6 carries administrative geography, radius and polygon proximity, store catchments, named places, DOOH venue identifiers, per-venue delivery and a foot-traffic metric. In the sources screened, the furthest any location signal gets in open-protocol agent-driven buying is one implemented connector, built on an earlier beta, that maps countries, regions and DMAs into Google Ad Manager. No interoperability test result is public, and the vendor releases that claim geo-targeted agentic buys name no field. Under the registered rule, H7 is unresolved.

In short

At AdCP v3.2.6, the stable release of 23 October 2026, the targeting overlay represents countries, ISO 3166-2 regions, metros, postal areas, point-based proximity, store catchments and identifier-based named places, as schema representation and nothing more . Delivery reporting represents DOOH plays, a per-venue breakdown, a measurement_source and a foot_traffic metric qualified by methodology, with no field for the control design . Geographic cells are in neither v3.2.6 nor v3.3.0-beta.0, and the author's proposal for them is open . The only implemented connector found, Prebid Sales Agent v2.0.0, is built against AdCP 3.1.0-beta.3; it maps administrative geography into Google Ad Manager and refuses postal areas . On 24 October 2026 none of the 34 agents in AAO's public registry showed a passing geo or DOOH conformance test . The vendor releases that claim geo or venue targeting in agentic AdCP buys name no field and no protocol version . IAB Tech Lab's AAMP components carry geography only as coarse codes, and ARTF 1.0 has no standard intent to change or add a geographic field . The location vendors' agent interfaces found sit outside agent-driven buying . H7 is unresolved .

The test

H7 asks whether location signals (geo targeting fields, geographic cells, venue identifiers or visit metrics) reach documented production use in agent-driven buying by the cutoff. Shared rule 12 records five states for each protocol and version: schema representation, an implemented connector, a demonstrated interoperability test, documented production use and a demonstrated transaction. H7 is supported when at least one location signal reaches documented production use or a demonstrated transaction in an agent-driven buying workflow, with the protocol, version and signal recorded. It is contradicted when a source documents that a location signal was dropped, could not be carried, or failed in such a workflow or an interoperability test, and no location signal reaches documented production use. Anything short of both is unresolved, and the highest state reached is reported. Membership, working-group roles, proposals and announcements earn no state (Chapter 13).

The protocols screened are AdCP (the Ad Context Protocol), IAB Tech Lab's AAMP (Agentic Advertising Management Protocols) components and ARTF (the Agentic Real Time Framework) 1.0, with OpenRTB 2.6 as the non-agentic baseline . The screen also covered location vendors' own agent interfaces, including servers built on MCP (the Model Context Protocol), through which AI assistants call outside tools . Versions and statuses below were read on 24 October 2026, the cutoff .

Interests

The author opened the geographic cell proposal that this chapter codes and co-leads the working group in which it was raised . Two of the 34 agents in the public registry of AgenticAdvertising.org (AAO), read below, are his own, and neither carries a geo or DOOH result . He also made the dated ruling, after extraction, on how H7's contradicted rule treats a connector that refuses a field by design; it is reported with the verdict below. None of these earns a state.

What AdCP can represent

AdCP's latest stable release at the screen was v3.2.6, published on 23 October 2026 . Its media-buy targeting overlay represents administrative geography: countries, regions as ISO 3166-2 codes, metros in the nielsen_dma, uk_itl1, uk_itl2, eurostat_nuts2 or custom systems, and postal areas, each with a matching exclusion field. It represents geo_proximity as a radius, a travel-time isochrone or a buyer-supplied GeoJSON polygon, and store_catchments drawn from a synced store catalog . All of this is schema representation, which shows that a value can be expressed and nothing more .

Identifier-based geo_places entered through PR #6093, merged on 15 August 2026, first published in the pre-release 3.2.0-beta.0 on 17 August and first stable in 3.2.1 on 1 October 2026 . It keys each place by a stable ID in a declared system (geonames, google_ads, microsoft_ads or an owner HTTPS URI) and a place type drawn from administrative units plus airport. Its registered vocabulary therefore names cities and neighbourhoods, not store-level points of interest, and the PR defers place-level forecasting and delivery breakdowns .

DOOH has its own identifiers. Placements accept venue_id, screen_id and openooh_venue_type identifiers and authority-prefixed external IDs, with geopath:30961 as the schema's example. DOOH placements declare slot and loop durations, and the experimental static-OOH panel identifiers accept a Geopath Spot ID scheme . Delivery reporting has a top-level plays count and a dooh_metrics block of loop plays, screens used, screen time, share of voice achieved, calculation notes and a per-venue venue_breakdown . A measurement_source slug lists geopath and route among its examples, and an experimental ooh_metrics block tiers estimated impressions as currency_measured or seller_modeled (Chapter 9) .

Visits travel without their control design. The foot_traffic metric is defined as incremental visits over baseline and qualified by an attribution_methodology of panel_based, deterministic_purchase, probabilistic or modeled. No field declares the control design, on a search of the v3.2.6 schema source for holdout, ghost, control-group and randomisation terms . On this review's reading, a foot_traffic value received through AdCP cannot tell a buyer whether its baseline was randomised, held out or matched, which is the distinction H3 turns on (Chapter 5) .

Cells earn no state

Hierarchical geographic cells are in no AdCP version current at the cutoff. Issue #5969 proposes geo_cells and geo_cells_exclude with an h3, s2, geohash or custom cell-system enum. The paper's author opened it on 21 July 2026, and it is open on milestone 3.4.0 with the labels rfc and needs-wg-review . Its companions, #6013 on conversion and #6014 on cell-grain delivery reporting, are open on the same milestone. A GitHub search on 24 October 2026 found no geo_cells pull request, and neither v3.2.6 nor v3.3.0-beta.0 contains the field . Under the brief's rules the proposal earns no state, whatever its standing in the working group the author co-leads .

One connector, on an earlier beta

In the protocols, repositories and registry screened on 24 October 2026, the highest state any location signal reaches in open-protocol agent-driven buying is an implemented connector . The registry lists registered agents, not every AdCP deployment. Prebid Sales Agent v2.0.0, released on 1 July 2026, is built against AdCP spec 3.1.0-beta.3 (adcp Python SDK 5.7.0) rather than 3.2.6. It translates geo_countries, geo_regions and geo_metros, Nielsen DMA only, with their exclusions, into Google Ad Manager targetedLocations . It rejects geo_postal_areas with an explicit error, "not implemented in GAM static mapping". The targeting manager read has no handling for geo_proximity, store_catchments or geo_places, an absence bounded to that one file . The release predates geo_places by about seven weeks, since geo_places was first published on 17 August 2026 .

Code shows a connector exists. It does not show use, and no source opened shows a production buy that exercised this mapping .

LOCATION SIGNALS AGAINST THE FIVE PROTOCOL STATES, 24 OCTOBER 2026SchemaConnectorInterop testProduction useTransactionAdCP · administrative geo fields Schema: Documented Connector: Implemented connector Interop test: Not documented Production use: Vendor claim; no field named Transaction: Not documented Sources: LOC-J-S01, LOC-J-S14, LOC-J-V02, LOC-J-S13, LOC-J-S23AdCP · administrative geo fieldsAdCP · administrative geo fields Schema: Documented Shown as: documenteddocumentedAdCP · administrative geo fields Connector: Implemented connector Shown as: connectorconnectorAdCP · administrative geo fields Interop test: Not documentedAdCP · administrative geo fields Production use: Vendor claim; no field named Shown as: vendor claimvendor claimAdCP · administrative geo fields Transaction: Not documentedAdCP 3.2.6 · proximity, catchments Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S01, LOC-J-S14AdCP 3.2.6 · proximity, catchmentsAdCP 3.2.6 · proximity, catchments Schema: Documented Shown as: documenteddocumentedAdCP 3.2.6 · proximity, catchments Connector: Not documentedAdCP 3.2.6 · proximity, catchments Interop test: Not documentedAdCP 3.2.6 · proximity, catchments Production use: Not documentedAdCP 3.2.6 · proximity, catchments Transaction: Not documentedAdCP 3.2.6 · named places (geo_places) Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S03, LOC-J-S05, LOC-J-S13, LOC-J-V03AdCP 3.2.6 · named places (geo_places)AdCP 3.2.6 · named places (geo_places) Schema: Documented Shown as: documenteddocumentedAdCP 3.2.6 · named places (geo_places) Connector: Not documentedAdCP 3.2.6 · named places (geo_places) Interop test: Not documentedAdCP 3.2.6 · named places (geo_places) Production use: Not documentedAdCP 3.2.6 · named places (geo_places) Transaction: Not documentedAdCP 3.2.6, 3.3.0-beta.0 · geographic cells Schema: Not documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S06, LOC-J-S07, LOC-J-S08AdCP 3.2.6, 3.3.0-beta.0 · geographic cellsAdCP 3.2.6, 3.3.0-beta.0 · geographic cells Schema: Not documentedAdCP 3.2.6, 3.3.0-beta.0 · geographic cells Connector: Not documentedAdCP 3.2.6, 3.3.0-beta.0 · geographic cells Interop test: Not documentedAdCP 3.2.6, 3.3.0-beta.0 · geographic cells Production use: Not documentedAdCP 3.2.6, 3.3.0-beta.0 · geographic cells Transaction: Not documentedAdCP 3.2.6 · venue identifiers Schema: Documented Connector: Not documented Interop test: Not documented Production use: Vendor claim; no field named Transaction: Not documented Sources: LOC-J-S04, LOC-J-S12, LOC-J-S13, LOC-J-S22AdCP 3.2.6 · venue identifiersAdCP 3.2.6 · venue identifiers Schema: Documented Shown as: documenteddocumentedAdCP 3.2.6 · venue identifiers Connector: Not documentedAdCP 3.2.6 · venue identifiers Interop test: Not documentedAdCP 3.2.6 · venue identifiers Production use: Vendor claim; no field named Shown as: vendor claimvendor claimAdCP 3.2.6 · venue identifiers Transaction: Not documentedAdCP 3.2.6 · visit metric (foot_traffic) Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S02, LOC-J-S30AdCP 3.2.6 · visit metric (foot_traffic)AdCP 3.2.6 · visit metric (foot_traffic) Schema: Documented Shown as: documenteddocumentedAdCP 3.2.6 · visit metric (foot_traffic) Connector: Not documentedAdCP 3.2.6 · visit metric (foot_traffic) Interop test: Not documentedAdCP 3.2.6 · visit metric (foot_traffic) Production use: Not documentedAdCP 3.2.6 · visit metric (foot_traffic) Transaction: Not documentedAdCP 3.2.6 · DOOH delivery metrics Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S02, LOC-J-S12, LOC-J-S13AdCP 3.2.6 · DOOH delivery metricsAdCP 3.2.6 · DOOH delivery metrics Schema: Documented Shown as: documenteddocumentedAdCP 3.2.6 · DOOH delivery metrics Connector: Not documentedAdCP 3.2.6 · DOOH delivery metrics Interop test: Not documentedAdCP 3.2.6 · DOOH delivery metrics Production use: Not documentedAdCP 3.2.6 · DOOH delivery metrics Transaction: Not documentedAAMP OpenProposal 3.0 draft 1 · geo codes Schema: In a draft for comment only Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S18AAMP OpenProposal 3.0 draft 1 · geo codesAAMP OpenProposal 3.0 draft 1 · geo codes Schema: In a draft for comment only Shown as: draft onlydraft onlyAAMP OpenProposal 3.0 draft 1 · geo codes Connector: Not documentedAAMP OpenProposal 3.0 draft 1 · geo codes Interop test: Not documentedAAMP OpenProposal 3.0 draft 1 · geo codes Production use: Not documentedAAMP OpenProposal 3.0 draft 1 · geo codes Transaction: Not documentedAAMP primitives 0.5.1 · geo codes Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S19AAMP primitives 0.5.1 · geo codesAAMP primitives 0.5.1 · geo codes Schema: Documented Shown as: documenteddocumentedAAMP primitives 0.5.1 · geo codes Connector: Not documentedAAMP primitives 0.5.1 · geo codes Interop test: Not documentedAAMP primitives 0.5.1 · geo codes Production use: Not documentedAAMP primitives 0.5.1 · geo codes Transaction: Not documentedAAMP seller-agent 2.4.2 · geo codes Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S20AAMP seller-agent 2.4.2 · geo codesAAMP seller-agent 2.4.2 · geo codes Schema: Documented Shown as: documenteddocumentedAAMP seller-agent 2.4.2 · geo codes Connector: Not documentedAAMP seller-agent 2.4.2 · geo codes Interop test: Not documentedAAMP seller-agent 2.4.2 · geo codes Production use: Not documentedAAMP seller-agent 2.4.2 · geo codes Transaction: Not documentedARTF 1.0 · OpenRTB geo, inherited Schema: Documented Connector: Not documented Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S17ARTF 1.0 · OpenRTB geo, inheritedARTF 1.0 · OpenRTB geo, inherited Schema: Documented Shown as: documenteddocumentedARTF 1.0 · OpenRTB geo, inherited Connector: Not documentedARTF 1.0 · OpenRTB geo, inherited Interop test: Not documentedARTF 1.0 · OpenRTB geo, inherited Production use: Not documentedARTF 1.0 · OpenRTB geo, inherited Transaction: Not documentedVendor MCP: Foursquare, Mapbox Schema: Not a buying protocol Connector: Connector outside agent buying Interop test: Not documented Production use: Not documented Transaction: Not documented Sources: LOC-J-S25, LOC-J-S26Vendor MCP: Foursquare, MapboxVendor MCP: Foursquare, Mapbox Schema: Not a buying protocol Shown as: n/an/aVendor MCP: Foursquare, Mapbox Connector: Connector outside agent buying Shown as: outside buyingoutside buyingVendor MCP: Foursquare, Mapbox Interop test: Not documentedVendor MCP: Foursquare, Mapbox Production use: Not documentedVendor MCP: Foursquare, Mapbox Transaction: Not documentedComparator: OpenRTB 2.6 geo (not agentic) Schema: Documented Connector: Implemented connector Interop test: not assessed Production use: Documented production use Transaction: not assessed Sources: LOC-J-S15, LOC-J-S16Comparator: OpenRTB 2.6 geo (not agentic)Comparator: OpenRTB 2.6 geo (not agentic) Schema: Documented Shown as: documenteddocumentedComparator: OpenRTB 2.6 geo (not agentic) Connector: Implemented connector Shown as: connectorconnectorComparator: OpenRTB 2.6 geo (not agentic) Interop test: not assessednot assessedComparator: OpenRTB 2.6 geo (not agentic) Production use: Documented production use Shown as: productionproductionComparator: OpenRTB 2.6 geo (not agentic) Transaction: not assessednot assessedDocumentedIn a draft for comment onlyImplemented connectorConnector outside agent buyingVendor claim; no field namedDocumented production useNot documentedNot a buying protocolSchema states are read at AdCP 3.2.6 (23 October 2026). The only implemented connector, the Prebid Sales Agent v2.0.0, is built on AdCP3.1.0-beta.3: it maps countries, regions and Nielsen DMA metros into Google Ad Manager and rejects postal codes. geo_places first shipped inthe pre-release 3.2.0-beta.0 (17 August 2026). No agent in the AAO registry passed a geo or DOOH storyboard. Geographic cells are a proposal(#5969) by the author, in a working group he co-leads: a declared interest, and no state. The vendor claims (PubMatic, Broadsign) name nofield. Membership and announcements earn no state (shared rule 12).
No location signal has a public interoperability test; administrative geo reaches an implemented connector, on AdCP 3.1.0-beta.3, and geographic cells reach no state. Each class of location signal in the agentic protocols current at the cutoff, against the five states: schema representation, implemented connector, demonstrated interoperability test, documented production use and demonstrated transaction (stream J, corrected by its verifier). OpenRTB 2.6 is the non-agentic baseline: Google documents IP-derived, coarse geolocation in its live bid requests. H7 is unresolved under its registered rule.Units: state · Scope: AdCP 3.2.6 and 3.3.0-beta.0, AAMP components, ARTF 1.0, location-vendor MCP servers · Sources The author co-leads AdCP’s Signals & Measurement working group and wrote the geographic-cell proposal; neither earns a state. The registry is live data, read on 24 October 2026.Data: data/figure-data.json#protocols

No public test passes

A conformance storyboard pass is the nearest public analogue to an interoperability test, and none is public for location . In AAO's public registry on 24 October 2026, none of the 34 agents shows a passing geo or DOOH conformance test . The geo storyboards (geo_region_targeting, geo_region_all_values_support, geo_region_exclusion_support and geo_place_targeting) appear only on two agents graded on AdCP 3.2.6, goTom Sandbox and Publink, and both are untested at zero of zero steps . AdCP's sales_dooh specialism tests a seller exposing a venue_id and reporting plays and dooh_metrics, and no registered agent declares it . The 11 agents with a verified badge hold it in spec mode only, none in the live-traffic mode . These are public compliance records as read on 24 October 2026, the cutoff; they change as agents are regraded .

What vendors claim

The strongest public claims of location signals in agent-driven AdCP buys are vendor releases that record neither the signal nor the protocol version . PubMatic and Butler/Till, on 15 December 2025, describe an AdCP-enabled CTV campaign for Clubtails "delivering geo-targeted, premium CTV inventory" without naming a field or a geographic unit. Broadsign, on 27 May 2026, describes a Netherlands OOH campaign in which agents using AdCP informed audience and venue targeting, without naming identifiers or delivery metrics . Both are vendor assertions, and neither reaches documented production use of a named location signal under H7's rule .

Outside the open protocols, proprietary DOOH seller agents reached over MCP, from VIOOH and Displayce, claim geographic and proximity handling. They name no fields and report no transaction . InMarket announced Maestrø in beta on 18 June 2026 as an agentic optimisation layer that feeds InMarket outcomes to AI agents, with an Open Access route "Built on MCP". No public MCP server or AdCP agent for InMarket was found, so it is an announcement, not a documented protocol implementation .

AAMP and ARTF stay coarse

IAB Tech Lab's AAMP components represent geography only as coarse codes at schema level . OpenProposal 3.0 draft 1, published for comment on 22 September 2026, gives the targeting envelope a settable geo object with an allowed[] list of geo codes. The pre-release iab-agentic-primitives 0.5.1 gives packages geo_targets as ISO 3166-2 codes, and its linear-TV quotes use Nielsen DMA codes . The reference seller-agent 2.4.2 carries geo_targets in its media kit. A grep of its ad-server clients found no mapping of geo_targets into Google Ad Manager geo targeting, although its GAM model declares a geoTargeting field .

ARTF 1.0, released on 12 November 2025, carries location only inside the embedded OpenRTB 2.x BidRequest that agents receive . None of its eight mutation intents is specific to geography. An ARTF agent can read device.geo and could activate a location-derived audience segment by segment ID, but it has no standard intent to change or add a geographic field .

The baseline is further along

The non-agentic baseline opened here is further along than the agentic evidence screened . OpenRTB 2.6 defines a Geo object (lat, lon, type, accuracy, lastfix, ipservice, country, region, metro, city, zip, utcoffset), DOOH venue types and a qty impression multiplier . Google Authorized Buyers documents production bid requests in which geo type is always IP (2) and accuracy reflects coarse IP-based geolocation. That is documented production use of coarse, inferred location, not device-observed location (Chapter 1, Chapter 2) . It is one exchange's documentation of its own system, and other exchanges may pass GPS fixes .

Vendors' agent interfaces sit outside buying

Among location vendors, this review found agent interfaces only outside agent-driven buying . Foursquare publishes an MCP server, created in January 2025 and last pushed in April 2025, whose tools search places and snap coordinates to Foursquare place IDs. Mapbox publishes an MCP server (v0.16.0, 15 October 2026, with a hosted endpoint) for geocoding, point-of-interest search and isochrones . Radar runs two MCP servers. Its public documentation endpoint serves search and retrieval, and an authenticated server announced on 14 October 2026, in pilot for enterprise customers by request, gives AI assistants read-only tools to query a customer's own location records. Neither is an advertising-transaction interface . Placer lists a remote MCP server, "Pi for Placer MCP", as a per-account enterprise entitlement among its data delivery routes; its documentation page was last updated on 22 October 2026, and its launch date is not established .

For GroundTruth, Blis, InMarket and Vistar Media, the searches of 24 October 2026 found no MCP server or AdCP agent, and none of them appears among the 34 agents in AAO's registry . Private or unannounced agent interfaces would not appear in these sources .

H7, coded by the rule

H7 is unresolved at 24 October 2026 . Geographic cells reach no state. Proximity, store catchments, named places, venue identifiers, DOOH metrics and foot_traffic reach schema representation only, administrative geo reaches an implemented connector on AdCP 3.1.0-beta.3, and no interoperability test result is public . The supported rule needs production use or a transaction with the signal and version recorded, and the two vendor-claimed agentic AdCP campaigns record no location field, so it is not met .

The contradicted rule needs a source documenting that a location signal was dropped, could not be carried, or failed in an agent-driven buying workflow or interoperability test, with no location signal in documented production use. The Prebid connector's refusal of postal areas is the nearest candidate . A clarification dated 24 October 2026, made by the author after extraction, rules that "could not be carried" requires an observed attempted workflow or interoperability test that failed or dropped the signal, and that a connector refusing a field by design, seen only in code, does not meet it. No attempted workflow was observed, so the clarification leaves the verdict unresolved . Stream J read the refusal the same way, as a declared capability limit rather than a signal dropped or failed in a workflow .

The rival framing is registered with H7: frequency and reach should be governed by place on a hierarchical cell grid. It comes from the author's essay and from #5969, and it is a design proposal . The protocol-state evidence neither supports nor refutes it, and it moves no state .

What would move the verdict

Support needs a named location signal in documented production use or a transaction in an agent-driven buy, with the protocol, version and field recorded. A source showing that the PubMatic or Broadsign campaigns passed geography or venue identifiers as AdCP fields would be the shortest route . Earlier states would show first: a passing geo or DOOH storyboard, a registered agent declaring sales_dooh, a badge in live-traffic mode, or a connector built on 3.2 that handles proximity or places . A documented attempt in which a location signal failed or was dropped in an agent-driven buy would meet the contradicted rule, provided no location signal reached documented production use.

A buyer offered an agent-driven buy by place can ask which field carried the geography, at which protocol version, and whether a foot_traffic number came with its control design. Chapter 12 turns those into questions for sellers.

The register lists the protocol, registry and platform surfaces screened, with each one's status and the observable behind it.

Chapter 11

The Ground Quotient

The Ground Quotient (GQ) summarises what each location product documents in public, within its cohort. Across all five cohorts, the two weakest dimensions are the ones a buyer needs before treating a location number as fact: agreement with ground truth and independent assurance.

In short

47 products are scored on 11 dimensions in five cohorts: 12 in visit measurement and attribution (A), 14 in location audiences and targeting (B), 10 in foot-traffic and visit analytics (C1), 7 in raw movement data (C2) and 4 in geofencing and visit-detection SDKs (D). The field GQ is 41 in A, 44 in B, 41 in C1, 38 in C2 and 54 in D, which is shown without bands by design. 1 product sits in the Most documented band, 18 in Well documented, 21 in Partly documented and 2 in Least documented. Independent assurance averages 1 in every cohort, and ground-truth validation is among the three lowest-scoring dimensions in A, B and C2. The GQ measures documented capability, not accuracy or performance.

What the quotient does

Each product was scored from 0 to 5 on the dimensions that apply to its cohort, against anchors fixed before scoring and amended once, before any cell was scored, after the second outside review (chapter 13). The quotient groups the cells into three. Depth is what the data and the number are: source transparency, the location fix and visit definition, ground-truth validation and, in cohort A only, causal design. Reach is where it works: coverage, data access, documented production volume and US availability. Standing is whether a buyer can trust and trade it: independent assurance, method disclosure and privacy and consent posture. A product's Raw score is 0.45 × Depth + 0.25 × Reach + 0.30 × Standing, each group the mean of its counted cells and renormalised if a group is missing. Cells that are n/e (no evidence) or n/a (outside the cohort's mask) are skipped, never counted as zero.

Raw is pulled toward the cohort's field mean in proportion to how thin the record is: Shrunk = (k × Raw + K × F) / (k + K), where k is the row's counted cells, F the mean Raw of the cohort's admitted rows and K, the prior strength, 4. The GQ is 100 × Shrunk / 5. K is an author-set heuristic, not a statistical estimate, and the tests below rerun the index without it. Bands come from the unrounded distance to the field mean, 20 × (Shrunk − F): Most documented at +12 or more, Well documented at +1 or more, Partly documented at −8 or more, Least documented below. A band needs at least 6 counted cells with every group represented, and a cohort shows bands only when 6 or more of its rows qualify. Cohorts A, B, C1 and C2 do. Cohort D has 4 rows and carries no bands by design.

Two rules shape the numbers and are the author's choices. Projection method, how panel visits are scaled to a population, is reported beside the matrix as a separate module and is not in the quotient: scoring it inside the GQ would have rewarded products that disclose nothing about their projections (chapter 13). Privacy carries a risk cap: a product whose location data was the subject of a regulator order, entered judgment or confirmed breach in the three years before the cutoff scores at most 1, and its uncapped score for current controls is published beside it. Seven products carry the cap. Without it, their GQs would be 2 to 5 points higher, three would move up a band, and two uncapped products, Placer.ai among them, would move down as their cohorts' field means rose .

The field mean here is the mean of the cohort's Raw scores. That differs from the author's Contextual and Native Quotients, which pooled group scores, so a GQ is not comparable with a CQ or an NQ, and a score in one cohort is not comparable with a score in another.

The results

GROUND QUOTIENT (0–100) BY COHORT, WITH THE RANGE UNDER FOUR REWEIGHTINGSA · Visit measurement and attribution · field 41MostWellPartlyLeastCuebiq Footfall Measurement49 · 10/11Azira Measurement47 · 9/11GroundTruth visit measurement45 · 10/11Reveal Mobile — Reveal OOH Measurement45 · 9/11 ±Foursquare Attribution43 · 10/11 ±Adsquare Footfall Attribution42 · 9/11, moves ±InMarket visit-lift measurement41 · 10/11 ±Arrivalist MediaInsights40 · 10/11 ±Vistar Media attribution39 · 6/11 ±Blis Smart Holdout Groups36 · 9/11Kochava DOOH Advertising Measurement35 · 6/11 ±Precisely PlaceIQ attribution34 · 6/11, moves ±B · Location audiences and targeting · field 44MostWellPartlyLeastFoursquare Audience52 · 9/10Cuebiq Audiences48 · 7/10 ±Reveal Mobile — Reveal Audiences48 · 7/10 ±GroundTruth Ads Manager47 · 10/10Foursquare Proximity47 · 8/10 ±Adsquare ID-Precise Audiences46 · 9/10, moves ±Arity Audiences45 · 6/10, moves ±Simpli.fi Addressable Geo-Fencing45 · 8/10 ±†Azira Audience43 · 10/10Vistar Media audience targeting43 · 8/10 ±Precisely Audiences41 · 9/10InMarket Audiences41 · 10/10Blis audiences39 · 10/10Mobilewalla audiences36 · 10/10, moves253035404550556065GQ (dashed line: each cohort’s field score)Shaded zones: the Most, Well, Partly, Least documented bands, set per cohort. Each row: GQ · counted cells of applicable.Grey bar: range under the four reweightings; “moves”: the band changes under at least one. Provisional: ± the band moveswhen missing evidence is filled; † a blind second scorer’s scores move it.
Read the band, not the rank: in visit measurement and in audiences, no product clears the most documented line. The Ground Quotient for the banded products in cohorts A and B, one section per cohort; cohorts C1, C2 and D follow in the next figure, on the same axis. The Ground Quotient uses the band offsets of the author’s Contextual Quotient, but its field mean is the cohort’s mean Raw score rather than a pooled group mean, so the two do not read identically; neither construction validates it. Depth, Reach, Standing group means are combined 45/25/30 and shrunk toward the cohort’s field mean (the mean Raw score of its admitted rows) with a prior strength of 4; bands come from the unrounded distance to that field score, and only verified or qualified cells count. A band needs at least 6 counted cells with one in every applicable group, in a cohort with at least 6 such rows. Across the reweightings, positions move by up to 3 places within a cohort, and 34 of the 42 banded products in all cohorts keep their band under every weighting. GQ measures publicly documented capability within a cohort, not product performance.Units: GQ points on a 0–100 scale, pulled toward the cohort field mean; shown rounded, plotted unrounded · Scope: 26 banded products in cohorts A and B, of 47 in the capability matrix; scores as of 24 October 2026One initial scoring pass; 16 rows nearest a band line re-scored blind. The index inherits every limit of the dimension scores and is sensitive to the weights; the bands, not the positions, are the finding.Data: data/gq.csv
GROUND QUOTIENT (0–100) BY COHORT, WITH THE RANGE UNDER FOUR REWEIGHTINGSC1 · Foot-traffic and visit analytics · field 41MostWellPartlyLeastPlacer.ai54 · 10/10, movesUnacast foot-traffic data51 · 10/10Advan Patterns+51 · 10/10Foursquare Visits feeds50 · 8/10 ±Mapbox Movement Data40 · 8/10 ±Huq Industries36 · 8/10 ±Precisely Visits36 · 8/10PassBy34 · 7/10, moves ±Zartico30 · 7/10 ±C2 · Raw movement data · field 38MostWellPartlyLeastQuadrant45 · 9/10Complementics Location Data Feeds41 · 7/10 ±Veraset Movement40 · 10/10, movesUnacast device-level location data37 · 10/10Outlogic Observation Panel37 · 9/10Collective Data Solutions data feeds33 · 8/10 ±Tamoco33 · 6/10 ±D · Geofencing and visit-detection SDKs and APIs · field 54 · no bands by designNo product in this cohort is banded.253035404550556065GQ (dashed line: each cohort’s field score)Shaded zones: the Most, Well, Partly, Least documented bands, set per cohort. Each row: GQ · counted cells of applicable.Grey bar: range under the four reweightings; “moves”: the band changes under at least one. Provisional: ± the band moveswhen missing evidence is filled; † a blind second scorer’s scores move it. Not plotted, A to Z: Arity Geosight andRoadway Insights (thin record), Bluedot (cohort without bands), Foursquare Movement SDK (cohort without bands), Infillion— Gimbal (cohort without bands), Radar (cohort without bands). Their scores are in data/gq.csv.
In foot-traffic analytics and raw movement data, one product clears the most documented line; developer tools carry no bands by design. The Ground Quotient for cohorts C1, C2 and D, continuing the previous figure on the same axis and under the same rules. Cohort D is scored but not banded, by design; its rows are listed under the chart. GQ measures publicly documented capability within a cohort, not product performance.Units: GQ points on a 0–100 scale, pulled toward the cohort field mean; shown rounded, plotted unrounded · Scope: 16 banded products in cohorts C1, C2 and D, of 47 in the capability matrix; scores as of 24 October 2026One initial scoring pass; 16 rows nearest a band line re-scored blind. The index inherits every limit of the dimension scores and is sensitive to the weights; the bands, not the positions, are the finding.Data: data/gq.csv

In cohort A the field GQ is 41; a product needs 42.2 for Well documented and 53.2 for Most documented. In cohort B the field is 44, with Well documented from 45.4. In cohort C1 it is 41, with Well documented from 42.4 and Most documented from 53.4. In cohort C2 it is 38. At these field means, a product scoring 5 on every applicable dimension would reach 84 in cohort A, not 100, because of the shrinkage.

The one product in the Most documented band is Placer.ai, in cohort C1, and it clears the line by less than a quarter of a point; under three of the four reweightings it is Well documented. Its band rests on documentation, not on accuracy: its US availability is backed by an independent record, and the one third-party comparison found for it, at a single trail site and with its funding not stated, put its estimate 30.5% above the counter . That comparison scores 3, not 4, because a comparison with unstated funding is not independent under the rules. Placer.ai's population visit estimates are projections; it also exposes raw panel counts (chapter 1).

The capability matrix

Each cell scores one documented capability from 0 to 5 against fixed anchors; n/e means no evidence, n/a means the dimension does not apply to the cohort. Click a cell for its rationale, availability, evidence grade, date, sources and verification status. Rows are compared only within their cohort; cohort D is shown without bands by design. Projection method is a separate module shown beside the matrix; privacy shows the risk-adjusted value with current controls alongside.

5 documented in operational detail3 real but thin or narrow1 adjacent or incidental0 documented absencen/e insufficient evidencen/a outside the cohort’s maskunverified: shown, counted as n/eβ beta · ann announced · ? unconfirmed · ret retired · ± provisional band: it moves when missing evidence is filled† provisional band: a blind second scorer’s scores move it
ProductGQSourcesDefinitionValidationCausalCoverageAccessVolumeUSAssuranceDisclosurePrivacyCounted
A · Visit measurement and attribution
banded, by GQ
CuebiqCuebiq Footfall Measurement · Specialists49Well documented10/11
AziraAzira Measurement · Specialists47Well documented9/11
GroundTruthGroundTruth visit measurement · Ad tech · active; acquired by ZeroToOne.AI (March 2026)45Well documented10/11
Reveal MobileReveal OOH Measurement · Specialists45±Well documented9/11
FoursquareFoursquare Attribution · Specialists · acquisition announced by Infillion (pending or closed; closing unverified)43±Well documented10/11
AdsquareAdsquare Footfall Attribution · Specialists42±Well documented9/11
InMarketInMarket visit-lift measurement · Specialists · active, independent41±Partly documented10/11
ArrivalistArrivalist MediaInsights · Specialists40±Partly documented10/11
Vistar MediaVistar Media attribution · Ad tech · active, subsidiary39±Partly documented6/11
BlisBlis Smart Holdout Groups · Ad tech · active; acquired (completed 3 March 2025)36Partly documented9/11
KochavaKochava DOOH Advertising Measurement · Ad tech35±Partly documented6/11
PreciselyPrecisely PlaceIQ attribution · Enterprise data34±Partly documented6/11
B · Location audiences and targeting
banded, by GQ
FoursquareFoursquare Audience · Specialists52Well documented9/10
CuebiqCuebiq Audiences · Specialists48±Well documented7/10
Reveal MobileReveal Audiences · Specialists48±Well documented7/10
GroundTruthGroundTruth Ads Manager · Ad tech47Well documented10/10
FoursquareFoursquare Proximity · Specialists47±Well documented8/10
AdsquareAdsquare ID-Precise Audiences · Specialists46±Well documented9/10
ArityArity Audiences · Enterprise data45±Partly documented6/10
Simpli.fiSimpli.fi Addressable Geo-Fencing · Ad tech45±†Partly documented8/10
AziraAzira Audience · Specialists43Partly documented10/10
Vistar MediaVistar Media audience targeting · Ad tech43±Partly documented8/10
PreciselyPrecisely Audiences · Enterprise data41Partly documented9/10
InMarketInMarket Audiences · Specialists41Partly documented10/10
BlisBlis audiences · Ad tech39Partly documented10/10
MobilewallaMobilewalla audiences · Specialists36Least documented10/10
C1 · Foot-traffic and visit analytics
banded, by GQ
Placer.aiSpecialists · active, independent54Most documented10/10
UnacastUnacast foot-traffic data · Specialists51Well documented10/10
AdvanAdvan Patterns+ · Specialists51Well documented10/10
FoursquareFoursquare Visits feeds · Specialists50±Well documented8/10
MapboxMapbox Movement Data · Enterprise data40±Partly documented8/10
HuqHuq Industries · Specialists36±Partly documented8/10
PreciselyPrecisely Visits · Enterprise data36Partly documented8/10
PassBySpecialists34±Partly documented7/10
ZarticoSpecialists30±Least documented7/10
not banded, A to Z
ArityArity Geosight and Roadway Insights · Enterprise data38Thin record4/10
C2 · Raw movement data
banded, by GQ
QuadrantSpecialists45Well documented9/10
ComplementicsComplementics Location Data Feeds · Specialists41±Well documented7/10
VerasetVeraset Movement · Specialists40Well documented10/10
UnacastUnacast device-level location data · Specialists37Partly documented10/10
OutlogicOutlogic Observation Panel · Specialists37Partly documented9/10
Collective Data SolutionsCollective Data Solutions data feeds · Specialists33±Partly documented8/10
TamocoSpecialists33±Partly documented6/10
D · Geofencing and visit-detection SDKs and APIs
no bands in this cohort, A to Z
BluedotDeveloper platforms48Cohort without bands8/10
FoursquareFoursquare Movement SDK · Developer platforms59Cohort without bands8/10
InfillionGimbal · Developer platforms52Cohort without bands7/10
RadarDeveloper platforms · active, independent56Cohort without bands10/10
How GQ is built. The Ground Quotient uses the band offsets of the author’s Contextual Quotient, but its field mean is the cohort’s mean Raw score rather than a pooled group mean, so the two do not read identically; neither construction validates it. Three groups: Depth (source transparency, location fix and visit definition, ground-truth validation, causal design), Reach (coverage, data access and integrations, documented production volume, us availability and coverage) and Standing (independent assurance, method disclosure, privacy and consent posture). Only verified or qualified cells count; an unverified cell counts as n/e, and n/a comes only from the cohort’s applicability mask. Each group is the mean of the counted cells inside it, so an unscored dimension is not counted as a zero. Raw combines the groups at 45/25/30, renormalised over the groups present, and is shrunk toward the cohort’s field mean, the mean Raw score of the cohort’s admitted rows, thin rows included, with a prior strength of 4 against the row’s own count of counted cells. A cohort is a set of products doing a comparable job; each has its own field mean and band lines, and rows are never ranked across cohorts. The weights and the prior strength are author-defined heuristics. Bands come from the unrounded distance to the cohort’s field score (Most documented at +12 or more, Well documented at +1 or more, Partly documented at −8 or more, Least documented below that); only the displayed score is rounded. A row gets a band only with at least six counted cells and at least one in every applicable group, and only in a cohort with at least 6 such rows; the others show a score without a band and are listed apart, A to Z, with any missing group named. The three bars under each score are Depth, Reach and Standing in that order. GQ summarises publicly documented capability within a cohort, not product performance, and is not calibrated to buyer outcomes.

Read the band, not the rank. A · Visit measurement and attribution (12 rows, field GQ 41.2). Band lines: Most documented 53.2, Well documented 42.2, Partly documented 33.2, Least documented below. Under four reweightings (equal thirds, depth-led, reach-led, standing-led), with Raw and the field mean recomputed, no product sits in the top band (Most documented), while positions move by up to 3 places and by 0.7 on average. Of the 12 banded products, 10 keep their band under every weighting (Arrivalist, Azira, Blis, Cuebiq, Foursquare, GroundTruth, InMarket, Kochava, Reveal Mobile, Vistar Media); Adsquare, Precisely cross a band line under at least one. With a prior strength of 0 (Raw, no shrinkage), 2 and 8 instead of 4, positions move by up to 0, 0 and 0 places. Deleting one counted cell at a time moves a score by up to 4 points up (Arrivalist, privacy and consent posture) or 5 down (Blis, causal design); 0 deletions would drop a row below admission and 18 would cost a row its band eligibility. In the missing-evidence scenarios (every n/e cell of a banded row filled with 1, then with 4, with the field and every other row frozen), 8 of the 12 banded rows with n/e cells change band (Adsquare, Arrivalist, Foursquare, InMarket, Kochava, Precisely, Reveal Mobile, Vistar Media; marked ±). B · Location audiences and targeting (14 rows, field GQ 44.4). Band lines: Most documented 56.4, Well documented 45.4, Partly documented 36.4, Least documented below. Under four reweightings (equal thirds, depth-led, reach-led, standing-led), with Raw and the field mean recomputed, no product sits in the top band (Most documented), while positions move by up to 3 places and by 0.6 on average. Of the 14 banded products, 11 keep their band under every weighting (Azira, Blis, Cuebiq, Foursquare, Foursquare, GroundTruth, InMarket, Precisely, Reveal Mobile, Simpli.fi, Vistar Media); Adsquare, Arity, Mobilewalla cross a band line under at least one. With a prior strength of 0 (Raw, no shrinkage), 2 and 8 instead of 4, positions move by up to 1, 0 and 0 places. Deleting one counted cell at a time moves a score by up to 5 points up (Arity, location fix and visit definition) or 5 down (Arity, source transparency); 0 deletions would drop a row below admission and 6 would cost a row its band eligibility. In the missing-evidence scenarios (every n/e cell of a banded row filled with 1, then with 4, with the field and every other row frozen), 7 of the 9 banded rows with n/e cells change band (Adsquare, Arity, Cuebiq, Foursquare, Reveal Mobile, Simpli.fi, Vistar Media; marked ±). C1 · Foot-traffic and visit analytics (10 rows, field GQ 41.4). Band lines: Most documented 53.4, Well documented 42.4, Partly documented 33.4, Least documented below. Under four reweightings (equal thirds, depth-led, reach-led, standing-led), with Raw and the field mean recomputed, the top band loses at most 1 of its 1 members, while positions move by up to 3 places and by 0.4 on average. Of the 9 banded products, 7 keep their band under every weighting (Advan, Foursquare, Huq, Mapbox, Precisely, Unacast, Zartico); PassBy, Placer.ai cross a band line under at least one. With a prior strength of 0 (Raw, no shrinkage), 2 and 8 instead of 4, positions move by up to 2, 0 and 0 places. Deleting one counted cell at a time moves a score by up to 3 points up (Arity, method disclosure) or 4 down (Placer.ai, privacy and consent posture); 4 deletions would drop a row below admission and 1 would cost a row its band eligibility. In the missing-evidence scenarios (every n/e cell of a banded row filled with 1, then with 4, with the field and every other row frozen), 5 of the 6 banded rows with n/e cells change band (Foursquare, Huq, Mapbox, PassBy, Zartico; marked ±). C2 · Raw movement data (7 rows, field GQ 38.0). Band lines: Most documented 50.0, Well documented 39.0, Partly documented 30.0, Least documented below. Under four reweightings (equal thirds, depth-led, reach-led, standing-led), with Raw and the field mean recomputed, no product sits in the top band (Most documented), while positions move by up to 1 places and by 0.3 on average. Of the 7 banded products, 6 keep their band under every weighting (Collective Data Solutions, Complementics, Outlogic, Quadrant, Tamoco, Unacast); Veraset crosses a band line under at least one. With a prior strength of 0 (Raw, no shrinkage), 2 and 8 instead of 4, positions move by up to 0, 0 and 0 places. Deleting one counted cell at a time moves a score by up to 5 points up (Veraset, ground-truth validation) or 4 down (Veraset, source transparency); 0 deletions would drop a row below admission and 6 would cost a row its band eligibility. In the missing-evidence scenarios (every n/e cell of a banded row filled with 1, then with 4, with the field and every other row frozen), 3 of the 5 banded rows with n/e cells change band (Collective Data Solutions, Complementics, Tamoco; marked ±). D · Geofencing and visit-detection SDKs and APIs (4 rows, field GQ 53.8). This cohort carries no bands by design; scores and coverage are shown. Deleting one counted cell at a time moves a score by up to 4 points up (Infillion, ground-truth validation) or 3 down (Radar, location fix and visit definition); 0 deletions would drop a row below admission and 0 would cost a row its band eligibility. Missing evidence is not neutral: every deletion case is in data/gq-missing-evidence.json, and every row’s scenario scores, including a hypothetical 0-to-5 envelope reported separately and never used for the flag, are in data/gq.csv. These tests cover weights, prior strength and missing cells, not evidence grades, the scorer or the product sample. Every input is in the CSVs in the appendix, so the index can be recomputed on different weights.

Where the field is weak

Independent assurance averages 1 in every cohort, the floor for a scored cell. No product holds a current accreditation or an independent audit of its location metrics. On 24 October 2026 none of MRC's eleven lists carried a visit or location metric, and both visit data sets MRC once accredited, Foursquare's and GroundTruth's, have lost accreditation . The products that score anything here score it for self-attestation or for a pending or historical record, which the rules treat as a flag, not a score.

Ground-truth validation is the lowest-scoring dimension in cohort C2, level with the lowest in B, and third-lowest in A, above only independent assurance and coverage. In the sources screened, no product documents an independent comparison of its visit counts with door counts or transactions across many places . Where a vendor publishes an accuracy figure, it publishes no places, period or held-out design, so the cell stays at the vendor-claim anchor (chapter 4).

Documented production volume is the third weak dimension. Panel sizes are stated in incompatible units, often without a period, and bidstream reach is not a panel, so most volume cells are low or n/e (chapter 2).

The strongest cells are US availability in every cohort and data access outside cohort A: vendors document where they sell and how a buyer gets the data, in detail. That is what the caps are for. A detailed help page is vendor documentation, so it earns a 4 at most, and only two cells in the matrix score 5, both for US availability backed by an independent record.

How stable the bands are

The index was recomputed under four other weightings, three other prior strengths and every single-cell deletion.

Under the four reweightings (equal thirds; Depth-led 60/20/20; Reach-led 30/45/25; Standing-led 30/20/50), recomputing Raw and the field mean each time, the largest position change is 3 places in cohort A, 3 in B, 3 in C1 and 1 in C2; 34 of 42 banded products keep their band under all four.

Removing the shrinkage (K = 0, which reports Raw) changes 3 bands in cohort A, 1 in B, 6 in C1 and 1 in C2.

Deleting one counted cell at a time, with every other row and the field mean held fixed, changes a band in 33 of 104 cases in cohort A and 26 of 121 in B. Leaving out a low score raises a quotient: missing evidence is not neutral. The largest single-cell effect in cohort A comes from deleting Arrivalist's privacy and consent posture cell, a 1, which would raise its GQ from 40 to 44. That cell is the risk cap.

The missing-evidence scenarios test the opposite case. Each row's n/e cells are filled with 1, then 4, one row at a time with every other row and the field mean frozen. These are scenarios, not bounds. 23 products change band under one of them and are marked ± in the matrix as provisional. The rows nearest a band line were also scored a second time, blind (chapter 13); a band that the second scorer's scores would move is marked † in the matrix. Rows so marked: 1.

What the quotient is not

The GQ says how much of a product's capability is documented in public, and how well. It does not say whose visit counts are most accurate, which is the question chapter 4 could not answer from public evidence, and it does not say whose lift is causal. It rests on one initial scoring pass under published rules, a cell-by-cell verification of every counted cell by a separate AI verifier, and a blind second pass on the rows nearest a band line. No human second scorer was used.

The profiles

The paper profiles 8 companies in depth: five whose main row is in cohort A (Foursquare, InMarket, GroundTruth, Blis and Vistar Media), two in cohort C1 (Placer.ai and Unacast) and one in cohort D (Radar). Each profile has a SWOT in which every line cites its sources and is tagged as record, vendor documentation, vendor claim or inference.

Deep profiles — select a company

Each card shows the matrix scores as a bar strip. Open a company for its SWOT, what it sells, who buys it, how it earns, its verified capabilities with availability and evidence grade, performance evidence with sponsorship, limits, risks and fit. Pick a SWOT quadrant to isolate it and compare every profiled company on it. Each SWOT line is tagged record, vendor documentation, vendor claim or inference, and opportunities and threats are the author’s reading of dated facts.

SWOT

Chapter 12

What to ask before you buy

Location data is sold as ground truth, and the public record does not support that description. Visit counts are documented projections or have no stated basis, visit lift mostly rests on matched comparisons, no independent multi-site validation of projected retail visits was found in the sources screened, and three companies under FTC location orders still document precise or device-level offers. A buyer can still use location well, by asking eight questions before the money moves.

In short

Of the seven registered hypotheses, three are contradicted and four are unresolved on the public record; none is supported. Lift is not measured against a holdout by default (H3 contradicted), FTC orders did not end the sale of precise location (H5 contradicted), and no visit metric holds MRC accreditation (H6 contradicted, as of 24 October 2026). Whether panels shrank and were replaced (H1), whether visit counts match the ground (H2), what location audiences are built from (H4) and whether agents can buy by place (H7) cannot be settled from public sources. The questions below turn those findings into a test a buyer can run on any vendor.

What the evidence says

The registered hypotheses read as follows at the evidence date.

The eight questions

The decision tool below gives each question the test that fits it, what the test assumes, where it fails and what it cannot tell you. It is written for a US buyer reading vendor documentation and contracts, not for a regulator.

Measurement decision tool

Pick the question a buyer is actually asking. The panel shows the test that answers it, the assumptions that inference needs, where it fails and what it still cannot tell you.

What would change these readings

A few public documents would move the paper's conclusions more than any amount of vendor marketing:

The author's positions, tested

Three positions in the author's own writing were registered as rival hypotheses, not evidence (chapter 1). His glossary line that footfall attribution is "correlated and modeled by default" matches what H3 found for the products that document a method. His essay on DOOH measurement calls outcome studies "a model on a model"; none of the DOOH attribution products screened documents a randomised or holdout control by default , which is consistent with it, and half the US DOOH products coded name no mobility source for their audience numbers (chapter 9). His case for governing reach and frequency by place on a geographic cell grid is a proposal in a working group he co-leads; it reaches no protocol state and this paper does not test it (chapter 10).

Chapter 13

Method, limits and corrections

How the paper was built, what the checks caught and what could not be reached. It is published so a reader can check the paper rather than trust it.

In short

AI research agents worked from one brief and one set of rules. They produced 11 research workstreams (ten from the brief and one of enforcement records added after the second outside review), 1 vendor-universe sweep and 8 company profiles. A separate AI verifier, told to refute, checked each file. The research registered and logged 793 source records and put 502 claims in the ledger: 493 research claims, every one checked by a verifier or a review, and nine more. Eight are author syntheses that state the hypothesis readings and the effect of the privacy cap; the ninth is a legal finding added in the third review, New Jersey's 2026 sale ban, which a separate check read in the enacted statute but which no verifier file covers. Verifiers made 911 checks of claims, capability records, profile fields and table rows: 619 found the item supported as stated, 266 supported it with a correction and 26 contradicted it. Another AI model reviewed the evidence and the design twice before scoring, then the full paper, then the live edition, and every factual point it raised was checked at the primary source or against the paper's own data before anything changed. The corrections ledger holds 221 entries. 47 products were scored on 11 dimensions, and every counted cell was re-checked by a separate verifier. This is AI-assisted research with a documented process. It is not an external audit, not peer review and not independently validated.

What was fixed before the research

Three registers were written on 24 October 2026, before any research agent ran. The hypothesis register records 11 entries: seven hypotheses (H1 to H7) and four coded questions (Q1 to Q4). Each hypothesis states its population, comparator and observable outcome, and the rules for supported, contradicted and unresolved. Absence of accessible evidence yields unresolved, never contradicted. The product register lists every product scored, listed or historical, with the entity that sells it and the reason; it now holds 86 records, of which 29 are listed and 10 historical. The scoring rules fixed the cohorts, their applicability masks and anchors for every dimension, with numeric thresholds where a scale is measured.

Three things changed after the research and before any cell was scored, all logged and all dated. The product register was rebuilt from the vendor-universe sweep and the profiles: renamed products, new owners, products moved to the listed table and rows added (Foursquare's Visits feeds, two raw-data feeds). Broadsign's audiences were registered on condition that US availability be established before scoring; it was not, and the row, scored in error in the first live edition, was removed in the final live sweep. The scoring rules were amended once, on 24 October 2026, after the second outside review. Projection method moved out of the quotient into a separate module; cohort C split into foot-traffic analytics (C1) and raw movement data (C2); causal design was reworded as causal capability; documented production volume replaced scale, with a lower-bound rule for daily figures and no generic annualisation; the assurance ladders were made monotone, with one independence test for every cohort; and privacy now reports current controls with the author's risk cap beside them. Four hypotheses received dated clarifications (H3, H4, H5 and H7). The original rules are kept in data/hypotheses.json next to each clarification, with its rationale and its effect on the verdict. No clarification changed a verdict: H3 moved from unresolved to contradicted because better sources coded more products, and every other reading is the same under the original and the clarified wording.

How the evidence was gathered

Each workstream agent read the shared rules, the brief and the registers, and wrote one structured file: sources with their publication, event and access dates, geography, period, funding and access limits; findings with the supporting passage and locator, evidence class, confidence, limitations and counterevidence; and data tables in which every row names its source, period and claim status. The rules require every cited source to be opened; a search snippet is a lead, not support. Where a page refused an automated fetch, agents retried with a browser user agent or the built-in browser and recorded the route. 67 registered source records were access-limited: partly readable, abstract only, metadata only, or not opened at all (one is a search-result lead kept for the trail). Claims resting on them say so.

Evidence classes follow the shared rules: direct record, independent measurement, commissioned measurement, vendor assertion, synthesis, inference, forecast and illustrative scenario. A vendor's own documentation is a vendor assertion, however technical. A study whose funding is unknown is not treated as independent, and a study with platform-employed coauthors is labelled as such. The author's own work is labelled and never counts as corroboration: 4 registered source records are the author's. Every absence claim is bounded to what was searched, and the searches are logged in each file.

How it was checked

Every workstream, profile and the review-added enforcement stream went to a separate verifier that had not seen the research process and was told to refute it. Verifiers opened the cited sources themselves and returned one of four verdicts per item. A claim's final wording is its verifier's or a review's correction where one exists; contradicted claims appear only in corrected form. Every research claim was checked. Of all 502 claims in the ledger, 314 stand as stated (the syntheses among them), 174 with a qualification and 14 contradicted.

THE PIPELINE, AND WHAT EACH STAGE PRODUCED OR REMOVEDResearch11 workstreams1 universe sweep8 vendor profilesshared brief and schemaRegistered793 source records502 claims in the ledger67 access-limited4 author works, labelledVerified493 research claims checked305 as stated174 with qualification14 contradicted8 syntheses + 1 legal findingScored47 products11 dimensions each397 cells scored (77%)85 n/e · 35 n/ablind 2nd pass on 16 rowsReviewed221 corrections logged0 claims withdrawn10 scoring corrections4 outside AI review rounds9 independent source checksWhat the process is not: two agents reading one source are not two measurements; a model checking a model is not an audit; a second AIscorer on 16 rows is not a human inter-rater test.Every count on this figure is computed from the ledgers at build time (data/stats.json); the prose quotes the same values.Research cutoff 2026-10-24. Every research claim marked independently checked was checked by a verifier or a review; author syntheses arelisted separately, and contradicted claims appear only in their corrected wording.
Every stage was built to remove things, and the counts are computed, not typed. The five stages of this project with the actual outputs of each. Every research claim in the ledger was checked by a verifier or a review; the nine other entries are eight author syntheses, which state the hypothesis readings and the privacy-cap effect, and one legal finding added in the third review (New Jersey's 2026 sale ban), read in the statute by a separate check but not covered by a verifier file. Every counted score cell was re-checked by a separate verifier, and the rows nearest a band line were scored a second time, blind. Corrections include all four outside review rounds.Units: counts · Scope: this research project, as of the cutoffCounts describe process volume, not evidence quality; a claim that survived verification is supported by its source, not proven true.Data: data/stats.json

The research ran on two models. A usage limit stopped the first fan-out after nine workstreams and one verifier had finished; the remaining two workstreams and ten verifiers were rerun on a second model, and the finished files were kept.

There were two outside review rounds before scoring, both by another AI model run by the author. The first spot-checked the evidence and reviewed the design; it returned 119 items. The second, a follow-up in the same conversation, tested the proposed fixes, recounted H3 product by product and withdrew or narrowed ten of its own earlier items; it returned 37. Every factual item in both rounds was checked at its primary source by eight separate checks before any change. The reviewer was right on substance far more often than not, but several of its factual assertions were wrong when checked: among them the list of signatories to the NAI's precise-location standards, its statements that a filing, a state act, a registry and a breach notice to a regulator could not be opened, and its claim that per-agent compliance data in the AgenticAdvertising.org registry is private. Each item is logged in the corrections ledger with the check that settled it. The largest changes were to the scoring rules (above), to the H3 count, to the state-law record (Connecticut and Virginia now ban the sale of precise geolocation) and to the enforcement record, which gained the FTC's order against General Motors and OnStar, further state actions and the data-broker registries. A third round, on the full draft, returned 37 findings, and a final sweep of the published edition returned 28; each was checked at its primary source or against the paper's own data and is logged in the corrections ledger. The final sweep produced a corrected edition on 24 October 2026: it removed one product scored in error, corrected eight score cells and fixed two defects in the web page's evidence buttons.

How the products were scored

The scoring unit is a named product that serves a stated buying task, mapped to one record in the product register. There are five cohorts: visit measurement and attribution (A), location audiences and targeting (B), foot-traffic and visit analytics (C1), raw movement data (C2), and geofencing and visit-detection SDKs and APIs (D). Each has an applicability mask; causal design applies only to cohort A. n/a comes only from the mask, never product by product.

Each cell was scored from 0 to 5 against the dimension's anchors for that cohort, then capped by the evidence: vendor documentation caps a cell at 4 and vendor marketing at 3. A 0 means a source documents absence or failure; missing evidence is n/e, never 0. Seven AI scoring agents scored the rows in batches from the fixed rules and the verified evidence. A separate verifier for each batch re-opened every counted cell's sources and confirmed, corrected or rejected it: 397 counted cells, none left unverified. A product enters the matrix with at least four counted cells; none fell short. The numeric thresholds in the anchors, such as US places or monthly devices, are the author's assumptions, fixed before scoring.

The rows within two points of a band line were scored a second time, blind, by separate AI scorers given the rules and each row's cited sources and verified claims, but not the first scores, grades or rationales: sixteen rows and 166 cells in cohorts A, B, C1 and C2. The two passes matched exactly on 81.9% of the cells and within one point on 96.9% of the cells both scored (quadratic-weighted kappa 0.90). With every second-pass score substituted at once, one row changes band: Simpli.fi Addressable Geo-Fencing, from Partly to Well documented, which the matrix marks †. One material disagreement on a row whose band it would have moved was adjudicated by re-reading the rule: Kochava's causal design stays n/e, because its documentation offers a synthetic control as one of three report types rather than as the default. Both passes are published in data/second-pass.csv. The published scores started from the first pass and carry the later corrections, and the † marks that historical result only; it is not recomputed on the corrected matrix. Chapter 11 sets out the Ground Quotient, its field mean, bands and sensitivity tests. Its field mean is the mean of a cohort's Raw scores, which differs from the pooled construction of the author's Contextual and Native Quotients, so the numbers are not comparable across papers. The agreement figures compare the first scores as they stood when the second pass ran, before the third outside review and the final live sweep corrected some cells; data/second-pass.json keeps that snapshot, labelled as such, and the published matrix carries the later corrections.

Limits

The paper scores what is documented in public by the cutoff, not what products do in private. Pricing, contract terms, panel economics, adoption and market shares are almost never public, and the paper lists them as unanswered rather than estimating them. A vendor with a thin public record scores lower than its product may deserve.

Status-sensitive facts (accreditation, ownership, products on sale, laws, protocol versions and the agent registry) were read on 24 October 2026 and are dated in the text. The registered evidence freeze was 30 October 2026. The privacy dimension's three-year window moves with the cutoff, to 24 October 2023 through 24 October 2026; no qualifying event lies in the six days either side. The paper was published before that date, so, as with the attention paper in this series, the author set the cutoff to 24 October 2026, the date the status-sensitive facts were read; the hypotheses, product register and scoring rules were not changed by the move. Anything that changes after the cutoff will be logged as a dated correction, not folded in silently.

The United States is the primary market. The US availability dimension counts documented US availability only; international breadth is recorded but earns nothing.

Several documents could not be read in full: InMarket's lift-methodology glossary (behind a sign-in), Oregon's data-broker register (behind search forms), and pages that refused automated access. Claims resting on summaries of them say so. IAB's DOOH Measurement Guide, gated on IAB's site during the research, was later found as a public PDF and read in full in the final live sweep of 24 October 2026.

Interests

The author has worked at Samba (TV measurement and advertising data) since May 2025. No cohort A documentation opened names Samba as a source of TV exposure data for TV-to-visit measurement; Foursquare and Cuebiq measure linear TV without naming their viewing-data supplier (chapter 5). He co-leads the Signals & Measurement working group of AgenticAdvertising.org, which maintains AdCP, one of the protocols assessed in chapter 10; a geographic cell-grid proposal he authored is open there and earns no protocol state in this paper. No Fluff Advisory, the author's firm, operates agents listed in that organisation's registry; in the registry data read for chapter 10, none declares a DOOH specialism or has a geo storyboard result . Earlier employers include Verve Group, whose lineage includes Verve Wireless, a location-advertising company whose assets Media and Games Invest agreed to acquire in January 2020 . Verve is credited as a contributor to IAB's 2017 location-marketing playbook cited in chapter 8 and shows no location product in the sources screened. The others are Hearts & Science and Lotame, which also shows no location product in the sources screened . No vendor funded, reviewed or saw the paper before publication. Every vendor is scored under the same published rules. The author's own essays and glossary argue positions on location and DOOH measurement that this paper tests as hypotheses, not as evidence.

The claims

Every claim marked in the text is listed here with its evidence class, review outcome, confidence and supporting passages.

Claim ledger

The 406 claims marked in the text, each with its evidence class, review outcome and confidence. Click an ID to see the supporting passage, scope, derivation and limitations. Headline claims are listed first. The full research ledger of 502 claims, including those not used in the text, is in data/claim-ledger.csv.

IDClaim (final wording)Ch.Evidence classReviewConfidenceSources
Arrivalist's 2021 Lee County analysis scaled 492,897 panel trips to 9,861,477 projected US adult trips (a factor of 20.0) and 932,706 panel point-of-interest trips to 22,730,788, with only 60,609 'panel attributed arrivals' tied to media exposure, from a panel described as GPS data 'accurate to 30 feet' balanced monthly to the US Census and excluding international visitors, under-18s, trips under 50 miles or under 4 hours, one-way trips and commuters.1vendor assertionsupported as statedhigh
LCI's reported store visits are projected: the console defines Overall Projected Store Visits as 'Exposed Device Visits * ND Device / DMA Size Ratio' (a rate-up of panel visits to DMA population) and Incremental Projected Store Visits as that total multiplied by the LCI Lift; the General Population is defined as US only. The console text is undated and NinthDecimal-era.1vendor assertionsupported with qualificationmedium
LCI is marketed as live in 2026 (InMarket's LCI page, Vistar's US partner page and TikTok's 2024 partner post), with a Retail Sales Lift Attribution add-on that uses card transactions from a subset of the same exposed and control users; Vistar's page states 'Live in: USA' and 'nearly 200M+ permission-based users' from SDK-based location data.1vendor assertionsupported as statedhigh
GroundTruth's Observed Visits metric is an observed, exposed-only count with no control group: a visit is a user visiting the brand or drive-to location within 14 days of exposure, credited last-touch, verified after 7 days, and the help centre states that observed visits may be lower than actual visits because not all users are trackable.1vendor assertionsupported as statedhigh
GroundTruth's Projected Visits is a panel-based probabilistic projection: a panel of impressed devices with frequent location signals is built per campaign and its visitation applied to all impressed devices, anchored in Observed Visits including first-party WeatherBug data, shown only once a campaign reaches about 40 Observed Visits and 350,000 impressions, cumulative, with no uncertainty reported.1vendor assertionsupported as statedhigh
Blis announced the global release of Smart Holdout Groups on 9 October 2024. It is a geographic holdout design: machine learning splits an audience into statistically balanced target and control zip codes on demographics and income, allows for commuting, and inserts buffer zones where ads are neither served nor measured. Blis does not describe the assignment as randomised and does not say the design is the default for all its visit-lift reporting. Footfall lift is 'Only available in the US', and the page documents no data source, visit definition, minimum size or significance rule.1vendor assertioncontradictedhigh
Unacast's current homepage and product navigation name no attribution, lift or campaign-measurement product and no Gravy-branded product; 'measure offline marketing attribution' appears only as a use of its Location Data product, so this review found no named 'Unacast footfall attribution' product in the sources screened by the cutoff.1synthesissupported as statedmedium
Foursquare's 2026 product menu lists Attribution, Audience and Proximity for marketers, the four-tool Geospatial Intelligence Platform, Dev Console, Places API and Movement SDK for developers, Places POI Data, Open Source places and Business Listings, plus the Swarm and Superlocal apps; no product named "Visits" appears. The count of "seven location products" is the researcher's grouping, not the vendor's.1vendor assertionsupported with qualificationhigh
Of the location suppliers screened, only Quadrant documents both a first-party server-to-server collection route and explicit (global) counts (1+ billion opted-in devices, 50+ billion daily location events); Outlogic describes "first-party geolocation data through exclusive partnerships" and "No Bidstream Data" but gives no count; Complementics (a discovery, not a seed vendor) claims "over 1 billion global devices" from "multiple supply sources" without naming the route. None gives a US-only count or a period.1vendor assertioncontradictedmedium
Placer.ai (Placer Labs, Inc.) sells an Analytics Platform, Enrichment and a Data Marketplace at the cutoff, and its advertising page offers to 'measure lift or incrementally' from near real-time visitation data without naming a separate measurement product, so the register keeps one cohort C row and notes the measurement use.1vendor assertionsupported as statedmedium
Blis's 2024 strategic report says the group has 'key partnerships with telco providers across North America, the UK, and Europe' and names Smart Holdout Groups ('Smartholdout') as patent-pending measurement technology developed in the year; it reports 95% customer retention (undefined).1direct recordsupported as statedmedium
Foursquare defines a Visits-feed visit as a stop of at least two minutes snapped to a venue by likelihood, using place shapes in dense locations, filters home and work visits from the Research feed, and acknowledges 'inaccurate snaps' such as visits recorded at closed stores, without publishing an accuracy threshold or error rate; its Movement SDK FAQ instead says there is 'no standard minimum dwell time'.1vendor assertionsupported as statedhigh
GroundTruth's place base is 'Blueprints', polygons traced from satellite imagery in three layers (in-store, on-lot, retail block), counted at 4.8 million across the United States and Canada, with no US-only count; other GroundTruth pages give 'over 5 million', '5 million ... globally' and '6 million ... globally'. POIs that cannot be Blueprinted are measured with a standard 12-meter radial fence, so not every measured place is a polygon.1vendor assertionsupported with qualificationmedium
Placer.ai describes its population visit estimates as extrapolations from a device panel: its documentation calls the method "a proprietary extrapolation algorithm" and illustrates it with 74.8 thousand panel device visits to one Michigan grocery store scaled to an estimated 2.4 million visits. Under this paper's definitions those population totals are projected numbers; Placer also exposes raw, unextrapolated panel counts (panelVisits, panelVisitors), which are observed panel figures, not population estimates.1vendor assertionsupported with qualificationhigh
The September 2024 deck's two panel figures imply different denominators: 25 million at about 9% implies a base near 278 million, while Placer's help page puts the panel at about 7% of the US population; the help-page example (74.8 thousand panel visits to 2.4 million estimated) implies a scale factor of about 32, or panel visits near 3.1% of estimated visits.1inferencesupported with qualificationmedium
Placer documents a visit as a cluster of device signals matched to a geofenced POI (visits are also captured outside the geofence by undisclosed venue-detection logic), counted at most once per person per POI per day in the visits metric (breakdown endpoints' estimatedFoottraffic can count the same device more than once a day, and traffic-pin impressions count every pass), captured from 1 minute of dwell since Data Version 2.0 (31 March 2024), with a per-category default duration segment; no horizontal accuracy threshold or detection-error statistic is published.1vendor assertionsupported with qualificationhigh
Placer's published API separates raw panel counts from projections: the glossary defines panelVisits and panelVisitors as "raw, unextrapolated data from our mobile device panel" used as model inputs, alongside extrapolated visits and visitors.1vendor assertionsupported as statedhigh
Radar documents its geofence detection rules: events are generated server-side from SDK or API location updates; geofences may be circles of 10 to 10,000 metres, polygons of 4 to 2,000 coordinates or isochrones; each event carries a confidence level from 1 to 3 computed from the device-reported accuracy and the geofence geometry; optional stop detection, accuracy-based entry and exit buffers and minute-based dwell thresholds are configurable.1vendor assertionsupported as statedhigh
Unacast's machine-learning visit numbers are projections: documentation defines visits as an estimate of "unique people with a stay at a location in a day", produced by a model with "more than 150 features" whose GPS input is aggregated person counts per H3 hexagon from "between 800k-1.5M daily active users".1vendor assertionsupported as statedmedium
Unacast's documentation gives a numeric dwell rule for its ML products, multiple pings from one identifier within a 50 m radius lasting longer than 60 seconds, applied identically to every polygon, and says signals are never treated as finer than 10-20 m.1vendor assertionsupported as statedmedium
Panel-size figures published by vendors in this stream are quoted in incompatible units and mostly undated: Advan (11 June 2019) 'approximately 200 million cellphone devices, including 50% of the cellphones and trucks in the US', from 1,500 apps; InMarket's LCI glossary (undated) '1B devices or 110M uniques' over 13 months 'across 110+ locations' in the NinthDecimal Location Graph, US only; Placer (undated) 'tens of millions' of US devices, about 7% of the US population; Mobilewalla (2025 footer) 2.2 billion unique devices across 40 countries 'collected from the ad tech ecosystem, third-party data providers, app publishers, and other sources'; Cuebiq (2017) a database of 61 million anonymous users.1, 2vendor assertionsupported with qualificationhigh
Foursquare retired its City Guide app on 15 December 2024 and its web version on 28 April 2025, AdExchanger reports it bought the Superlocal app in 2025, and Infillion says it will 'evaluate the future' of Swarm and Superlocal; the consumer apps are the source of the check-ins Foursquare uses as visit ground truth and of its first-party panel.1, 2synthesissupported as statedmedium
In the filings, official statements and vendor pages this review opened, no US location vendor discloses a US panel series on one definition spanning a pre-2021 and a post-2023 figure. The dated figures use incompatible units: SafeGraph's July 2020 carrier breakdown, InMarket's 'about 100 million unique devices' a year, Gravy's daily signals from about a billion devices, and Placer's undated '30M Active Devices' and '25M+ devices' in a September 2024 deck. H1 is therefore unresolved on this evidence. The absence holds only for the sources screened, and none of these figures shows a market-wide contraction or substitution.1, 2, 3inferencesupported with qualificationmedium
Azira's measurement panel is documented as a blend of SDK integrations and bidstream location signals from the bid requests of over 100,000 apps, filtered by device activity thresholds, with places as manually drawn polygons from satellite imagery; no panel size and no proportion of SDK versus bidstream supply is stated.1, 2, 5vendor assertionsupported as statedhigh
Foursquare documents the sources behind Attribution as GPS pings from its own consumer apps and vetted third-party partners (each third-party provider calibrated against overlapping first-party users), exposure by pixel, SFTP or S3, TV exposure inferred by joining viewership data with ad run-logs, OOH exposure inferred by joining its movement data with billboard locations, and over 2 billion annual card transactions mapped to places across 450+ US chains; no proportions or precision class by source are published.1, 2, 5vendor assertionsupported as statedmedium
No opened cohort A documentation names Samba as a source of TV exposure data: Foursquare and Cuebiq document linear-TV-to-visit measurement, Cuebiq from 'impression logs from major linear broadcast partners' and Foursquare across 'TV (both linear and connected/advanced)', without naming the viewing-data supplier.1, 2, 5, 13synthesissupported as statedmedium
Apple announced a one-time location option and background-use information for iOS 13 on 3 June 2019 and shipped them in iOS 13, released 19 September 2019, as 'Allow Once' location permission, background tracking alerts and Wi-Fi and Bluetooth protections against location inference.1, 3vendor assertionsupported as statedhigh
iOS 14 (announced 22 June 2020, released 16 September 2020) let users grant apps approximate instead of precise location; Apple's WWDC20 session states apps cannot opt out, that reduced-accuracy fixes are quantised to a region with a typical radius of about five kilometres (a couple of kilometres in dense cities, ten kilometres or more in rural areas), recomputed about four times per hour, and that region monitoring requires full accuracy.1, 3vendor assertionsupported as statedhigh
iCloud Private Relay, released as a public beta with iOS 15 on 20 September 2021 for iCloud+ subscribers who enable it, replaces the client IP with a relay IP that maps to a roughly city-level area by default ('Maintain general location'; the location hint used to choose that IP is a four-character geohash of roughly 800 km2) or only to country and time zone, and covers Safari browsing, DNS queries and insecure HTTP app traffic, leaving HTTPS in-app traffic and its IP geolocation untouched.1, 3vendor assertionsupported with qualificationhigh
Android 10, publicly released on 3 September 2019, introduced the separate ACCESS_BACKGROUND_LOCATION permission and the option to allow location only while an app is in use; apps targeting Android 9 or lower had background access added automatically, and Wi-Fi and Bluetooth scanning APIs began to require fine location for apps targeting Android 10, with MAC addresses randomised by default.1, 3vendor assertionsupported as statedhigh
Android 12 (source pushed to AOSP on 4 October 2021) lets users grant only approximate location even when an app requests precise location, offers Precise and Approximate options in the permission dialog, lets users set the accuracy for any app in Settings regardless of its target SDK, and Google documents approximate location as accurate to within about 3 square kilometres.1, 3vendor assertionsupported as statedhigh
Google Play's Data safety section was pre-announced on 6 May 2021, became visible to users on 26 April 2022 and mandatory for all apps after a grace period ending 20 July 2022; declarations must cover data collected through third-party SDKs, define approximate location as an area of at least 3 square kilometres and precise location as less than 3 square kilometres, and require disclosure of location inferred from IP address.1, 3vendor assertionsupported as statedhigh
Google's Authorized Buyers Program Guidelines (last updated 15 May 2026) state that Google does not share precise location data through the program; that any precise location a buyer otherwise receives (GPS, Wi-Fi or cell-tower data) may be used only to bid on that impression and kept no longer than that purpose needs; that buyers, advertisers and their vendors may not sell any Program Data; that Program Data may not be used for ads personalisation or profile building where the user or seller has not allowed it; and that non-aggregated Program Data may be kept at most 18 months unless law requires otherwise.1, 3vendor assertionsupported with qualificationhigh
Chrome's IP Protection was designed for Incognito mode only, for third-party requests to domains on a Masked Domain List, through a two-hop proxy assigning IPs that represent coarse location including country, with a public city-level geofeed (proposed threshold of one million unique cookies per area over two weeks, about 700 US areas). Google said it would reach Chrome Stable no sooner than July 2025, listed it for retirement on 17 October 2025, archived the explainer repository on 3 November 2025, and by 14 August 2026 classed it as 'Discontinue: scheduled for phaseout' with no date; whether it reached Stable is not established. Its effect on IP geolocation for advertising is confined to Incognito third-party contexts and is being withdrawn.1, 3vendor assertionsupported with qualificationmedium
Radar’s SDK tracking presets set the stop rule and requested OS accuracy: on iOS the Responsive and Continuous presets treat a device as stopped after 140 seconds within 70 metres, Continuous requests kCLLocationAccuracyBest while Efficient and Responsive request kCLLocationAccuracyHundredMeters (the default "medium"), and on Android all three presets use 140 seconds and 70 metres.1, 3vendor assertionsupported as statedhigh
Prebid's documented coordinate coarsening happens only when the transmitPreciseGeo activity is denied, either by a publisher rule or by a configured privacy module (such as the GPP usnat control module) translating a consent string; then Prebid Server truncates lat and lon to two decimals and masks IPv4's rightmost 8 bits (PBS-Java 3.0 also removes metro, city, zip, accuracy, ipservice and ext) and Prebid.js allows only two-digit precision; the default is allow, and the Prebid Mobile Android SDK's setLocationDecimalPrecision defaults to no limit.1, 3, 8direct recordsupported with qualificationmedium
Placed's 2015 vendor analysis of three weeks of exchange bid requests (about 4 billion impressions a day across about 50 million devices), against its own first-party panel (about one in 450 US adults), found that 27% of daily bid requests carried any location; the column gives the share of located requests precise enough to identify a business inconsistently (it says both that 12% were too imprecise and that only 12% could place a device at a specific address; its filtered count of 30 million reliable locations a day fits the latter); 91% of observed business visits generated no ad request, less than 1% generated an ad-request location within 100 m, and about 73% of bid requests occurred in transit.1, 4vendor assertionsupported with qualificationmedium
Placer.ai's help-centre documentation (undated, read 2026-10-24) describes a panel of tens of millions of US devices from hundreds of partner apps, about 7% of the US population (55% iOS, 45% Android); its September 2024 Salt Lake deck gives two different figures, 30 million active devices from 500 SDK apps on one slide and 25 million-plus devices, about 9% of the population, on another, neither defined by period; its visit numbers are projections from a proprietary extrapolation algorithm (an example scales 74.8 thousand panel visits to 2.4 million), and the opened accuracy pages name validation sources (first-party data, transactions, store revenues, counters, MLB attendance) without publishing any result or error statistic.1, 4vendor assertionsupported with qualificationhigh
GroundTruth documents its places as Blueprints, polygons traced from satellite and street-view imagery in three layers (in-store, on-lot, retail block), 'over 5 million' in number, verified against 'trusted location sources' it does not name; it asserts without a cited study that radial geofences measure visits 'with up to 75% inaccuracy'.1, 4, 5vendor assertionsupported as statedmedium
Thinknear's vendor-run Location Score Index, the earliest public series on bidstream location accuracy found in the sources screened, reported in 2014 that 67% of mobile ad inventory carried latitude and longitude and that 34% of location-bearing impressions were within 100 metres of the user's location (bands as published sum to 93%; the base is not stated); the Q1 2015 edition (more than one billion impressions sampled; 62% of ad requests carried location) put 37% within 100 m, 9% at 100-1,000 m, 26% at 1-10 km, 18% at 10-100 km and 10% beyond 100 km, with an industry score of 50 against 51 in Q4 2014.1, 4, 6vendor assertionsupported with qualificationmedium
Google's Authorized Buyers documentation (last updated 17 September 2026) states that bid-request location is obtained only from IP geolocation, never from GPS or other sources, that Google limits lat and lon precision to 0.01 degrees, that it provides only a coarse geolocation shared by a sufficiently large number of users, and that for city-level location 'accuracy' is the radius of a circle with the same area as the city.1, 4, 6, 8vendor assertionsupported as statedmedium
The guidelines state that two decimal places of latitude and longitude place a device within about one kilometre, four within about ten metres and five within about one metre, warn that decimal count must not be equated with accuracy, encourage first-party 'ground truth' validation, and set a general expectation of less than 5% error on primary reported characteristics with disclosure above that.1, 4, 8direct recordsupported as statedhigh
Hierarchical geographic cells are not part of AdCP at the cutoff versions: issue #5969 (geo_cells / geo_cells_exclude with an h3, s2, geohash or custom cell-system enum), opened by the paper's author on 21 July 2026, is OPEN with milestone 3.4.0 and labels rfc and needs-wg-review, its two companions (#6013 conversion, #6014 cell-grain delivery reporting) are also OPEN on milestone 3.4.0, no geo_cells pull request was found, and neither v3.2.6 nor v3.3.0-beta.0 contains a geo_cells field; under the brief's rules the proposal earns no protocol state.1, 4, 8, 9, 10direct recordsupported as statedhigh
Foursquare Attribution's documented default control is a modelled 'expected visit rate' built from '10+ core attributes' (a 'modeled twin cohort' per its 30 September 2024 blog), which codes as matched or synthetic control, not a randomised or held-out group, as of the documentation's 12 February 2026 update; the product page calls the output 'incremental lift', while the blog and the metrics page call it 'behavioral lift', and the Attribution FAQ in the same documentation set gives a worked example with a 14-day conversion window plus 7 days of reconciliation.1, 5vendor assertionsupported with qualificationhigh
Cuebiq's current marketing (undated page, 2026 footer) describes its incrementality method as 'causal machine learning to simulate a randomized control trial' with 'behaviorally matched control groups' matched on location patterns, device type, prior visitation behaviour and media exposure history, which under this paper's codes is a matched or synthetic control, not a randomised design, however it is named.1, 5vendor assertionsupported with qualificationhigh
GroundTruth's Observed Visits metric (help article dated 31 March 2025, whose FAQ describes a verification-period rollout 'as of September 17 2024') counts a user visiting the brand or 'drive-to' location within 14 days of exposure, credited by last-touch, with a 7-day verification lag before 'verified visits' appear; the help centre states that observed visits 'may be lower than actual visits', its Blueprints article (25 February 2026) documents the visit place as a satellite-traced polygon with in-store, on-lot and retail-block layers across '4.8M Blueprints' and calls the metric a 'raw' observed count; the metric carries no control group, and the Cost Per Visit model bills on these verified visits (Toyota case, 15 November 2024: 'over 1,200 visits' in a month across DE, PA and NJ).1, 5vendor assertionsupported with qualificationhigh
Attribution windows disclosed by vendors range from 4 days (Vistar/Foursquare DOOH, Target) through 7 days for QSR and 14-30 days for auto (Azira), 14 days plus a 7-day verification lag (GroundTruth), a 14-day example conversion window plus 7 days of reconciliation (Foursquare's Attribution FAQ), two weeks after versus two weeks before exposure (InMarket) to a 30-day look-back (Simpli.fi); Cuebiq's 2017 sports-retailer case shows 37% of exposed visitors arriving within 2.6 days and 14% between 10.5 and 13 days, so window choice alone moves a visit count materially.1, 5synthesissupported with qualificationhigh
Foursquare's attribution visit volumes are projected, not observed: the 2022 method post documents census weighting of the panel to the national population and projection of visit volumes on the basis of match rates by platform and partner.1, 5vendor assertionsupported as statedmedium
Azira's total visits are projected from observed visits by a Poisson detection model: each observed device represents 1/P(Detection) devices, extrapolation runs only when observed visits exceed about 1,000, Bayesian priors apply and the multiplier is capped at 20x; the product page lists mobile/desktop, audio, video, CTV and DOOH as channels, a conversion pixel and API pushes to DSPs as routes.1, 5vendor assertionsupported as statedhigh
Adsquare's Attribution Dashboard, launched 30 June 2025 inside OnePlatform as part of its 'legacy Attribution solution', documents a simulated control ('Control Condition' or 'Synthetic Control Condition') adjusted for weather, seasonality, local footfall trends and public holidays in place of control groups, consented SDK movement data, visit matching by lat/long and 2D POI polygons with 'no fuzzy radius logic', and 'net visitation uplift' as the headline metric; the US is not named as an attribution market and no minimum sample or significance rule is stated.1, 5vendor assertionsupported as statedhigh
Arrivalist's MediaInsights documents a matched control of cardholders not exposed to the campaign, card transaction data from Visa, Mastercard and Discover, and exposure across digital display, CTV, social, native and DOOH in every US media market; the partner page says arrivals are verified with 'no panels, no proxies' while the TripInsights page says 'our panel holds steady', and the live pages render their headline statistics as zero placeholders.1, 5vendor assertionsupported as statedmedium
GroundTruth's help centre (2021, not since updated) says CTV-to-store visits rely on a partnership with TapAd converting IP addresses to mobile ad IDs, so CTV visit attribution adds an IP-to-device match before the location step.1, 5vendor assertionsupported as statedmedium
InMarket’s 29 July 2026 description of Visit Lift says its counterfactual is a synthetic control, a statistical model of expected visitation built from historical patterns, and stops short of the mechanics; the vendor calls this causal, but under this paper’s rules a synthetic or modelled control is coded matched_or_synthetic, not randomised.1, 5vendor assertionsupported as statedhigh
The 2017 Location-Based Advertising Measurement Guidelines contain no provision on visit lift, incrementality or control groups (no occurrence of 'lift', 'control group' or 'incremental' in the text); MRC addresses foot traffic as an outcome and incrementality (including RCTs) in its separate Outcomes and Data Quality Standards (September 2022), which require foot-traffic outcomes to follow the 2017 location guidelines.1, 5, 8direct recordsupported with qualificationhigh
Of fourteen cohort A seed products, nine document a general visit-measurement method that governs their ordinary reporting, and eight of them claim lift. Of the eight, six use a matched or synthetic control (Foursquare, InMarket, Reveal, Adsquare, Cuebiq, Arrivalist) and two a randomised or holdout control (Azira's randomised PSA control, documented as the default; Blis Smart Holdout Groups, a machine-balanced geographic holdout whose assignment is not documented as random). The ninth reports exposed-only visits with no control and no lift claim (GroundTruth Observed and Projected Visits). Five document no default (Vistar, a partner wrapper; Kochava, where MediaLift synthetic control is one selectable option; Precisely; Unacast; Lifesight, whose location module is not on its current site). Seven of the nine documented visit-measurement methods are non-holdout.1, 5, 8, 9synthesissupported with qualificationmedium
Adsquare sells two targeting products in 2026 under names that replace the register's 'Audience Management Platform': ID-Precise Audiences (MAID-based segments from 'verified visits, offline purchases', with home and work inferred at postal-code level and look-back windows of 14, 30, 90 and up to 180 days) and Geo-Contextual Audiences (no device ID; a 'postcode, H3 cell, polygon' scored by the hour from household, census, point-of-sale and weather data), both activated in The Trade Desk, DV360, Adform and 'all other connected partners'; the location signals are 'sourced from vetted partners with explicit, auditable consent' with no route named.1, 6vendor assertionsupported as statedmedium
Simpli.fi's Addressable Geo-Fencing (live, US, 2026) converts up to one million street addresses per campaign into parcel-level geofences drawn from plat lines in property-tax and public land-survey records, targets 'any device seen within those plat lines' with mobile, video and CTV ads for up to 30 days via a cross-device graph with 'variable recency settings', and measures with Conversion Zones and 'Geo Conversion Lift'; it says it uses 'GPS data paired with plat lines' and rejects IP because of truncation, but does not say where the GPS fixes come from.1, 6vendor assertionsupported as statedmedium
Vistar Media's own guide documents DOOH audience targeting from 'aggregated and anonymized location data' plus third-party partners (Epsilon, Eyeota, InMarket, Affinity Answers). T-Mobile's app-based segments have been available through Vistar since 6 May 2025; on 5 October 2026 Vistar announced enhanced, location-enriched T-Mobile segments available only through the Vistar DSP. Per AdExchanger, T-Mobile's data combines mobile location data with app installation and usage inferred from network requests, with OOH-proximity exposure only for users who opted into location tracking; T-Mobile's Jess Zhu attributes the exclusivity to tightening regulation of location data and mobile device IDs.1, 6synthesissupported with qualificationmedium
H4 remains unresolved, and the cohort B source counts must be rebuilt. Foursquare (SDK/API partners plus data suppliers, brokers and ad networks) and InMarket (own app, partner SDK network and 'trusted & certified third-party sources') disclose multiple sources without naming a primary one, so code both 'multiple disclosed sources; primary source not established'. Azira (SDK, bid-stream and transactions) and GroundTruth disclose blends without proportions. No product documents a primary source, so neither the earlier 0/0 count nor the verifier's two SDK votes stands.1, 6synthesiscontradictedmedium
No cohort B documentation opened states a fix-accuracy threshold with a method or a detection error statistic. The only numeric precision figure found is Azira Audiences' unexplained "within 3 meters of precision". Elsewhere the precision class is asserted by geometry: GroundTruth On-Premise "strictly inside the physical building walls", Simpli.fi parcel plat lines, Adsquare "precise polygons or custom radii" alongside postcode and H3-cell units, Foursquare "snap-to-place" visits, and coarse ZIP, state or DMA options at GroundTruth. GroundTruth's "Blueprint-level precision" is a measurement-product claim, not a targeting precision class.1, 6synthesissupported with qualificationmedium
GroundTruth documents the tests it applies to each location signal and visit (GPS-sourced, stale, outlier, fraudulent device, inside a Blueprint, during open-store hours, typical employee behaviour, drive-by speed; centroids and carrier-IP locations rejected) but publishes no numeric threshold for dwell, horizontal accuracy or speed.1, 6vendor assertionsupported as statedhigh
InMarket documents its current location sources as its own first-party app, a ‘Comscore-verified partner SDK app network’ and unnamed ‘trusted & certified third-party sources’, with precise coordinates collected via apps operated by InMarket and Third Party Partners; it gives no proportions by source, and its own apps at 30 June 2026 are CheckPoints, ListEase, Key Ring, Subscription Stopper and Out of Milk.1, 6vendor assertionsupported as statedhigh
GeoLink, InMarket’s self-serve activation platform from the Thinknear acquisition, combines first-party location data with a machine-learning ‘Location Score’ that evaluates the location carried in ad requests before bidding, and sells block-level geo-audiences, real-time point-of-interest geofences and retargeting on past store visits; so InMarket’s targeting uses bidstream-derived location as a filtered input alongside SDK data.1, 6vendor assertionsupported as statedmedium
The FTC's Mobilewalla Decision and Order (Docket C-4811) was issued 13 January 2025 and its finalisation announced 14 January 2025 on a 4-1 vote; it bars Mobilewalla from collecting or retaining information it accesses in online advertising auctions for any purpose other than participating in them, and from selling, sharing, disclosing or otherwise using Sensitive Location Data for the sensitive locations it must identify, except to convert that data into non-sensitive or non-location data. It is the only regulator record in this stream that documents bidstream as a cohort B location source; Azira's own data page also names bid-stream among its sources.1, 6, 7direct recordsupported with qualificationhigh
Across the US rules read, statutes define precise geolocation by a radius of 1,750 feet (Maryland, Oregon's sale ban, Washington's precise location information, Connecticut, Virginia) or 1,850 feet (California, Civil Code 1798.140(w)); the five FTC orders instead exclude coarse data, giving as an example zip code or census block location with a radius of at least 1,850 feet; Washington's geofence definition uses 2,000 feet.1, 6, 7direct recordsupported with qualificationhigh
OpenRTB 2.6's Geo object carries lat and lon as floats, a 'type' for the source of location (AdCOM Location Types: 1 GPS/Location Services, 2 IP Address, 3 User Provided), 'accuracy' in metres as reported by the device (recommended for type 1), 'lastfix' in seconds since the fix, and 'ipservice' (AdCOM IP Location Services, beginning ip2location, Neustar (Quova), MaxMind), and it states that lat/lon should be passed only if they conform to the accuracy of the stated type and that a postal-code centroid should not be passed; the 2.6 text contains no rule on truncating or rounding coordinates.1, 6, 8direct recordsupported as statedhigh
The X-Mode/Outlogic order (C-4802) treats data revealing only coarse location (its example: zip code or census block with a radius of at least 1,850 feet) as not Location Data, lists seven categories of Sensitive Locations, requires deletion of Historic Location Data within 60 days unless consent is obtained or the data is deidentified or rendered non-sensitive within 90 days, deletion of Data Products within 90 days, a Supplier Assessment Program and a consumer deletion-request mechanism, bars collecting Location Data from devices that opted out of tracking without a consent record, and, from 90 days after the effective date, bars collecting, using or disclosing any Location Data without a record of the consumer's prior consent.1, 7direct recordsupported with qualificationhigh
Washington's My Health My Data Act (Chapter 191, Laws of 2023, ESHB 1155) made it unlawful from 23 July 2023 to implement a geofence (a virtual boundary of 2,000 feet or less from the perimeter) around an entity providing in-person health care services to identify or track consumers, collect consumer health data or send them messages; its consumer-health-data duties apply from 31 March 2024 (30 June 2024 for small businesses), define precise location information by a 1,750-foot radius and treat precise location that could indicate an attempt to obtain health services as consumer health data.1, 7direct recordsupported as statedhigh
California defines 'precise geolocation' in Civil Code 1798.140(w) as data used to locate a consumer within an area equal to or less than a circle with a radius of 1,850 feet and lists it as sensitive personal information in 1798.140(ae); its Delete Act registry requires data brokers to register each January 1-31 and to begin processing deletion requests through the DROP mechanism on 1 August 2026.1, 7direct recordsupported as statedmedium
Maryland's Online Data Privacy Act (2024 ch. 455, SB 541, approved 9 May 2024, effective 1 October 2025) bars a controller from selling sensitive data, which includes precise geolocation defined by a 1,750-foot radius, with no consent exception, subject to the act's coverage thresholds and exemptions; it also bars any person from using a geofence within 1,750 feet of a mental health or reproductive or sexual health facility to identify, track, collect data from or notify consumers about their consumer health data. Section 2 of the chapter makes section 14-4612 as enacted apply only prospectively, not to processing before 1 April 2026; that clause does not postpone the act or the sale ban.1, 7, 12direct recordsupported with qualificationhigh
Oregon's HB 2008 (Oregon Laws 2025, chapter 251; passed the House 17 April 2025, the Senate 21 May 2025, repassed 27 May 2025, approved by the Governor 3 June 2025, effective 1 January 2026) amends ORS 646A.578 so a controller may not sell personal data that accurately identifies within a radius of 1,750 feet a consumer's or linked device's present or past location, or personal data of a consumer known or wilfully disregarded to be under 16.1, 7, 12direct recordsupported as statedhigh
Connecticut bans the sale of precise geolocation data: Public Act 26-64 (SB 4, approved 27 May 2026, effective 1 October 2026) provides that no controller and no third party shall sell any consumer's precise geolocation data (1,750-foot radius; content of communications and utility metering data excepted), replacing the consent-to-sell rule PA 25-113 had put in place from 1 July 2026. Data brokers selling or licensing brokered personal data in Connecticut must be registered from 1 January 2027.1, 7, 12direct recordcontradictedhigh
The guidelines separate accuracy (closeness to true location) from precision (number of decimal places) and require both as disclosures; define geo-fencing as either point-radius or boundary (polygon); define physical visitation as the intersection of device location and place with speed or longitudinal analysis to exclude drive-bys; and state that geo-fencing generally cannot represent multi-storey structures.1, 8direct recordsupported as statedhigh
The 2017 guidelines list GPS, Wi-Fi, IP, cell trilateration, registration, beacon, panel and ad/bid-request location as sources and characterise their relative accuracy (beacons within metres; GPS 10-100 m; Wi-Fi 30-100 m; cell at zip or neighbourhood level; mobile IP generally not accurate or precise); they say bid-request location should pass validation edit rules, that zip, DMA or state centroids should not represent precise location unless reported at market level, and that vendors using ad or bid-request data should disclose the number of active devices observed daily, weekly or monthly and the number of measured visits.1, 8direct recordsupported with qualificationhigh
Digital Envoy's Digital Element NetAcuity IP-geolocation service, the only other MRC-accredited location-determination service found in the communications screened, was formally moved from hiatus to non-accredited in January 2020 after Digital Envoy chose not to proceed with a new audit; no IP-geolocation service is on MRC's lists at 24 October 2026.1, 8direct recordsupported with qualificationhigh
Across the documents opened, two decimal places is the recurring boundary between precise and coarse coordinates, but the bodies attach different distances to it: NAI treats two or fewer decimals, or any area at least a 500 m-radius circle, as imprecise; MRC's 2017 guidelines and IAB's 2016 guide say two decimals is about one kilometre; Google caps at 0.01 degrees; Prebid truncates to two decimals when the activity is denied. NAI's 500 m radius is close to, but about 6% smaller than, the 1,750-foot (533 m) radius used in several state laws (per workstream H).1, 8synthesissupported with qualificationmedium
NAI's 2020 Code defines Precise Location Information as data derived through technology able to determine with reasonable specificity a device's actual physical location (for example GPS-level coordinates or RF triangulation) and requires opt-in consent for its use in tailored advertising or ad delivery and reporting; NAI's February 2020 guidance (superseding 2015) describes three methods of rendering location imprecise: two or fewer decimal places, an area at least as large as a 500 m-radius circle, or a non-unique general descriptor of the place.1, 8direct recordsupported with qualificationhigh
Vistar Media's two US DOOH cases measured by Foursquare report, for Target (flight 2021-08-15 to 2022-01-29; 22 states; $1.2M+ budget), 72 million+ impressions, 533,000 store visits inside a four-day look-back and a 6.51% lift in visitation 'compared with non-exposed consumers', and for Jack in the Box (twelve markets; undated), 49M+ impressions, 1.3M+ store visits and an 8.8% lift; exposure is inferred from ad-log timestamps, device location, venue type and screen location, and the OAAA document says Vistar's studies 'compare control versus exposed groups' without describing the control.1, 9vendor assertionsupported as statedmedium
Adsquare infers DOOH exposure by proximity of mobile advertising IDs to screen coordinates while an ad is live, then cross-references exposed IDs against later in-store visits in its 2D polygons; no exposure radius, lookback window or threshold is stated in the interview.1, 9vendor assertionsupported as statedhigh
At AdCP v3.2.6 (latest stable release, 23 October 2026) the media-buy targeting overlay represents administrative geography (geo_countries, geo_regions as ISO 3166-2, geo_metros with systems nielsen_dma, uk_itl1, uk_itl2, eurostat_nuts2 or custom, geo_postal_areas) with matching exclusion fields, point-based geo_proximity (radius, travel-time isochrone or buyer-supplied GeoJSON polygon), store_catchments from a synced store catalog, and identifier-based geo_places (first published in the pre-release 3.2.0-beta.0 on 17 August 2026, first stable in 3.2.1 on 1 October 2026); this is schema representation and nothing more.1, 10direct recordsupported with qualificationhigh
T-Mobile US agreed on 20 December 2024 to acquire 100% of Vistar Media Inc. and completed the acquisition on 3 February 2025, transferring cash of US$621 million, per its FY2025 Form 10-K. Note 2 of that filing puts the fair value of consideration transferred at US$617 million, because part of the payment settled preexisting relationships with Vistar.2direct recordsupported with qualificationhigh
Lamar Advertising received US$115.1 million in cash at the 3 February 2025 closing for its 20% equity interest in Vistar Media, with up to a further US$15.1 million held in escrow, per its 8-K earnings exhibit of 20 February 2025.2direct recordsupported as statedhigh
Near Intelligence, Inc. completed its business combination with the SPAC KludeIn I Acquisition Corp on 23 March 2023 (EDGAR records the former name through 2023-03-23) and began trading on the Nasdaq Global Market under the ticker NIR on 24 March 2023.2direct recordsupported with qualificationhigh
Near Intelligence reported revenue of US$33,217,126 for the six months ended 30 June 2023 (US$28,897,952 a year earlier, a 14.9% increase) and a net loss of US$36,899,928, and its 10-Q stated that its liquidity condition raised substantial doubt about its ability to continue as a going concern.2direct recordsupported as statedhigh
Near Intelligence, Inc. and certain of its subsidiaries filed Chapter 11 petitions on 8 December 2023 in the US Bankruptcy Court for the District of Delaware, with up to US$16,000,000 of DIP financing from lenders agented by Blue Torch Finance LLC and a stalking-horse credit bid of not less than US$50,000,000 from BTC Near Holdco LLC; Nasdaq notified the company that trading would be suspended at the opening of business on 19 December 2023; the event is an insolvency.2direct recordsupported with qualificationhigh
... a Form 15-12G deregistration, signed 27 March 2024, was filed with the SEC on 28 March 2024 (EDGAR filing date; accepted the evening of 27 March).2direct recordsupported with qualificationhigh
Azira operates as Azira LLC with headquarters in Pasadena and offices in Paris, Bangalore and Sydney, and claims a data infrastructure of 13 trillion location signals, 43 million points of interest and solutions in 44 countries; this review infers, but did not open a settling source showing, that Azira is the business sold out of Near Intelligence's Chapter 11 to Blue Torch's BTC Near Holdco LLC.2inferencesupported as statedlow
At listing in March 2023 Near described itself as processing data from an estimated 1.6 billion unique user IDs and 70 million points of interest in more than 44 countries; the definition is 'unique user IDs', not devices or a monthly panel, and no geography split was given.2vendor assertionsupported as statedmedium
Foursquare announced its acquisition of Placed from Snap on 30 May 2019 with terms undisclosed; Snap's 10-Q records that it divested its membership interest in Placed, LLC to Foursquare Labs, Inc. in June 2019 for total cash of US$77.8 million, of which US$66.9 million was purchase consideration, recognising a US$39.9 million gain; the event is an acquisition (completed June 2019).2direct recordsupported as statedhigh
Foursquare and Factual announced a merger on 6 April 2020 (terms undisclosed, Foursquare name retained, David Shim remaining CEO), claiming combined datasets of more than 500 million devices worldwide, a panel of 25 million opted-in users, more than 105 million points of interest and more than US$150 million of revenue; the event is a merger, announced; no opened source gives the completion date.2vendor assertionsupported as statedmedium
Foursquare retired its City Guide consumer app on 15 December 2024 at 11:59 PM ET and the web version on 28 April 2025, stating it did so to focus on Swarm; this is a product retirement. The page does not say whether City Guide contributed location data to Foursquare's panel.2vendor assertionsupported with qualificationhigh
Infillion announced on 18 September 2026 (ACCESS Newswire) that it is acquiring Foursquare, terms undisclosed; contemporaneous reports describe the transaction as pending close, and the release claims Foursquare covers more than 100 million points of interest, 16 billion human-verified check-ins and 'aggregated coverage of 250 million U.S. devices' (AdExchanger paraphrases this as data 'drawn from 250 million US devices').2vendor assertionsupported with qualificationmedium
xAd rebranded as GroundTruth on 15 June 2017 (a rebrand, not an exit), claiming at the time 95 million active monthly users and 17 million active daily users across 100 million places, with no geography attached to the user figures.2vendor assertionsupported as statedhigh
Telenav completed the sale of its advertising business (Thinknear) to inMarket Media, LLC on 16 August 2019 in exchange for inMarket LLC units representing a 14.5% member interest valued at US$15.6 million, recording a US$4.9 million loss on sale and presenting the business as discontinued operations; Thinknear's status is therefore 'sold to inMarket', an acquisition by asset sale.2direct recordsupported as statedhigh
InMarket acquired the assets of NinthDecimal in a transaction reported on 10 September 2020 for an undisclosed sum, stating that it then had 200 employees, US$100 million of annual revenue and 'over 100M SDK-based users', and continued NinthDecimal's LCI, which InMarket's page expands as 'Location Conversion Index'; the event is an acquisition (asset purchase, 2020, not 2019 as the register seeds).2vendor assertionsupported as statedmedium
The FTC's January 2024 complaint describes InMarket Media, LLC as a Delaware LLC based in Austin, Texas, whose SDK was incorporated into more than 300 third-party apps downloaded onto over 390 million unique devices since 2017 (its own apps onto over 30 million), and alleges that from 2016 'about 100 million unique devices sent Respondent location data each year'.2direct recordsupported as statedhigh
Digital Envoy acquired X-Mode Social in a transaction reported on 5 August 2021 with terms undisclosed, rebranding it Outlogic and naming X-Mode's CEO Josh Anton as Digital Envoy's chief strategy officer; the acquirer said it shut off US location data flows to defense contractors; the event is an acquisition followed by a rebrand.2vendor assertionsupported as statedmedium
The FTC's case record names Outlogic, LLC as the successor to X-Mode Social, Inc.; the proposed order is dated 9 January 2024 and the final order 11 April 2024 (terms are workstream H's).2direct recordsupported as statedhigh
Spectus, Cuebiq's former Workbench clean room, was publicised as a stand-alone data clean room in a release dated 23 February 2022, and an undated Cuebiq page describes it as a separate business unit to which former Workbench clients are being migrated, while Cuebiq 'will remain as an ad tech business solely focused on Media Measurement and Audience Targeting'; the event is a restructuring (split), not an insolvency or exit.2vendor assertionsupported with qualificationmedium
Unacast announced on 29 November 2023 that it and Gravy Analytics were merging; no opened source states the structure, surviving entity or completion date, so the event is recorded as a merger, announced.2vendor assertionsupported as statedmedium
Precisely, backed by Clearlake and TA Associates, signed a definitive agreement to acquire New York-based PlaceIQ on 19 January 2022 (terms undisclosed) and states that the acquisition completed in February 2022; the event is an acquisition (completed).2vendor assertionsupported as statedhigh
Advan Research announced on 3 November 2022 that it had acquired SafeGraph's Patterns (Weekly, Monthly and Neighborhood Patterns) business, and SafeGraph's documentation marks Patterns a legacy product unavailable 'at the start of 2023'; for SafeGraph this is a product retirement and for Advan an acquisition.2vendor assertionsupported as statedhigh
SafeGraph's documentation disclosed, as of its July 2020 release, a US opted-in device panel broken down by carrier whose six listed counts sum to 28,914,920 devices (Verizon 10,303,871; AT&T 7,267,146; T-Mobile 7,129,894; Sprint 3,685,988; Altice 323,221; C-Spire 204,800); the definition is 'a panel of opted-in mobile devices' at one release, not a monthly series.2vendor assertionsupported as statedmedium
Foursquare documented two data-marketplace routes for its datasets: AWS Data Exchange from 13 November 2019 (Places plus 'foot traffic-powered datasets', delivered to S3 and billed to the buyer's AWS account) and Snowflake Data Marketplace from 8 February 2021 (Places and Visits via secure data sharing); a live AWS Marketplace listing also carries a SafeGraph Places free sample delivered through AWS Data Exchange.2vendor assertionsupported as statedmedium
Foursquare's public device figures move from 'more than 100 million monthly devices' (US, May 2019) and 'the movements of 100 million U.S. devices' (November 2019) to 'more than 500 million devices worldwide' plus 'a panel of 25 million opted-in users' (April 2020, post-Factual) to 'aggregated coverage of 250 million U.S. devices' (September 2026); the four figures use four definitions and do not form a series on a constant definition.2synthesissupported as statedmedium
Infillion, the pending acquirer of Foursquare, already owns the location SDK company Gimbal and acquired Catalina (closed February 2026) and MediaMath (bought out of bankruptcy in 2023 for US$22 million), so Gimbal (cohort D) and Foursquare (cohorts A to D) would sit under one owner if the Foursquare deal closes.2synthesissupported as statedmedium
If the Foursquare deal closes, Infillion will own two location product families that the register treats separately: the Gimbal Location Platform (an SDK with radial or polygon geofences 'down to 50 meters', iBeacon micro-location, visit-based measurement and visit-based audience segmentation for app owners' first-party data; gimbal.com now redirects to infillion.com) and Foursquare's attribution, audience, places and SDK products, alongside MediaMath, TrueX, Drawbridge and Catalina.2synthesissupported as statedmedium
Bluedot, the seed developer-geofencing vendor, is no longer independent: Rezolve AI plc agreed on 4 February 2025 to buy the share capital of Bluedot Industries, Inc. (Delaware) and Bluedot Industries Pty. Ltd. and closed on 20 February 2025 for 819,737 ordinary shares, a related-party deal (the seller DBLP is wholly owned by a Rezolve director) accounted for as a common-control transfer; bluedot.io now redirects to rezolve.com.2direct recordsupported as statedhigh
Skyhook, an early Wi-Fi positioning supplier relevant to the developer cohort, was acquired by Qualcomm Technologies in a transaction Qualcomm confirmed by email in May 2022 without a formal announcement, and skyhook.com redirects to Qualcomm's Terrestrial Positioning Service at the cutoff; it is classified as historical (acquisition), outside the advertising cohorts.2synthesissupported as statedmedium
Outlogic (formerly X-Mode, under an FTC order banning sale of sensitive location data) still licenses an 'Observation Panel', attribution data and audiences at the cutoff through Snowflake, daily and hourly AWS S3 exports, a REST API, Eyeota and Adsquare, and its homepage notice under Texas law says it 'may receive and sell the precise latitude and longitude coordinates of your mobile device'.2vendor assertionsupported as statedhigh
Advan Research sells five named products at the cutoff (FIT, REI, REVEAL, SPENDVIEW and Patterns+) and claims '100+ daily observations from 45M U.S. & 65M global devices', geolocation 'from GPS, Wi-Fi, and beacon signals' with 'No ad exchanges', and '10M+ hand drawn geofences'; this is one of the few dated-at-access US device counts with a stated source type.2vendor assertionsupported as statedmedium
At least three location-data sellers screened (Unacast, Veraset and Complementics) sell identity linkage of mobile advertising IDs to hashed emails and/or IPs alongside location data; a fourth, Quadrant, sells hashed-email datasets for identity resolution, with no stated link to its location records.2synthesissupported with qualificationmedium
Cuebiq Group, LLC (1460 Broadway, New York) markets Footfall Measurement, Cuebiq Audiences, Footfall Benchmarking and a Data Platform at the cutoff, and spectus.ai redirected to cuebiq.com on 24 October 2026; whether Spectus (split out in February 2022 per workstream D) has been folded back into Cuebiq is an inference from the redirect, not an established corporate event.2inferencesupported with qualificationlow
Lifesight has pivoted out of the location cohorts: its 2026 homepage sells 'causal MMM, incrementality testing and incrementality-adjusted attribution' with AI agents and names no footfall, store-visit or location-data product, so its seed row moves to listed.2inferencesupported as statedmedium
Three names could not be confirmed active from an opened source by the cutoff: onemata.com returned a Wix "ConnectYourDomain Error" (404), datastreamgroup.com served only a parking redirect, and plotprojects.com returned a Cloudflare 403 to two routes; their status is unconfirmed, not closed. Precisely's PlaceIQ Audiences URL, refused to curl, is readable through a second fetch route and shows the product live as "Precisely Audiences".2inferencesupported with qualificationmedium
Data-marketplace discovery on Datarade's foot-traffic category (headed '40 Foot Traffic Data Providers' on 24 October 2026) adds location sellers not in the seed list, among them Irys, Intuizi ('400mm+ Devices and growing'), DRAKO, GapMaps and BIGDBM, alongside seed vendors Quadrant and Unacast; the providers' figures are self-reported.2vendor assertionsupported as statedmedium
T-Mobile US entered a share purchase agreement for 100% of Blis Holdco Limited on 18 February 2025 and completed the acquisition on 3 March 2025, transferring cash of US$180 million, of which US$174 million was the fair value of consideration transferred and the remainder settled preexisting relationships with Blis; provisionally assigned fair values were total assets acquired of US$264 million (including goodwill) and liabilities assumed of US$90 million, with provisional goodwill of US$105 million assigned to the Wireless segment; Blis's results to 31 December 2025 were 'not material'.2direct recordsupported with qualificationhigh
Companies House records T-Mobile US, Inc. as the person with significant control of Blis Holdco Limited (75% or more of shares and votes) from 3 March 2025; LDC GP LLP held more than 50% but less than 75% of shares from 16 June 2022 to 3 March 2025; the holding company was incorporated on 14 March 2022 as Project Balloon Bidco Limited and renamed on 8 January 2024; Blis Global Ltd (incorporated 18 December 2007, Blis Media Limited 2012-2019) is controlled by Blis Group Limited.2direct recordsupported as statedhigh
Blis's About page, last modified 8 October 2026, is titled 'Independent DSP Established in 2004' and does not mention T-Mobile, while its homepage title reads 'Blis, part of T-Ads | Omnichannel DSP'.2vendor assertionsupported as statedhigh
Infillion announced on 18 September 2026 that it was acquiring Foursquare (title 'to Acquire', body 'has announced the acquisition'), with undisclosed terms; its release says leadership will join 'after the transaction closes'. Foursquare's homepage read 'Foursquare has joined Infillion' on 24 October 2026, and Business Insider wrote on 20 October 2026, in its own words, that 'Foursquare was acquired by Infillion', reporting Crowley's Substack post that equity holders received $0. No opened source states a closing date.2synthesissupported with qualificationmedium
Foursquare's public device figures use five different definitions and do not form a series: 'more than 100 million monthly devices' measured in the US (May 2019), 'more than 500 million devices worldwide' plus a 25 million opted-in panel (April 2020), 'an audience of 100M+ unique users' (Visits docs, undated), '9B+ monthly visits from 500M+ devices worldwide' (homepage, October 2026) and 'aggregated coverage of 250 million U.S. devices' (Infillion, September 2026).2synthesissupported as statedmedium
ZeroToOne.AI announced on 25 March 2026 that it had acquired GroundTruth, with no seller, price or closing record disclosed; GroundTruth's site now calls itself 'a ZeroToOne.AI company', and the acquirer's counsel confirmed its role on 24 April 2026.2direct recordsupported as statedhigh
No current US panel size is published for GroundTruth; the dated scale figures found use incompatible definitions: a 50 million opted-in 'mobile panel' target (November 2016), a 'first-party database' of 95 million 'active monthly users' and 17 million 'active daily users' plus a claim to see 'two out of three people who own a smartphone in the U.S.' and 'over one billion physical visits ... each month' globally (June 2017), 'over 30 Billion visits annually' (2021) and 'more than 2,000 enterprise customers globally' (March 2026).2vendor assertionsupported with qualificationmedium
InMarket’s scale figures are incompatible and mostly undefined: ‘200 million+ Location-based consumers’ (current pages, no period), ‘200M+ opted-in consumers’ (Maestrø release, June 2026), ‘nearly 200M+ permission-based users’ (Vistar page), 110 million monthly active unique devices (undated NinthDecimal sell sheet), ‘over 100M SDK-based users’ (2020 letter) and GeoLink’s 200M+ mobile, 190M+ desktop and 110M+ CTV devices; none is a dated US monthly device panel.2vendor assertionsupported as statedhigh
Placer's undated help-centre page describes its panel as "tens of millions" of US devices, about 7% of the US population, 55% iOS and 45% Android, from hundreds of partner apps that collect location "in the background", with data from 1 January 2017 and US territories excluded.2vendor assertionsupported as statedmedium
Placer's stated panel size appears as "over 20 million active devices" (website as quoted May 2022), "30M Active Devices" and "25M+ devices representing ~9%" (Sept 2024 deck), "over 20 million monthly active users" (Santa Cruz fact sheet, Feb 2026) and "roughly 30 million mobile devices (representing about 8% of the U.S. population)" (Sept 2026 commissioned write-up), against "approximately 7%" on the help page; only the city sheet gives a monthly basis. Drop "internally inconsistent" for the app count: the deck counts dozens of SDK partners and hundreds (500) of apps, different units.2synthesissupported with qualificationmedium
Placer documents its supply as background location from partner mobile apps that integrate its SDK, plus auxiliary Bluetooth, Wi-Fi beacon, battery and network data; TechCrunch reported in August 2024 that it also gets data "through other third-party sources"; no source opened gives proportions by source, and none documents use of bidstream location.2synthesissupported as statedmedium
At the cutoff Unacast's own Foot Traffic Data page sells four Location Intelligence APIs (Area Visitors returning "unique device counts" for a submitted polygon, coordinate-level Observations, Trade Areas, Personas) and scheduled DaaS delivery, while its pricing page still lists machine-learning Foot Traffic Datasets and the Location Insights platform as "US only" packages.2vendor assertionsupported as statedmedium
Gravy Analytics, Inc., a Delaware corporation in Ashburn, Virginia whose wholly owned subsidiary is Venntel, Inc., trades as Unacast: its September 2026 privacy policy opens "Gravy Analytics, Inc. dba 'Unacast", its January 2025 breach notice calls it "a subsidiary of Unacast, Inc", and gravyanalytics.com redirects to unacast.com; the combination was announced as a merger on 29 November 2023 with no structure or completion date stated.2synthesissupported as statedhigh
The FTC complaint against Gravy and Venntel alleges that they collected no data directly from consumers, obtained it from suppliers who "may themselves obtain the location data from other data suppliers, the mobile advertising marketplace, or mobile applications", claimed over 17 billion signals from about a billion devices daily, sold raw timestamped coordinates tied to MAIDs and IP addresses in batch deliveries, and failed to take reasonable steps to confirm consent.2direct recordsupported as statedmedium
Unacast documents its supply as licensed, not collected: it says it chose "to exclusively license data from other entities in the ecosystem instead of collecting location data through our own SDK", licenses signals "from aggregators representing SDKs across tens of thousands of mobile apps", and processes "an almost equal mix of U.S. and international data", with no source proportions.2vendor assertionsupported as statedmedium
Unacast and Gravy volume figures use incompatible global units and none gives a US monthly device count: "more than 1 billion monthly devices across 180+ countries" (product page), "70 billion global signals per day" and "600 million MAUs globally" (Datarade, self-reported), and the companies' claim of "more than 17 billion signals from around a billion mobile devices daily" (FTC release, December 2024).2vendor assertionsupported as statedhigh
In December 2020 Apple and Google barred apps in their app stores from using X-Mode's SDK, a platform SDK removal; this review found the event only in trade reporting (AdExchanger, February 2021) and did not open a statement by either platform.2, 3synthesissupported as statedmedium
Cuebiq announced on 23 February 2021 that it was sunsetting its proprietary location SDK in favour of a clean-room product, Workbench (then in private beta for six months), while keeping an open-source SDK version that developers could still use to collect consented data; this is a documented partial shift of a US location vendor away from its own SDK supply, with no panel figure disclosed. The CEO cited privacy and security risk; the article, not Cuebiq, sets the move against Apple's cross-app tracking crackdown and ATT.2, 3vendor assertionsupported with qualificationmedium
Foursquare projects 'normalized visits' in the Research feed by weighting each observed visit with a 'SAG Score' (state, age and gender cohort population divided by active panelists), adjusts weights to offset changes in panel size and technical changes 'such as changes to how we calculate a visit in our SDK due to an OS update', and names iOS 13, partner-app MAU changes and new contributing apps as causes of step changes in raw visits.2, 3vendor assertionsupported as statedhigh
Placer restates history when it changes its model: Data Version 2.0 (31 March 2024) updated "all historical data from January 1, 2017", and its accuracy page says de-biasing adjustments happen "usually no more than once a year" and "can sometimes impact previously run numbers", so a Placer series read at two dates can differ for the same past period.2, 4vendor assertionsupported as statedhigh
Since 10 September 2025 the Blis DSP carries T-Mobile Advertising Solutions' US app ownership and app engagement data, which Blis says it combines with 'real-world movement patterns and verified transactions'; the homepage calls Blis 'part of T-Ads' and 'the only omnichannel DSP to combine T-Mobile app data with real-world movement & spending habits'. The T-Mobile data is described as app data, not location data.2, 6vendor assertionsupported as statedhigh
No current US panel size was found for Blis; the most recent panel figure is the August 2021 press kit's '370m opted-in global planning and measurement panel' (global, undefined), alongside '18 billion' ad requests a day and a 'Smart Pin' filter that discards about 80% of raw location data; a 2019 release gave reach of over a billion mobile devices a year.2, 6vendor assertionsupported as statedmedium
The FTC finalized its order against Mobilewalla on 14 January 2025; the order bans Mobilewalla from collecting consumer data from real-time bidding exchanges for purposes other than participating in those auctions, and the FTC alleged (this was the first time it alleged such a practice was unfair) that Mobilewalla had collected bidstream data; this documents an FTC allegation that bidstream collection was among Mobilewalla's sources, not an admission or a finding.2, 6, 7direct recordsupported with qualificationhigh
T-Mobile US agreed on 20 December 2024 to acquire 100% of Vistar Media Inc. and completed the acquisition on 3 February 2025, transferring cash of US$621 million, of which a portion settled preexisting relationships; the fair value of consideration transferred was US$617 million (FY2025 Form 10-K).2, 6, 9direct recordsupported as statedhigh
AdExchanger reported on 5 October 2026 that T-Mobile's data for Vistar includes mobile location data used to estimate inventory impressions and app installation and usage read from network requests; for users who opted into location tracking, T-Mobile can also detect proximity to OOH ads and use that exposure to retarget the user on other channels. T-Mobile tied the Vistar-only exclusivity to 'tightening regulations around location data and the use of mobile device IDs for ad targeting' and said DOOH measurement is 'on our road map to look into for next year'.2, 6, 9vendor assertionsupported with qualificationmedium
Vistar's T-Mobile partner page describes the segments as 'built from app ownership data, from devices within T-Mobile’s network' with use cases such as targeting people with competitor shopping apps 'near your store locations', while the 5 October 2026 release adds 'location insights' to the signal list.2, 6, 9synthesissupported as statedmedium
Arity, the driving-data company whose SDK data collection is the subject of a Texas action (workstream H), sells a named advertising audience product (Arity Audiences) alongside Arity SDK, Geosight and Routely, and announced on 16 October 2026 an agreement to acquire substantially all the assets of INRIX, expected to close in 2026.2, 7vendor assertionsupported as statedmedium
On 1 September 2026 Pine59 announced that it is "the new home of Unacast's former Aggregated Location Insights business" after "the completion of a management buyout" led by two Unacast co-founders and its former CTO; docs.unacast.com, which documents the machine-learning foot-traffic datasets, now says it "has moved to Pine59".2, 7direct recordsupported as statedmedium
Media and Games Invest plc announced on 23 January 2020 that its subsidiary gamigo AG had agreed to acquire substantially all assets of Verve Wireless Inc. (technology, IP and team) for a price 'expected to be in the low double-digit million range'; MGI renamed itself Verve Group SE with immediate effect on 13 June 2024; the 2020 event is an acquisition by asset purchase and the 2024 event a rebrand.2, 8, 13vendor assertionsupported as statedhigh
Perion Network completed its acquisition of Hivestack Inc. (Montreal, founded 2017, 32 countries) on 12 December 2023 for US$100 million in cash at closing plus a three-year retention and performance plan of up to US$25 million; the event is an acquisition (completed).2, 9vendor assertionsupported as statedhigh
Broadsign announced on 25 November 2025 (per AV Network; the cited Inavate copy is dated 2 December 2025) that it had acquired the DOOH SSP Place Exchange, with a minority investment from Crestline Investors, terms undisclosed, a combined programmatically transactable network of 1.8 million screens and Place Exchange's PerView measurement product; the event is an acquisition (announced as completed, though the release also uses 'is acquiring').2, 9vendor assertionsupported with qualificationmedium
Placer documents live delivery routes beyond its dashboard: a published REST API reference (PAPI v1.2.1), scheduled bulk feeds in CSV or Parquet, Snowflake private sharing into the buyer's account, distribution inside the Bloomberg Terminal's {ALTD} alternative-data platform (since September 2023; Data Entitlements from February 2026, per Placer), and, as a per-account enterprise entitlement, a remote MCP server ("Pi for Placer MCP") whose documentation page was last updated 22 October 2026 and which is listed in Claude's connector directory and the ChatGPT store; its launch date is not established.2, 10vendor assertionsupported with qualificationhigh
App Tracking Transparency was announced on 22 June 2020 as an iOS 14 requirement, deferred on 3 September 2020 to 'early next year', and became mandatory for all apps on 26 April 2021 with iOS 14.5; Apple's definition of tracking includes sharing user or device data with data brokers.3vendor assertionsupported as statedhigh
Apple introduced privacy manifests, SDK signatures and required-reason APIs at WWDC23; on 7 December 2023 it set the requirement for 'spring 2024', and on 29 February 2024 it dated it: warning emails from 13 March 2024 and, from 1 May 2024, App Store Connect rejects uploads that use a required-reason API without an approved reason; a manifest's declared tracking domains are blocked unless the user has granted ATT permission.3vendor assertionsupported with qualificationhigh
Apple's WWDC24 session introduced CLServiceSession, under which Always authorization is effective only while the app holds a session started in the foreground and approximate location is delivered only every 15 to 20 minutes; iOS 18 shipped on 16 September 2024, iOS 26 on 15 September 2025 and iOS 27 on 14 September 2026. Apple's Core Location change log lists no change after June 2024, and no change to the user-facing location permission in iOS 26 or iOS 27 was found in the Apple pages screened (WWDC25 and WWDC26 session listings were not opened).3vendor assertionsupported with qualificationmedium
Android 11, which began rolling out on 8 September 2020, added a one-time ('Only this time') location grant, removed the background-location button from the runtime dialog so that 'Allow all the time' can be set only in Settings, required apps targeting Android 11 to request background location separately from foreground location, and auto-resets permissions of unused apps.3vendor assertionsupported as statedhigh
Google Play announced on 19 February 2020 that background location access would need approval, with a projected timeline (subject to change) of 3 August 2020 for new apps and 2 November 2020 for existing apps, and said on 8 September 2020 it would not enforce the policy for existing apps until 2021. The current Play policy limits all device location data, foreground and background, to essential functions central to the app's core purpose, says it is never permitted solely for advertising or analytics, and reserves background access for critical features.3vendor assertionsupported with qualificationhigh
The only platform-attributed effect figure found: Google stated on 19 February 2020 that on Android 10 'over half of users select "While app is in use"' when offered the new location options, and that many apps requesting background location did not need it (coded 'documented' under Q4 as an official statement with a figure; the effect is on permission grants, not on any vendor's panel).3vendor assertionsupported as statedmedium
Google Play's User Data policy, as read on 24 October 2026, lists device location among personal and sensitive user data, prohibits selling it (defining sale as transfer to a third party for monetary consideration) and requires developers to ensure their SDK providers do not sell such data from the app; the Permissions policy adds 'Don't sell device location' and 'Don't use device location solely for advertising or analytics purposes'.3vendor assertionsupported as statedmedium
On 17 October 2025 Google announced it would retire the Attribution Reporting API, Protected Audience and Topics on both Chrome and Android, together with Protected App Signals, SDK Runtime, IP Protection, On-Device Personalization, Private Aggregation, Related Website Sets and SelectURL, with phase-outs to follow Chrome and Android processes and no retirement dates given; CHIPS, FedCM and Private State Tokens continue.3vendor assertionsupported as statedhigh
The FTC's January 2024 complaint against X-Mode Social and Outlogic records that the X-Mode SDK had been integrated into more than 300 apps, that X-Mode paid app developers per device whose location the SDK collected, that it also bought location data from data brokers and aggregators and collected it from its own apps, and that it sold precise location data revealing visits to sensitive locations; the complaint does not mention Apple's or Google's December 2020 removal of the SDK, which this stream could not open from a primary source.3direct recordsupported as statedhigh
Near Intelligence's February 2023 registration statement describes Apple's 2020 approximate-location option under 'key trends around the lack of precise location data' and cites Apple's iOS 14 and 15 opt-in measures and Android 12 as privacy measures, without attributing any figure or change in its own data supply to them (coded 'asserted' under Q4).3direct recordsupported as statedmedium
Telenav sold its advertising business, Thinknear, Inc., to inMarket Media, LLC under an Asset Purchase Agreement dated 8 August 2019, receiving a 14.5% member interest in inMarket at closing and a perpetual licence back, with the business presented as discontinued operations (event class: acquisition by asset sale).3direct recordsupported as statedhigh
Radar’s iOS SDK privacy manifest (file last changed 1 June 2024) declares precise location, coarse location, device ID, user ID, performance and diagnostic data as collected and linked to the user, each with tracking set to false and purposes limited to app functionality and analytics, while the privacy notice lists mobile advertising identifiers among SDK data.3vendor assertionsupported as statedmedium
SafeGraph's residing-device sampling rate fell after the COVID-19 outbreak and declined until October 2021, recovered to a peak of 13.4% in May 2022 and dropped to 4.9% in July 2022, a fall the authors say 'may relate' to a data-provider disruption; annual means were 7.2% (2018), 8.1% (2019), 7.2% (2020), 6.6% (2021) and 8.5% (2022). That the series does not contract monotonically across the 2020-2021 permission changes is this review's inference: the authors attribute the decline to the pandemic and do not discuss the permission changes.3, 4independent measurementsupported with qualificationmedium
An academic working-paper abstract (April 2022) using device-level location data from more than 7 million iOS and Android devices reports that, for a location data provider collecting through multiple apps, the frequency of data collection from iOS devices fell after Apple's App Tracking Transparency policy, driven both by devices becoming unobserved and by observed devices emitting fewer pings.3, 4synthesissupported as statedlow
Every independent SafeGraph ground-truth comparison found uses data from 2018-2020, before or during the iOS 13/14, App Tracking Transparency and Android 12 changes; the only post-2021 independent comparisons are the Advan park series (to January 2023) and the Minnesota Placer.ai/StreetLight case (summer 2021), so published validation does not describe the panels as they existed at the cutoff.3, 4synthesissupported as statedhigh
An independent audit of SafeGraph's point-of-interest data (about 47 million US devices) against North Carolina's 2018 general-election voter file found that polling places with older and with more non-white voters had lower coverage: rank correlations of coverage with the share of voters over 65 of -0.14 (p<0.001) and with the share of non-white voters of -0.11 (p=0.0067).4independent measurementsupported as statedhigh
In the same audit, SafeGraph's election-day marginal traffic correlated with actual turnout across polling places (rank correlation 0.383, p<0.001) but place-level estimates were noisy: the root-mean-squared error was 1,375 voters, and polling places that registered 20 marginal SafeGraph devices had between roughly 300 and 2,300 actual voters.4independent measurementsupported as statedhigh
Allocating a resource in proportion to SafeGraph traffic rather than to actual voter counts would have under-allocated by 37% to the oldest and most non-white group of polling places and over-allocated by 33% to the youngest and whitest group (both p<0.05), and in a rank regression each percentage-point rise in voters over 65 was associated with a five-place drop in SafeGraph's ranking relative to the true ranking.4independent measurementsupported as statedhigh
SafeGraph's own 2019 check (vendor blog and notebook) imputed device demographics from each device's home census block group and compared them with census totals by demographic category nationally (r=0.99 for education and income), plus a geographic check of device counts against county population (r=0.97; a block-group correlation of 0.176 per Li et al. 2024); it concluded the panel was 'well-sampled across demographic categories' and did not test bias for place-specific visit inferences.4vendor assertionsupported with qualificationmedium
Across 2018-2022, SafeGraph's monthly sampling rate (residing devices divided by total population) averaged 7.5%. Monthly values ranged from 4.5% to 14.5% across the national, urban and rural series, and the overall trend peaked at 13.4% in May 2022 before falling to 4.9% in July 2022. In 2019, device counts tracked census population closely at county level (Pearson r 0.986 urban, 0.934 rural) and moderately at tract level (r above 0.683 urban, above 0.830 rural). The urban-tract fit weakened to r-squared 0.375 by 2022. These results compare the panel with population counts and do not validate visit counts.4independent measurementsupported with qualificationhigh
The 2018-2022 census comparison found Hispanic residents slightly over-represented in 2018 and early 2019 and under-represented from March 2020 to July 2021 (state-median bias -0.058 in 2020 and -0.059 in 2021, easing to -0.022 in 2022); low-income and low-education groups were slightly under-represented, more so during the pandemic, but at state level in 2022 the pattern reversed (lower-education and lower-income groups over-represented); most group biases were within about +/-0.05; rural units were sampled at higher rates than urban ones at tract and block-group level from April 2019.4independent measurementsupported with qualificationhigh
SafeGraph-derived origin-destination flows for March-May 2020 (panel described as about 10% of the population; weekly active devices fell from over 22 million to 13 million in the week of 13-19 April 2020) correlated with pre-pandemic ACS commuting flows at county level at 0.974-0.985 for inferred population flows and 0.915-0.961 for raw visitor flows, and with Descartes Labs mobility indices in five metros at 0.92 or above; the authors state that no ground truth exists for these flows.4independent measurementsupported with qualificationhigh
A peer-reviewed study of six western US national parks compared SafeGraph Social Distancing Metric records with National Park Service visitation statistics for 2019-2020 and concluded that device mobility records capture park visitation patterns at finer spatiotemporal granularity; the abstract read reports no correlation statistic.4synthesissupported as statedmedium
In Yellowstone, SafeGraph Patterns visits (January 2018-November 2020) correlated with NPS monthly recreation visits at r=0.88 and r=0.85 for the two most-visited POIs, with a trail counter's daily counts at r=0.76 (2018) and 0.77 (2019), and with park-wide gate vehicle counts at r=0.79 in 2019 but only 0.47 in 2020, when the compared facility imposed indoor capacity limits.4independent measurementsupported as statedhigh
In the same Yellowstone study only 40 of the 80 SafeGraph POIs located inside the park were valid (the rest had mismatched coordinates or names, mostly attractions), the ACS-imputed visitor demographics differed significantly from the visitor survey on education and income, and short-term international visitors (23% of the park's visitors per NPS surveys) cannot be assigned a home block group.4independent measurementsupported as statedhigh
A 2025 preprint using Advan Weekly Visit Patterns (about 35 million US devices from about 1,000 apps, described as roughly a 10% sample) for January 2019-January 2023 reports a Pearson correlation of 0.875 between its visit series and National Park Service visitation for the ten most-visited parks, a comparison the authors call qualitative and based on visual inspection.4synthesissupported as statedmedium
The only Veraset-specific coverage study found, a June 2026 preprint benchmarking 2,478 Mexican municipalities against the 2020 census, finds that the multi-app Veraset data concentrate users in larger, wealthier and more digitally connected places, that coverage bias is spatially clustered, and that it differs by source from Facebook's single-app data.4independent measurementsupported as statedmedium
Two 2025 preprints (funding not stated) find mobility-data bias in all ten US cities studied but specific to each city, with tract wealth, ethnicity and education predicting how much data residents produce, and, for four UK datasets against the 2021 census, that multi-app datasets do not necessarily reduce bias relative to single-app sources; the US authors say this raises serious questions about general debiasing approaches.4synthesissupported with qualificationmedium
For Cuebiq, a 2017 Federal Highway Administration case study comparing its data with a smartphone GPS household travel survey found demographic biases by traveller age and income and a bias toward trips longer than 9 miles, and a 2022 University of Washington analysis of device-to-population ratios in 11 metros found the direction of racial bias varying by metro (other-race residents under-represented by 9.60% against 1.04% for white residents in Los Angeles; the pattern reversed in Boston and Seattle).4independent measurementsupported as statedmedium
Location Sciences, which sold the Verify verification product, told the market in September 2019 that of 550 million impressions it verified in the first half of 2019 only 14% carried high-quality GPS signals, that 36% of GPS-enabled applications displayed location fraud and that 65% of advertising budgets were being wasted on mistargeted and poor-quality location data; Verify's revenue in that half was 113,536 pounds.4vendor assertionsupported as statedmedium
This review found no peer-reviewed measurement of bidstream location accuracy with published statistics in the sources screened by the cutoff (web searches only; ACM, IEEE, USENIX and PETS databases were not searched directly): the closest academic items are a July 2024 IMDEA Networks talk on bid requests from a mid-size DSP reporting insufficient numeric precision and abnormal spatial concentrations suggesting manipulation (no numbers; no paper found), and the 2017 ADINT study, in which ads bought with a budget of about US$1,000 could localise a device to about 8 metres once it stayed about 5 minutes.4synthesissupported with qualificationmedium
Randomised field experiments of location-targeted mobile promotions exist in the academic literature with store-level outcomes: a 2015 JMR geo-conquesting experiment across competitive, focal and benchmark shopping areas found increasing returns to discount depth when targeting consumers near a competitor and decreasing returns at the focal location, and a 2019 Management Science experiment in one shopping mall (83,370 user responses over 14 days in June 2014) found trajectory-based targeting raised redemption probability, redemption speed and transaction amounts.4synthesissupported as statedmedium
The Federal Reserve Bank of Chicago's weekly retail trade index (CARTS) uses retail foot traffic as one of eight weekly indicators and lists SafeGraph and Advan Research among its data sources, benchmarking the index to Census monthly retail sales; this is documented production use of panel foot traffic by a central bank, not a published validation of visit counts.4direct recordsupported as statedmedium
No independent comparison of any named vendor's projected retail visits with door counts or transactions across many places and months was found in the sources screened by the cutoff, and no vendor publishes a held-out validation with error statistics on the pages opened. The third-party evidence that exists is historical and narrow: a 2018 audit of SafeGraph's panel found lower place-level coverage at polling places with older and non-white voters (adverse evidence for that panel and use), park and trail comparisons from 2018 to 2021, and one Placer.ai trail-site check whose funding is not stated, so it is third-party but not independent under the rules. H2 stays unresolved overall; no single verdict is given across products and data vintages.4synthesissupported with qualificationmedium
Unacast's own 'ground truth' post (published 25 February 2021, updated 5 August 2024) compares its average workday foot-traffic estimates at five US manufacturing plants with 2019 employee counts taken from online sources and reports that 'the only outlier was the Everett facility' and 'All other data matched within 20%', with the facility-level numbers shown only in a chart image and the reference being headcount rather than visits.4vendor assertionsupported with qualificationmedium
Huq (2026-08-06) publishes a median MAPE of 14.5% for its footfall estimates 'against ground truth in Germany', tested against 'hundreds of authoritative external sources', without naming the references, the site count or the period; Advan (2019) guarantees '99.5% accuracy of geofences' across 1.2 million locations, a claim about geofence geometry rather than visit counts; neither is a US visit-count validation.4vendor assertionsupported as statedmedium
Cuebiq's 2017 benchmark paper asserts, citing an MMA report released in October 2015 ('Demystifying Location Data Accuracy', gated behind MMA member login), that 'less than 33% of location data collected through ad exchanges' is accurate within 100 metres, a vendor-cited figure about bidstream location whose underlying sample and method neither this stream nor its verifier could read.4vendor assertionsupported with qualificationlow
Of the opened documentation for the fourteen cohort A products, only Azira's undated white paper reports a comparison of its visit numbers with an independent reference: a vendor-asserted median absolute percent error of 10 per cent and a correlation of 0.85 between extrapolated visits and 'ground truth sales data and foot traffic counters', with no study design, sample, period or places disclosed. No product publishes such a comparison as a documented study. The other validation claims found are bare assertions: InMarket's 'Comscore-Verified Visit Methodology' and GroundTruth's Blueprints 'verified using a selection of trusted location sources'.4synthesiscontradictedmedium
Foursquare's only published validation of its attribution panel is a trend check of scaled transactions against 'public financial statements' and of visitation trends against transaction trends, with no places, period or statistic; the 'Third-party verified' Forrester item on the product page is a Forrester Consulting Total Economic Impact ROI study commissioned by Foursquare (June 2022), not a validation; this review found no independent ground-truth comparison of Foursquare Attribution or Visits numbers in the sources screened by 24 October 2026.4vendor assertionsupported with qualificationmedium
A 2013 third-party user study (244 users, January to July 2013; the paper carries no funding or acknowledgement statement) found that Foursquare check-ins covered roughly 10% of the locations users visited and that about 75% of check-ins did not match a GPS-detected visit; Foursquare today trains its Snap-to-Place visit model on 'human-verified' check-ins, so the study bears on that ground truth, though its data predate the current products by a decade.4synthesissupported with qualificationlow
GroundTruth's ground-truth evidence is a vendor-commissioned receipt-panel comparison: GroundTruth commissioned InfoScout (now Numerator) in 2017, and its 2019 post reports the 'third annual' audit at '94.4%* visit accuracy', footnoted as an analysis of '10,000 matched panelists who shopped at a sample of key retailers' and submitted receipts; help pages later claim '99% accurate as verified by Numerator'. The sample size and reference (receipts) are stated, but no report, period, retailer list, method or error statistic is published, and the measure checks whether recorded visits are confirmed rather than whether visit counts match a reference.4commissioned measurementcontradictedmedium
No published comparison of InMarket’s visit numbers with an independent reference (door counts, transactions or official visitor counts) with error statistics was found; validation statements are vendor claims naming Comscore (‘Comscore-Verified Visit Methodology’; ‘LCI Attribution Comscore validated for visit metrics accuracy and aptness’, 2020) and an unnamed set of ‘truth sets’, with no report, date or scope published.4vendor assertionsupported as statedmedium
In the only third-party comparison of Placer.ai found (funding not stated) in the sources screened by the cutoff, a University of Minnesota Extension case study at one Minnesota recreation area (29 May to 6 September 2021), Placer.ai estimated 13,233 visits against 10,138 counter-recorded visits, 30.5% above, and StreetLight 14,544 (43.5% above); the author reports no statistically significant difference, but the platforms showed weekends 7 times busier than weekdays against 2.1 times in the counter averages.4synthesissupported with qualificationmedium
The same Minnesota case study found Placer.ai's inferred visitor demographics differed significantly from the intercept survey on race, education and income: for example 30.8% with a bachelor's degree or higher and 21.8% with household income over US$100,000 in Placer.ai data, against 62% and 61% in the survey.4synthesissupported as statedlow
Placer publishes accuracy claims without method: its home page states "+92% accuracy", a California city's 2026 fact sheet relays that "Placer.ai claims 92–96% accuracy" with correlations to ground truth "consistently exceeding 90%", and the help page names references (Major League Baseball attendance, transactions, store revenues, conference attendees, vehicle counters) without any result, sample or statistic.4vendor assertionsupported as statedhigh
An interested site-selection vendor's blog reports that, across 12 retailer-quarter comparisons for six large US retail and restaurant chains (Q1 2025 to Target's Q2 FY26), Placer.ai visit trends and the companies' SEC-reported traffic or transaction figures "agreed on direction 9 times out of 12", with a median gap of about 2.2 percentage points.4commissioned measurementsupported with qualificationlow
The only accuracy statistics Unacast publishes for its foot-traffic estimates are an R-squared "of 91.6% or higher" against the foot traffic of one unnamed nationwide clothing retailer, with no places, period, sample or holdout stated, and a 2021 post (updated 2024) saying workday estimates at four of five US manufacturing plants "matched within 20%" of 2019 online headcounts (Everett the outlier) and that stadium visits matched approximate capacity in October 2018 to February 2019; per-site values appear only in chart images.4vendor assertionsupported with qualificationhigh
Across 663 Facebook experiments with more than 5,000 user-level features, double/debiased machine learning and stratified propensity-score matching could not recover experimental lift: median RCT lifts were 29%, 18% and 5% for upper-, mid- and lower-funnel outcomes, against 83%, 58% and 24% from DML and 173%, 176% and 64% from SPSM, and the authors conclude they were unable to reliably estimate a campaign's causal effect.4, 5synthesissupported as statedhigh
Even with randomisation, advertising effects are hard to measure: across 25 large field experiments with US retailers and brokerages (2.8 million dollars of digital spend, most reaching millions of customers) the median confidence interval on return on investment was over 100 percentage points wide, individual sales had a standard deviation about ten times their mean, informative experiments can require more than 10 million person-weeks, and the authors call selection bias from targeting a crippling concern for observational methods.4, 5synthesissupported with qualificationhigh
A randomised experiment with 1.6 million customers of a major retailer on Yahoo! measured a 5% increase in purchases from online ads, 93% of it in brick-and-mortar stores and 78% from consumers who never clicked; a cross-sectional observational estimator on the same data showed a large negative bias, three times the experimental effect (it understated the effect), while a difference-in-differences estimator served as a specification check.4, 5synthesissupported with qualificationhigh
Two randomised designs that location attribution can borrow have published methods: ghost ads (Google-affiliated authors, 2016-2017), which identify the control-group counterparts of exposed users so that lift can be measured without PSA controls, which the authors say become invalid under performance-optimised delivery, and geo experiments (Google, 2011), in which non-overlapping geographic regions are randomly assigned to treatment or control and realised through geo-targeted advertising.4, 5synthesissupported as statedhigh
Fifteen US Facebook advertising campaigns run as randomised controlled trials in 2015 (500 million user-experiment observations, 1.6 billion impressions) were used to test observational methods. Matching and regression methods using rich individual-level data mostly overestimated lift relative to the experiments, and in half of the studies the purchase lift was off by a factor of three across all methods. The study is an academic-Facebook collaboration on Facebook's own data: two coauthors are affiliated with Facebook, and the two Kellogg academics declare no financial interest or compensation.4, 5, 12synthesissupported with qualificationhigh
Thinknear editions after 2015 showed no improvement on its own measure: a May 2016 report put 32% of real-time location data from publishers and exchanges within 100 metres (industry score 45, down from 50, the lowest since tracking began in 2014) and 7% of data targeting 100-1,000 m accurate; an undated reseller deck that advertises the Q4 2017 index shows, on an unlabelled slide, 37% of impressions within 100 m, 35% within 100-100,000 m and 28% off by more than 100,000 m (the slide glosses this band as 6 miles, about 10 km, so the threshold is ambiguous).4, 6vendor assertionsupported with qualificationmedium
Location Sciences' 2019 verification of Blis location data ('near perfect scores (99%)') was a paid engagement, and in its final results for 2020 (RNS, 18 March 2021) Location Sciences stated that Blis Global Ltd, 'one of Verify's key customers', threatened legal action after Verify identified and reported 'data manipulation', that it rejected the claim as baseless, and that Blis had not followed up; Adweek reported on 15 December 2020 that Blis denied the allegations.4, 6direct recordsupported as statedmedium
Geopath's reach-and-frequency approach introduced with its 2023 data release is 'centered around observed mobile location data from smartphone applications and connected cars', uses machine learning trained on that observed data, and is self-reported to align 'with the observed data with ±5% accuracy'; the page (updated 15 November 2022) names no provider, sample size or validation method.4, 8, 9vendor assertionsupported as statedmedium
In the only third-party comparison of Placer.ai found in the sources screened (a University of Minnesota Extension study whose funding is not stated), the case study (April 2024) at one Minnesota recreation area, Placer.ai estimated 13,233 visits and StreetLight 14,544 for 29 May-6 September 2021. Those totals are 30.5% and 43.5% above the 10,138 recorded by trail counters. StreetLight's figure is vehicle trips multiplied by a median of three passengers. The authors found no statistically significant difference, but the comparison is not like for like: polygons differ, counters cover only the cross-country trails, and events are handled differently. The 7x versus 2.1x weekend ratio and the demographic differences should be read with those limits.4, 11synthesissupported with qualificationmedium
Azira's methodology page (footer 2025) is the only cohort A vendor document opened in this stream that documents a randomised control as the default: 10-15% of impressions serve public-service creative as a PSA holdout, with a synthetic control from its identity graph as the alternative, polygon-based visits, extrapolation of observed visits by a detection probability capped at 20x, minimums of about 1,000 observed visits and 100,000 exposed devices for breakouts, 99% confidence intervals and a two-tailed t-test.5vendor assertionsupported as statedmedium
Azira's Domestos case (Rize, Turkey; undated) reports an exposed footfall rate of 1.672% against a control rate of 1.168%, an 'Attribution Lift Index' of 143.151 presented as a 43% increase in store traffic against a stated 27% market benchmark, from 236,495 exposed users, 3,955 tracked visits and 577,978 impressions, without stating the control design, window or dates.5vendor assertionsupported as statedmedium
Cuebiq's 2017 benchmark paper (client reports Q3 2016 to Q1 2017; database of 61 million anonymous users) defines uplift against a control of unexposed users matching the exposed group's criteria, publishes benchmark uplift ranges of 10-30% for retail and big-box, 10-40% for QSR and 20-45% for automotive, and reports average campaign uplift between 18.62% and 37.70% across the three quarters.5vendor assertionsupported as statedmedium
Cuebiq's 2022 benchmark report (campaigns run in 2020-21) sets vertical thresholds at the 33rd and 66th percentiles of its client reports: retail uplift 0-1% low, 1.01-7.61% medium, 7.62-52.5% high; QSR uplift 0-3.88%, 3.89-11.86%, 11.87-38.5%; grocery uplift 0-1%, 1.01-11.25%, 11.26-35.7%; it defines uplift against a control group and adds an 'Incrementality Effect' (share of visits that are incremental) and a cost per incremental visit.5vendor assertionsupported as statedmedium
adsquare's Attribution dashboard (page dated 2025-05-20) reports uplift from a 'Synthetic Control Condition model' that simulates unexposed behaviour after adjusting for weather, seasonality, local footfall trends and public holidays, which the page says 'removes reliance on traditional control groups', with visits matched to 2D POI polygons from SDK data collected with opt-in; no uncertainty or significance reporting appears on the page.5vendor assertionsupported as statedhigh
Azira is the only vendor whose public pages opened disclose numeric minimum-sample and significance rules for visit lift (about 1,000 observed visits and 100,000 exposed devices; 99% confidence intervals; two-tailed t-test). InMarket's thresholds (reported as 10 or 25 million impressions and ">95%" confidence) sit in a glossary behind a sign-in and could not be verified from a public route; Choozle documents a different minimum, 30 days and 1 million impressions a month, for its InMarket Visit Stream integration only. Reveal's measurement page discloses confidence intervals and p-values without a numeric minimum; Vistar states only that it requires "enough scale"; Foursquare, Cuebiq, Adsquare, Blis, Simpli.fi and GroundTruth state none on the pages opened.5synthesissupported with qualificationmedium
Foursquare Attribution's documented default lift method is a modelled control: the 2022 method post describes regression adjustment that builds a synthetic control from static features, followed by difference-in-differences against pre-exposure visitation; the current developer docs describe a 'modeled control group' weighted on 10+ attributes and a 'model-based approach'. No randomised or holdout option appears in the opened documentation.5vendor assertionsupported with qualificationhigh
Foursquare Attribution documents measurement across digital, social, audio, linear and connected TV and out-of-home, GPS pings from first-party and vetted third-party sources, OOH proof-of-play log ingestion, a Spotify integration and '550+ integrated partners', with daily dashboard updates; it documents no pricing, no numeric minimum sample, no significance rule and no visit-definition thresholds, but it does document a mandatory pre-campaign feasibility gate (a score from estimated impressions) and releases reports only once results are 'statistically viable'.5vendor assertionsupported with qualificationhigh
InMarket's LCI documents a matched control by default: control devices are drawn from visitors to the same locations with employees removed and matched 1:1 to exposed devices on eight audience dimensions, and lift is the difference between exposed and control changes in visits two weeks after versus two weeks before exposure.5vendor assertionsupported as statedmedium
InMarket's LCI console gives two different denominators for LCI Lift on the same page: the Glossary divides the exposed-minus-control lift by 'Visits', the Calculations section by '(Exposed Visits + Control Visits)'.5vendor assertionsupported as statedhigh
InMarket's legacy LCI console glossary, read once during the research and since behind a sign-in, documented minimum samples and uncertainty: 10 million impressions for mobile app with valid device IDs and 25 million for mobile web or desktop per measured dimension, a standard error on the lift and a confidence level where '>95%+ constitutes a valid measure', with waivers subject to a feasibility assessment. These thresholds cannot be reproduced from a public route at the cutoff; the synthetic-control design itself is also described in InMarket's public July 2026 post.5vendor assertionsupported with qualificationmedium
GroundTruth's documentation states a payment model: Cost Per Visit, which it says it introduced in spring 2017, under which 'marketers only pay for ads that result in a store visit'; visit measurement is the basis of a media buy here. Whether measurement is also sold separately is not stated, and among the other thirteen products the opened pages state no payer or fee.5vendor assertionsupported with qualificationmedium
Reveal's current product documentation names only an OOH 'Net Lift Study' built on a synthetic control chosen by propensity-score matching from a 'persistent panel of 60M US DAUs', with confidence intervals and p-values 'computed using closed-formed formulas and simulations'; its sample dashboards show 95 per cent confidence, but no confidence level is stated as a rule; VISIT Local is not named on the current site, and the 2021 case-study URL now serves the homepage.5vendor assertionsupported with qualificationmedium
Azira's white paper defines lift as (exposed rate - control rate) / control rate, but then computes incremental visits as 'Exposed Group Lift * Exposed Group Devices'. Read literally, that multiplies a relative lift by a device count. Under the paper's own definition, incremental visits are (exposed rate - control rate) x exposed devices. Do not reproduce or endorse the published formula without that correction.5vendor assertionsupported with qualificationhigh
Cuebiq's 2026 measurement content documents a behaviourally matched control (unexposed consumers similar in movement and shopping behaviour), opted-in device location data, linear TV exposure from broadcast partners' impression logs at household level, and coverage of linear TV, CTV, mobile, OOH, social and streaming audio, reporting incremental store visits and cost per incremental visit; no named product, visit definition, threshold or significance rule appears.5vendor assertionsupported as statedmedium
Precisely's audience product page documents no named PlaceIQ attribution product: measurement appears as a capability of Precisely Audiences ('tying media exposure to verified store visits and purchase activity') built from 'anonymized mobile signals', with activation partners listed and no measurement partner, control design, visit definition or panel size.5synthesissupported as statedmedium
Every cohort A product with a documented control design at the cutoff names at least one non-mobile channel it measures: CTV or TV by Foursquare, InMarket, Azira, Blis, Cuebiq and Arrivalist; DOOH or OOH by Foursquare, InMarket, Azira, Blis, Reveal (OOH only), Adsquare, Cuebiq, Arrivalist and GroundTruth (DOOH views via Blueprints); audio by Foursquare, Azira, Blis, Cuebiq and Arrivalist. Lifesight's help page and Vistar's partner page also name OOH or DOOH without a documented method, and Precisely's CTV is an activation channel, not a measured one.5synthesissupported with qualificationhigh
Blis documents Smart Holdout Groups as a geographic holdout: areas are scored on seven data points including demographics, household characteristics and income, pairs of similar areas are matched with one designated control and one target, and buffer zones built from Blis movement data are left unserved and unmeasured; the documents do not state that designation within a pair is random.5vendor assertionsupported as statedhigh
Blis announced the US rollout of Smart Holdout Groups on 11 July 2024 ('now available in the US') and the global release on 9 October 2024; footfall lift is 'Only available in the US', app-usage lift draws on UK mobile-network data and is 'Coming soon to the US', and in October 2024 Blis said clients 'will soon' be able to choose their own control factors.5vendor assertionsupported as statedhigh
On the product page, both launch releases and the technology page, Blis publishes no visit definition, no source for the footfall outcome, no minimum sample, significance rule or confidence interval and no projection method for Smart Holdout Groups, while describing it as 'statistically robust' and stating that measurement 'can be independently verified'.5synthesissupported as statedmedium
Blis's privacy centre lists location-attribution and audience-measurement companies among its 'Ad Effectiveness & insights' partners, whose role includes verifying 'whether a user visited a store after seeing an ad'; the listed partners include Cuebiq, Foursquare, InMarket, Kochava, Lifesight and Samba TV, and no source says which, if any, supplies Smart Holdout Groups' footfall outcomes.5vendor assertionsupported as statedmedium
Blis's US restaurant case study reporting a '55% store visit uplift (control vs exposed)', a 0.76% store-visit rate against a '0.5%' benchmark and 36% same-day visits was published on 12 September 2019, about five years before Smart Holdout Groups, and describes location audiences built from devices 'seen in competitor smoothie bars, restaurants or similar brands in close proximity'.5vendor assertionsupported as statedmedium
Foursquare Attribution's visit numbers are projected, not observed: the 2024 method describes tenure filters on third-party panelists, census weights at census block-group level with demographics predicted from behaviour, place weights, and 'projection weighting' that scales matched panelists to each publisher's delivered impressions.5vendor assertionsupported as statedhigh
Foursquare Attribution publishes no numeric minimum sample or significance rule: campaigns pass a feasibility score (Excellent, Good or 'Consult Foursquare') computed from estimated impressions, reports appear 'once the results are statistically viable' at least two weeks after launch and are finalised after the conversion window plus 7 days, impression minimums are given only through the support portal, and the calculator shows store-level feasibility and online or hybrid conversions as 'currently unavailable'.5vendor assertionsupported as statedhigh
Foursquare's documentation page describes its output as 'incremental lift' measured against a modelled expected visit rate, while reports and case studies use 'Behavioral Lift' (also 'proprietary visitation behavioral lift', S23), which no opened page defines; separately, Foursquare says it 'cannot offer a direct view into the calculation' of the star ratings that compare partners' metrics, Behavioral Lift among them.5vendor assertionsupported with qualificationhigh
Foursquare's published Attribution results carry no design detail: a 2026 linear-TV QSR case reports 1.32% behavioral lift, 3.4M+ incremental and 58.9M total attributed store visits, and the product page reports 9.2%, 7.8% and 2.5% lift figures and a '23% lift in in-store visits among exposed users versus the control group', none with exposed and control rates, sample, period or control construction.5vendor assertionsupported as statedmedium
GroundTruth's Observed Visits counts a user's visit to the brand or 'drive-to' location within 14 days of exposure to a GroundTruth ad, credited by last touch, and shows only 'verified' visits after a 7-day verification period (rolled out to accounts created after 17 September 2024); the help centre says observed visits 'may be lower than actual visits'.5vendor assertionsupported as statedhigh
GroundTruth's Projected Visits applies the visitation of a per-campaign panel of impressed devices 'with frequent location signals' to all impressed devices, using a proprietary model that includes WeatherBug first-party data, appears once a campaign usually reaches 40 Observed Visits and 350,000 impressions, is cumulative and rounded, and reports no uncertainty.5vendor assertionsupported as statedhigh
GroundTruth's visit measurement reports exposed-only visitation with no documented control group: Visitation Rate is Visits / Impressions; its '89% Incremental Visits' case defines 'incremental' as visits from newly acquired customers, not visits above a control; the 'more than half' incremental figure for 42,000 DOOH-exposed visits states no comparator; and its only comparative metric, Market Share, is a directional pre/post trend in share of all visits that the vendor says other factors may drive.5synthesissupported with qualificationhigh
GroundTruth sells a Cost Per Visit buying model, which it says it introduced in spring 2017, under which 'marketers only pay for ads that result in a store visit'; its help centre labels it a managed offering, and a November 2024 case reports an auto dealers' association paying 'only for verified visits' for 'over 1,200 visits' in a month, with no cost, impressions or control.5vendor assertionsupported as statedmedium
The only detailed public LCI method, the undated NinthDecimal-era glossary on InMarket’s LCI console, documents an audience-matched control (1:1 on eight demographic, travel and technology traits, drawn from devices seen at the same client-specified locations with employees removed), lift as the exposed minus control change in visits two weeks after versus two weeks before exposure, a standard error, a ‘>95%’ confidence rule and minimums of 10 million (mobile app with device IDs) or 25 million (mobile web/desktop) impressions per campaign and per report dimension.5vendor assertionsupported as statedmedium
Across InMarket’s own and partner documentation, every lift design described is matched or modelled: a 1:1 audience-matched device control (console), a synthetic control from historical visitation (2026 Visit Lift), ‘similar control users’ (TikTok, 2024) and a synthetic matched household control for CPG sales (2026); Visit Stream and the Yahoo DSP feed are observed visits for correlation and ‘directional’ reporting with no control.5synthesissupported as statedhigh
LCI’s headline store-visit totals are projected, not observed: the console defines Overall Projected Store Visits as exposed device visits rated up by a device-to-DMA ratio (with a ± range from a regression of population against device data across DMAs) and Incremental Projected Store Visits as that total times the LCI Lift; only ‘Exposed Device Visits’ are panel observations.5vendor assertionsupported as statedmedium
InMarket’s visit-lift measurement reaches buyers through partner platforms documented by the partners or in InMarket releases (TikTok from 2024, Reddit for all US advertisers from 12 November 2024, Vistar Media for US DOOH, Yahoo DSP for a daily observed-visit stream in the US and Canada from 23 April 2026, Basis from 27 May 2026), plus its own console, exports and a daily Visit Stream feed; no developer API reference was found.5vendor assertionsupported as statedmedium
InMarket publishes headline lift and return figures for this row with no design, base or uncertainty beyond its own descriptions: 121 of 126 TikTok campaigns with ‘statistically significant lift’ (2024), a 26% incremental visit lift against a 23% benchmark with 285,000 incremental visits for an unnamed dining chain (2026), a 40% incremental visit lift for an unnamed restaurant chain on CTV, ‘4.6M Incremental Visits’, an ‘11x’ media-effectiveness gain (InMarket and CMO Council, June 2023) and a 25% rise in repeat store visits (Forrester TEI, July 2021).5vendor assertionsupported as statedmedium
Simpli.fi's case studies count a visit when a device served the advertiser's creative later enters a Conversion Zone drawn around the store, an exposed-only design: a western-US QSR with 61 locations reported 12,768 in-store visits at a $1.70 cost per visit with a 30-day look-back (case dated April 2025), and a fast-food brand with 353 locations reported more than 215,000 visits at $1.09 against a $5 goal plus a 'Geo-Conversion Lift' of 31.76% defined as the difference between visitors who had received an ad and visitors who had not, with no matching described.5, 6vendor assertionsupported as statedmedium
Both MRC location accreditations on record since 2020 covered data sets, not a visit-lift or attribution metric; in the 35 MRC communications from January 2020 to October 2026 screened by name for Foursquare, GroundTruth, Placed, Cuebiq, NinthDecimal, inMarket, PlaceIQ, Blis and Reveal Mobile, and on the current lists, no lift, incrementality or attribution metric of a location product is recorded.5, 8direct recordsupported with qualificationhigh
MRC granted accreditation for 'location information reported in Visits data set' to 'Foursquare (formerly Placed) Visits data set' in its July-September 2020 actions, suspended it in October 2022 and revoked it in December 2022; Foursquare's own 2020 release said its Attribution product 'has not been audited or accredited by the MRC'.5, 8direct recordsupported as statedhigh
Vistar documents no attribution method of its own at the cutoff: its TTD activation guide says Vistar 'works with trusted industry leaders' for foot-traffic, brand, online-conversion and sales-lift studies, that 'All studies require a feasibility test and have varying minimums and costs', and that it 'offers device ID passback for free'; vistarmedia.com/measurement returned HTTP 404.5, 9vendor assertionsupported as statedmedium
In a 2022 OAAA-hosted Vistar case for a national retailer (flight 15 August 2021 to 29 January 2022; 22 US states; budget $1.2M+), Foursquare-measured results were 72 million+ impressions, 533,000 store visits within a four-day look-back and a 6.51% lift in visitation 'compared with non-exposed consumers'; the document asserts a control-versus-exposed design without describing how the control was built or its size.5, 9vendor assertionsupported as statedmedium
InMarket announced Maestrø in beta on 18 June 2026 as an agentic optimisation layer that feeds InMarket outcomes to AI agents, sold three ways including a fully managed ‘Guaranteed iROAS’ offer and an ‘Open Access’ route ‘Built on MCP’; no public MCP server or AdCP agent for InMarket was found, so this is an announcement, not a documented protocol implementation.5, 10vendor assertionsupported as statedmedium
The author's former and current employers checked by this stream show no named location product on the pages opened: Lotame's homepage (Spherical Platform, Addressable Audiences, Data & Identity Services) has no 'location' or 'geo' text, Verve's homepage names audience and ID-less publisher products without a location product, and the Samba TV consumer site refers business visitors to samba.com, which was not opened.5, 13vendor assertionsupported as statedlow
Azira's privacy policy (updated 6 August 2025) documents that it collects personal information from third-party data providers and data brokers, from bid requests received when acting as a DSP, and from 'raw human movement data collected by mobile apps consistent with user permissions'; it therefore documents a blend of partner-sourced app data and bidstream data without proportions.6vendor assertionsupported as statedmedium
Foursquare Audience, live in 2026, builds segments from past visitation with location-specific high, medium and low frequency buckets, a recommended look-back of 3 to 6 months (custom ranges up to 18 months), a 5,000-device minimum segment size, and is sold off-the-shelf on The Trade Desk, LiveRamp and DV360; its documentation does not state the collection route of the visits.6vendor assertionsupported as statedmedium
GroundTruth Ads Manager (live, US, $0 minimum spend) sells four location-targeting layers documented in its help centre as of 23 September 2026: Target Locations (city to precise business address, lat/long or nationwide), Target by Audience (historic visitation, with Deterministic first-party, Predictive and Datonics 'Premium' tiers), Target Neighborhoods (trade-area lookalikes) and Target On-Premise (real-time, mobile only, with In Store, On Lot, Retail Block and Radial boundaries); the platform calls geofencing 'Location Targeting'.6vendor assertionsupported as statedmedium
GroundTruth's privacy policy (effective 2 April 2026) documents a blend of location sources without proportions. It names collection by SDKs, scripts and similar techniques, and lists these sources for geolocation information: consumers, customers, ad inventory supply partners (publishers), service providers, consumer data resellers and other third parties. It does not use the words bid request or bidstream, gives opt-out choices only, and states "We may sell your sensitive personal data."6vendor assertionsupported with qualificationmedium
Blis's product documentation could not be read by this stream at the cutoff: the homepage title reads 'Blis, part of T-Ads | Omnichannel DSP' and the technology page title 'Cookieless DSP Technology | Geospatial AI | Blis', but both bodies were truncated or bot-blocked, so Blis audiences are coded 'not disclosed' pending a readable source.6inferencesupported as statedlow
The FTC's final order with InMarket (finalised 1 May 2024, vote 3-0-2) prohibits InMarket from selling, sharing or licensing any precise location data and from any product or service that categorizes or targets consumers based on sensitive location data. The complaint it settled, announced January 2024, described collection through InMarket's own apps and through third-party apps that use its SDK. InMarket's current data page and privacy policy (30 June 2026) describe the same own-app and partner-SDK route.6direct recordsupported with qualificationhigh
Azira Audience (live, 2026) builds segments from real-world visitation, purchase behaviour and intent, at a stated "3 meters of precision" with no method given. It activates through Azira's Advance DSP (claimed 80-90% addressability, January 2025 blog) across desktop, mobile, CTV, audio, DOOH and Meta/TikTok. Azira's data page documents a blend of location sources without proportions: "premium SDK, bid-stream, and verified consumer transactions". Its privacy page describes a sensitive-location data program that removes sensitive locations from its datasets.6vendor assertioncontradictedmedium
Mobilewalla Audience Segments is still presented on a page whose copyright line reads 2025, with 200+ segments built by predictive modelling over app usage, demographics and GPS location data. The company homepage now leads with telecom and consumer-lending AI products. Mobilewalla's business-services privacy notice (updated 9 January 2026) says all its data comes from third-party ad-tech information providers. It names movement-data fields (MAID, latitude and longitude, IP, timestamp) but not whether they come from SDKs or bid requests, and it states that Mobilewalla does not knowingly collect visits to named sensitive locations.6vendor assertionsupported with qualificationlow
Precisely sells the PlaceIQ audience line as "Precisely Audiences" in 2026; the old placeiq-audiences URL now redirects to /product/precisely-audiences/. The page offers 1,500+ pre-built segments "curated from anonymized mobile signals, demographic profiles, shopping patterns, and categorical interests", exportable to DSP, CTV or social platforms, and states no collection route, panel or accuracy method.6vendor assertionsupported with qualificationmedium
Reveal (Reveal Mobile, Inc.) builds location audience segments in 2026 through its Geofencing Solutions, which captures Mobile Advertising IDs at "your locations, competitor locations, and audience hotspots" for activation in The Trade Desk, LiveRamp, Pontiac Media, Basis, Choozle and social platforms. Its OOH platform offers retargeting of OOH-exposed devices across display, social and CTV. Neither page names the source of device location.6vendor assertionsupported with qualificationmedium
Across the cohort B documentation opened by 24 October 2026 (including InMarket's data page and Azira's audience page), this review found no independent on-target or accuracy validation of a location audience with a published design. The accuracy statements are vendor assertions without method: GroundTruth's Predictive Audiences "over 90% predictive accuracy", Foursquare's "industry's most accurate location-based datasets", Mobilewalla's age and gender "verified" against Nielsen DAR and US Census, InMarket's 3.7x against Wordstream display benchmarks, Azira's 80-90% addressability and "3 meters of precision", and Simpli.fi's plat lines "for maximum accuracy". InMarket also asserts that its location data is "Comscore verified and Location Sciences certified", naming certifiers but publishing no certificate or scope.6synthesissupported with qualificationmedium
None of the cohort B product pages opened describes sensitive-place suppression, but vendor privacy documents do. Foursquare commits to the NAI enhanced standard and lists 13 sensitive-place categories. Mobilewalla says it does not knowingly collect visits to places of worship, shelters, treatment centres or reproductive health clinics. Azira describes a sensitive-location data program that removes such data. These are self-attested policy statements with no verified enforcement, alongside FTC orders imposing programs on InMarket, Mobilewalla, and Kochava with Collective Data Solutions. GroundTruth's notice that it 'may sell your sensitive personal data' is a state-law disclosure and does not show that it sells sensitive-place visits.6synthesiscontradictedmedium
Geofencing and geo-conquesting are sold to US local advertisers in 2026 through at least three self-serve or managed routes with different mechanics: GroundTruth Ads Manager (real-time On-Premise and 'Pure Geographic' delivery to anyone inside a boundary, plus retargeting of 'your competitor's' past visitors, no minimum spend), Simpli.fi Addressable Geo-Fencing (parcel fences around up to one million addresses with 30-day cross-device follow-up) and Reveal's Geofencing Solutions (MAID capture at own and competitor locations for DSP and social activation).6synthesissupported as statedmedium
GroundTruth Ads Manager documents six channels (mobile, CTV and OTT, desktop and tablet, audio, DOOH with "1M+ digital out-of-home screens across the US", and direct mail). Azira's Advance DSP also documents six (desktop, mobile, CTV, audio, DOOH and Meta/TikTok social), so the two are tied for the widest documented channel set among the products opened. GroundTruth names no third-party DSP activation, only reporting integrations with TapClicks, NinjaCat and Agency Analytics. Foursquare, Adsquare, Reveal and Mobilewalla name external DSPs or marketplaces, and Precisely shows partner logos. Azira, Vistar and Simpli.fi activate through their own platforms.6synthesiscontradictedmedium
Blis Global Ltd's advertising privacy notice (effective 17 November 2025) states that its location data includes precise GPS-sourced latitude/longitude and IP-derived geolocation, that it may build historic location profiles and link devices on residential IP addresses into households, and that such data reaches it from its own cookie or from data partners, SSPs, exchanges and clients; it deletes or anonymises personal data within 13 months.6vendor assertionsupported as statedhigh
Blis describes its audience targeting (Dynamic Audience Targeting) as AI trained on seed panels of 'consented personal data' supplied by clients or drawn from Blis's 'first-party real-world consumer behavior data', which then targets combinations of 'approximate geography, content, and context'; it translates census-tract and Vodafone quadkey data to postal districts for activation; how the movement data is collected is not stated.6vendor assertionsupported as statedhigh
Blis's documented activation routes for its audiences are its own DSP, offered managed or self-service on display, native, audio, online video, CTV and DOOH inventory, and, from 17 June 2025, PMG's Alli Marketplace; Blis says it does not mark up media and caps its data fees.6vendor assertionsupported as statedmedium
Foursquare Audience builds segments from past visitation with location-specific high, medium and low frequency buckets, a look-back of up to 18 months (3 to 6 recommended), optional look-alike expansion and reach estimates from a random device sample; its minimum segment size is stated as 5,000 devices in the FAQ and 10,000 devices on the requirements page, and it is priced at US$1.50 CPM 'in most scenarios' against US$0.75 for Proximity.6vendor assertionsupported as statedhigh
Foursquare's eligible-platforms documentation lists 26 activation platforms for Audience across DSPs, social platforms (Meta, LinkedIn, Pinterest, Reddit, Snapchat, TikTok), CTV (Roku/OneView, Samsung Ads), audio (Spotify, SoundCloud (Pandora)) and DOOH (Vistar Media), and the requirements page lists ready-to-use segments in 13 platforms; Vistar's partner page says over 2,300 Foursquare audiences are available in its DOOH DSP.6vendor assertionsupported as statedmedium
GroundTruth's help centre names its location sources as owned-and-operated WeatherBug, direct app partnerships, SDK integrations and the bid-stream, with a single proportion ('90% of our location signals' from the first three) in an article whose body was last edited in April 2018; Vistar Media's partner page describes GroundTruth's audience data as including 'bid stream data'.6vendor assertionsupported as statedmedium
GroundTruth's location guidelines (updated 28 September 2026) define three protected classes that change targeting, audience building and measurement: Consumer-Protected (1-mile minimum; no device-level collection), Healthcare-Protected (0.4-mile minimum for healthcare ads in WA, NY, CT, NV and CA; visits not tracked) and Prohibited (no location targeting; visits not measured), each with a published category list.6vendor assertionsupported as statedhigh
GroundTruth Ads Manager documents four targeting layers as of 23 September 2026: Target Locations (city to precise business address, lat/long or nationwide; 'Pure Geographic' delivery to anyone inside the boundary), Target by Audience (Predictive, Deterministic and Datonics 'Premium' tiers), Target Neighborhoods and Target On-Premise (mobile only; In Store, On Lot, Retail Block, Radial).6vendor assertionsupported as statedhigh
GroundTruth Ads Manager documents six channels (mobile, CTV and OTT, desktop and tablet, audio, DOOH with '1M+' US screens, and direct mail), a $0 minimum spend in its own comparison table, and buys inventory in real-time auctions across a stated 'over 100,000' publishers.6vendor assertionsupported as statedmedium
Outside GroundTruth's own self-serve and managed platform, the only named activation route for GroundTruth audiences found is Vistar Media's programmatic DOOH integration, documented on Vistar's partner page; GroundTruth's help centre mentions PMPs and unnamed DSP partners, and its named integrations (TapClicks, NinjaCat, Agency Analytics, a reporting API) carry reporting, not segments.6vendor assertionsupported as statedmedium
Since the ZeroToOne.AI acquisition, Ads Manager sells 'Predictive AI Audiences' from ZeroToOne.AI's model (called a 'Location Behavior Model' in the help centre and a 'Large Behavioral Model' in the acquirer's release), built from location visitation, interests, transactions, digital engagement and demographics with 24-48-hour to 14-30-day prediction windows, marketed at 'over 90%' (or '90%') predictive accuracy without a published definition or method; the catalogue grew from an 'initial' 40 segments (June 2026) to '1,500+' (October 2026).6vendor assertionsupported with qualificationhigh
At 30 June 2026 InMarket’s privacy policy says it does not sell ‘(in the plain language sense of that word)’ or license to customers personal information containing precise geolocation, while its state-law notice says that in the past 12 months it ‘sold (or shared for interest-based advertising)’ categories including coarse and precise geolocation to Third Party Partners, and it uses precise location to create audience segments and for attribution and measurement.6vendor assertionsupported as statedhigh
InMarket documents sensitive-place handling only as company-level statements: its Ethics Principles say it does not use sensitive location visit data and suppresses and deletes data from sexual and reproductive healthcare providers, it describes a Power to Decide partnership for filtering those locations and NAI membership (a board seat on its home page), and its privacy policy retains precise location for 37 months from collection.6vendor assertionsupported as statedhigh
InMarket Audiences (also ‘Audience Suite’) is sold as 10,000+ syndicated segments, custom audiences, PMPs, GeoType personas built by machine learning on 1,000+ attributes, and, from May 2026 in Basis, RMN audiences and ‘Lift Optimized Audiences’ of known visitors, purchasers and look-alikes; activation is claimed on ‘any’ DSP with Basis the one external DSP route named in the sources opened.6vendor assertionsupported as statedhigh
Vistar's GroundTruth partner page offers, among example US segments, 'Visitors who visited general clinics at least 1 time in the past 120 days nationwide', and neither that page nor Vistar's Services Privacy Notice states a sensitive-place suppression rule.6synthesissupported as statedmedium
Vistar's TTD activation guide says buyers using The Trade Desk can apply audiences 'through Vistar or The Trade Desk': 'Vistar's entire taxonomy is available through both Auction Packages and PMPs' and 'Custom audiences must pass a feasibility check via Vistar's data team (4-5 business days)', while 'Third-party audiences must contain mobile device IDs' when applied in TTD. The Vistar DSP route is documented separately (solutions page; 5 October 2026 release).6vendor assertionsupported with qualificationmedium
Kochava Collective's status at the cutoff cannot be confirmed from kochava.com: the /collective/ URL serves the App Measurement product page with no Collective content, and the FTC's 4 May 2026 release on the stipulated order says Collective Data Solutions 'has taken over Kochava's data broker business' and will be barred from selling, sharing or disclosing sensitive location data without affirmative express consent, with the consent exception limited to data 'used to provide a service directly requested by the consumer'.6, 7direct recordsupported as statedmedium
The Mobilewalla order (Docket C-4811, issued 13 January 2025, finalisation announced 14 January 2025 by 4-1 with Commissioner Holyoak dissenting) adds a ban on collecting or retaining data accessed in online advertising auctions for any purpose other than participating in them, bars use or sale of sensitive location data across ten categories with only a conversion exception (no direct-relationship consent exception), requires deletion of Historic Location Data within 90 days and Data Products within 120 days, and runs 20 years.6, 7direct recordsupported as statedhigh
At the cutoff Mobilewalla documents continued licensing of device-level location-derived data: its business privacy notice (updated 9 January 2026) says it processes 'movement data' that includes MAID, latitude and longitude, IP address and timestamp and visits to commercial locations, that 'During the last year, Mobilewalla has sold personal information it has collected to our Clients and others, including ad tech partners', and that it does not knowingly collect visits to sensitive locations; its site sells Market Insights (mobility patterns), Feature Mart, Audience Segments, Data Enrichment and 'Location-Based Marketing', with no stated precision class for what is sold.6, 7vendor assertionsupported as statedmedium
At the cutoff Kochava's data-broker business operates as Collective Data Solutions, LLC (Sandpoint, Idaho; a co-defendant under the 2026 order), whose site sells 'Data Feeds: License premium data including consumer characteristics, interest & behavior, precision location (protected by Privacy Block)', Audience Targeting and Audience Enrichment, cites '>500M Unique connected devices' and '16M+ Geofenced retail & commercial locations', offers QSR and retail brands brick-and-mortar visitation and competitor conquesting and hedge funds consumer signals, and markets Privacy Block as blocking health clinics, religious institutions and schools; the former kochava.com/collective URL now serves an app-analytics 'Data Management' page.6, 7vendor assertionsupported as statedhigh
Under the preregistered rule H5 is contradicted. Three of the five ordered companies document at the cutoff the sale or licensing of precise geolocation to third parties: Outlogic, Collective Data Solutions for Kochava, and Gravy Analytics trading as Unacast, each in its own current policy or product pages. Mobilewalla documents licensing of device-linked lat/long data but not the precision of what it licenses, and InMarket documents no such product. Compliance with the orders is not assessed.6, 7synthesissupported with qualificationhigh
Foursquare Proximity is a real-time radius geofence with no look-back, delivered to DSPs where 'your ad platform is able to validate that a user is within the radius boundaries of the geofence by matching the lat/long of the impression', and for national Trade Desk segments Foursquare requires a separate New York, Washington and Connecticut set with a minimum 3,000-foot (914 m) radius 'to follow state privacy laws'.6, 7vendor assertionsupported as statedhigh
GroundTruth documents that, for locations in Maryland (from 1 October 2025), Oregon (1 January 2026), Virginia (1 July 2026), New Jersey (8 July 2026) and Connecticut (1 October 2026), Visit Tracking, On-Premise and Neighborhood targeting, radius targeting below 1 mile and audience building from new precise location signals are unavailable, attributing the restriction to state laws on precise geolocation.6, 7vendor assertionsupported as statedhigh
FTC Decision and Order C-4803, issued 29 April 2024 and finalised by a 3-0-2 vote announced 1 May 2024, bars InMarket from selling or licensing precise Location Data for any valuable consideration, and from products that categorise or target consumers on Sensitive Location Data tied to the sensitive locations its own programme identifies (nine categories, Definition I), with a carve-out for compliance use; it excludes coarse data at a radius of at least 1,850 feet and runs 20 years from issuance, extendable by a federal-court complaint alleging violation.6, 7, 8direct recordsupported with qualificationhigh
Foursquare's consumer privacy policy (updated 20 February 2026, effective 22 March 2026) says it receives location from users who opt in to precise or background location in its apps, that SDK and API partners 'may license data to us', that Visits, Audiences, Proximity and Attribution are built from that data, and that as an NAI Precise Location Enhanced Standards participant it does not use or share activity correlated with 13 listed sensitive-place categories; NAI's signatory page (last updated March 2025) lists Cuebiq, Foursquare, InMarket and Outlogic.6, 8vendor assertionsupported as statedhigh
Location Sciences, which signed InMarket as the first (commercial) customer of its Verify Audience platform, audited several InMarket audiences in H1 2020 (department store, big box, QSR, auto, pet, amusement park) and rated them 'Optimal', counting a visit only inside store boundaries; the RNS says the deal followed 'paid for tests across multiple agencies and suppliers' in H1 2020, without saying who paid for InMarket's audits. Scope was announced as up to 1,000 audiences (certifier) or up to 500 segments (InMarket); no later audit, renewal or report was found, although InMarket's 2026 data page still says 'Location Sciences certified'.6, 8commissioned measurementsupported with qualificationmedium
Broadsign Ads' DOOH audience targeting (found in discovery; not in the register) is the only DOOH audience product opened whose documentation names both the mobility supplier and the collection route: Native Touch data 'pulled from active application SDKs and APIs', collected 'from smartphones once audiences enter the defined location boundaries', including 'device IDs, languages, app IDs, age, gender', translated into 6 targeting groups and over 190 personas per screen; no panel size, consent route or region is stated.6, 9vendor assertionsupported as statedmedium
Broadsign's measurement page describes foot-traffic studies that 'track store visits after ad exposure', 'Device ID passback' that 'involves collecting anonymized device data from mobile devices that have been exposed to OOH ads', and case results including Decathlon ('218 digital screens'; 'a 46% total increase in store footfall, delivering an incremental 8 percentage point lift directly attributable to the campaign' against 'non-exposed control groups') and San Diego Tourism via Place Exchange ('a 49.8% net lift in physical visits to San Diego within 120 days'); measurement partners appear as logos only and no control-formation method, panel or provider is documented.6, 9vendor assertionsupported as statedmedium
GroundTruth's DOOH product, launched on 9 October 2025 through Place Exchange, attributes visits by capturing 'mobile device IDs within viewing range of a screen when an ad plays' and reuses those IDs for retargeting; its Blueprints post says DOOH views are counted when a device enters a screen's mapped viewshed 'for the appropriate amount of time', with no time stated.6, 9vendor assertionsupported as statedhigh
Vistar-hosted partner pages name the data behind its US audience partners: GroundTruth 'first-party data, third-party partnerships, and bid stream data'; Adsquare 'spatial data, audience data and mobile location data'; Foursquare segments 'based on historical visitation patterns'; PlaceIQ 'location and purchase data'; InMarket '200M+ location-based users'; none gives proportions or a precision class.6, 9synthesissupported as statedmedium
Vistar's audience guide states that DOOH targeting 'uses aggregated and anonymized location data to identify trends, without ever relying on personal information', while its Services Privacy Notice says the services receive device location histories associated with device identifiers and that Vistar sells and shares personal information.6, 9synthesissupported as statedmedium
Kochava Inc. is an Idaho-based company that the FTC sued in the District of Idaho on 29 August 2022 (describing a data sample covering more than 61 million unique mobile devices in one week and data 'derived from hundreds of millions of mobile devices'); in a release dated 4 May 2026 the FTC announced a proposed stipulated order, filed in the District of Idaho, against Kochava and its subsidiary Collective Data Solutions, 'which has taken over Kochava's data broker business', a move of the data business into a subsidiary.7direct recordsupported with qualificationhigh
The Gravy Analytics/Venntel order (Docket C-4810, issued 13 January 2025, finalisation announced 14 January 2025 by 5-0 after a proposed order announced in December 2024) bans selling, disclosing or using sensitive location data across eight categories (adding military installations) with a direct-relationship consent exception, excludes from 'Location Data' data used for Security Purposes, federal National Security purposes or federal law-enforcement emergencies, and runs 20 years; it does not ban sale of precise location data to commercial customers.7direct recordsupported as statedhigh
FTC v. Kochava (D. Idaho, No. 2:22-cv-00377-BLW) was litigated for almost four years: complaint filed 29 August 2022; first motion to dismiss granted with leave to amend 4 May 2023 (Dkt. 24); First Amended Complaint 5 June 2023; motion to dismiss it denied 3 February 2024 (Dkt. 71); Kochava transferred its data-broker business to subsidiary Collective Data Solutions, LLC, so a Second Amended Complaint naming CDS was filed 15 July 2024 (Dkt. 86); motion to dismiss it denied 3 February 2025 (Dkt. 101); a stipulated order was announced 4 May 2026 (Commission vote 2-0) and entered 25 June 2026 (Dkt. 138).7direct recordsupported as statedhigh
The Kochava order (entered 25 June 2026, 10-year term) requires defendants within 90 days to deidentify or render non-sensitive all Historical Location Data, unless they obtain within that period records showing consumers consented to its collection, use and disclosure. Its definition of Precise Location Data excludes coarse data (radius of at least 1,850 feet) and data used for security purposes, federal national-security purposes, or a law enforcement response to an imminent risk of death or serious bodily harm.7direct recordsupported with qualificationhigh
The widely cited scale of the Gravy breach ("several terabytes", "historical location data of millions of smartphones") is the hacker's claim on a closed-access Russian-language forum, first reported by 404 Media; in the sources read, the only other figure is security researcher Baptiste Robert's statement that the copy of the leaked dataset he obtained held more than 30 million location data points (method unpublished); 404 Media found much of the location data was inferred from IP addresses, and TechCrunch wrote that it is unclear how Gravy derived its data.7synthesissupported with qualificationmedium
In the California Data Broker Registry file (603 registrants that operated as data brokers in 2025; file dated 29 July 2026, downloaded 24 October 2026), Collective Data Solutions, Outlogic, InMarket, Mobilewalla, Unacast, Inc. and Venntel each self-report collecting precise geolocation (115 of the 603 registrants do), and Unacast and Venntel report past-year sale or sharing to the federal government and other state governments. Kochava Inc. is not listed. These are the brokers' own declarations about collection in 2025, not evidence of what they sold at the cutoff.7direct recordsupported with qualificationhigh
On 13 January 2025 (date of the Attorney General's release; the posted petition is unstamped) the Texas Attorney General announced a suit in the District Court of Montgomery County, Texas against The Allstate Corporation, two Allstate insurers, Arity, LLC, Arity 875, LLC and Arity Services, LLC under the Texas Data Privacy and Security Act, the Texas Data Broker Law and the Insurance Code, alleging that Arity paid app developers to embed its SDK (the release names Life360) and collected location and driving-behaviour data from over 45 million consumers nationwide without notice or consent; the state calls it the first enforcement action by a state attorney general under a comprehensive privacy law. These are allegations; the case status at the cutoff was not checked.7direct recordsupported with qualificationhigh
On its home page and privacy policy (updated 30 June 2026), the only InMarket pages read, InMarket documents no product that sells or licenses precise location data to customers: the policy says it does "not sell (in the plain language sense of that word) or license to customers any personal information ... that contains precise geolocation information", while its state-law disclosure says that in the past 12 months it "sold (or shared for interest-based advertising)" categories including "coarse and precise geolocation information" to Third Party Partners.7vendor assertionsupported with qualificationmedium
At the cutoff Gravy Analytics trades as Unacast (its privacy policy opens 'Gravy Analytics, Inc. dba Unacast'; gravyanalytics.com redirects to unacast.com) and documents continued sale of precise location data to third parties: it sells 'Location Data', 'Foot Traffic Data' and 'Data Linkages: connecting MAIDs to hashed emails (HEMs) and IPs', shares customers' 'device's location information, mobile advertising identifier, venues and events you attended', lists 'Precise Geolocation Data' among categories sold in the preceding twelve months, states customers may resell and names 'law enforcement and national security' among customer uses; its subsidiary Venntel sells Location Intelligence, Location Stream and an Intelligence Portal to national-security buyers.7vendor assertionsupported as statedhigh
On 14 January 2026 the FTC announced its final order against General Motors and OnStar, which bans GM for five years from disclosing consumers' geolocation and driver-behaviour data to consumer reporting agencies; the order was proposed on 16 January 2025. It is a connected-vehicle case and lies outside the five location-data companies covered by hypothesis H5.7direct recordsupported as statedhigh
On 13 August 2024 Texas sued General Motors and OnStar under its deceptive trade practices law, alleging that GM collected and sold vehicle driving data, including GPS latitude and longitude, to companies that built driving scores for insurers without drivers' informed consent; GM's quarterly filing of 20 October 2026 says it is defending state enforcement suits, so the claims remain allegations.7direct recordsupported as statedhigh
Arkansas (26 February 2025, Phillips County Circuit Court), Nebraska (8 July 2025, Lancaster County District Court) and Iowa (26 February 2026, Polk County District Court) also sued General Motors and OnStar over the collection and sale of driving data. The Nebraska and Iowa releases name location among the data tracked; for Arkansas, location appears in the complaint (GM collected drivers' location data), not in the release. All three are allegations.7direct recordsupported with qualificationhigh
On 8 May 2026 California's Attorney General, with four county district attorneys, announced a US$12.75 million settlement with General Motors over the sale of Californians' location and driving data to two data brokers (Verisk and LexisNexis Risk Solutions); the Napa County Superior Court entered the final judgment on 12 May 2026 (case 26CV001011).7direct recordsupported with qualificationhigh
On 10 March 2025 California's Attorney General announced an investigative sweep of the location data industry, sending CCPA notice letters to advertising networks, mobile app providers and data brokers; it is an investigation, not a lawsuit.7direct recordsupported as statedhigh
State attorneys general have settled with Google over deceptive location tracking at least six times, with primary releases opened: Arizona US$85 million (4 October 2022), 40 states US$391.5 million (14 November 2022), Indiana US$20 million (29 December 2022), Washington US$39.9 million (18 May 2023), California US$93 million (announced 14 September 2023, subject to court approval at the time) and Texas US$1.375 billion (agreed in principle 9 May 2025, signed as announced 31 October 2025; the Texas sum also resolves incognito-browsing and biometric claims). A District of Columbia settlement (reported at about US$9.5 million, December 2022) was not opened at source.7direct recordcontradictedhigh
On 4 April 2017 the Massachusetts Attorney General settled with Copley Advertising, a Massachusetts company that had geofenced reproductive-health and methadone clinics in five cities outside Massachusetts to serve ads promoting abortion alternatives; under an Assurance of Discontinuance filed in Suffolk Superior Court, Copley agreed not to use geofencing at or near Massachusetts healthcare facilities to infer anyone's health status. The release mentions no payment.7direct recordsupported with qualificationhigh
Texas, Oregon and Vermont keep data broker registers alongside California's; on 24 October 2026 the Texas register's 456 records included Outlogic, Collective Data Solutions, Unacast, Inc. and Venntel but not Mobilewalla, InMarket or Kochava, and Vermont's revised statute, effective 1 January 2027, requires disclosure of precise-geolocation collection. Registration is a filing, not an assurance, and absence from a register does not show that a company is unregistered elsewhere.7direct recordsupported as statedmedium
In the searches logged on 24 October 2026 (the researcher's 14 and the verifier's 8), one US state attorney-general lawsuit against an alleged location data broker was found for 2023 to 2026: Texas v. Allstate and Arity (filed 13 January 2025, Montgomery County), which pleads a Texas Data Broker Law count against Arity alongside TDPSA claims over location data collected through app SDKs, and which remains in litigation. No state attorney-general lawsuit against an advertising-technology company over location data was found. The other state actions found concern a carmaker (General Motors), a platform (Google, including Washington's May 2023 settlement) and a 2017 advertiser case, plus California's 2025 sweep.7synthesiscontradictedmedium
The order requires InMarket to delete Historic Location Data collected through its own apps within 90 days of the effective date, to delete, deidentify or render non-sensitive Historic Location Data collected from third parties within 120 days, to delete audience segments built from Historic Location Data within 120 days, and to run a Sensitive Location Data Program (within 90 days of issuance) and an SDK Supplier Assessment Program confirming consent for SDK-supplied data.7direct recordsupported as statedhigh
Placer documents sensitive-place suppression at product level: it says it does not knowingly sell or provide data on military facilities, PreK-12 schools, places of worship, rehabilitation centres and women's health facilities, and it names Washington's My Health My Data Act and Nevada SB370 as reasons it withholds property, chain and industry reports for in-person health-care locations in those states.7vendor assertionsupported as statedhigh
FTC Decision and Order C-4810 against Gravy Analytics, Inc. and Venntel, Inc., issued 13 January 2025 after a complaint and proposed order announced on 3 December 2024 and a 5-0 final vote announced on 14 January 2025, bans selling, sharing or using Sensitive Location Data tied to the sensitive locations the companies must identify (eight categories, with narrow exceptions), bars collecting or using any Location Data without a consent record from 90 days after the effective date, requires a Supplier Assessment Program, and requires deletion of Historic Location Data within 60 days unless, within 90 days, consent records are obtained or the data are deidentified or rendered non-sensitive; it runs 20 years from issuance (or from any later federal-court complaint alleging a violation); respondents neither admit nor deny the allegations.7direct recordsupported with qualificationhigh
On 24 October 2026 Unacast markets "Privacy-friendly device-level location data for areas of interest globally" from "more than 1 billion monthly devices across 180+ countries from 15+ suppliers", and its pricing page offers "Access to granular, deduplicated, and cleaned device-level data" for the "US & International".7vendor assertionsupported as statedhigh
Gravy Analytics told Norway's Datatilsynet it was informed on 4 January 2025, by the intruder, of unauthorised access to its AWS storage apparently through a misappropriated access key, that "some files" were obtained and processing was operational again by 9 January 2025; Unacast's Texas registration, submitted 9 January 2026, adds that a small subset of copied data, "covering primarily a few days around New Year's 2025", was briefly posted on a dark web forum.7vendor assertionsupported as statedhigh
In the California Data Broker Registry download of 24 October 2026, Unacast, Inc. and Venntel, Inc. (both Ashburn, Virginia) each answer Yes to collecting precise geolocation and to sharing or selling data to the federal government and to other state governments in the past year, and No to sharing with law enforcement except under subpoena or court order; Unacast reports 561 delete requests, all complied with in whole.7direct recordsupported as statedhigh
Unacast's sensitive-location controls are documented only as assertions: PrivacyCheck "ensures that data generated by consumer mobile devices while visiting sensitive locations is never used, shared, or resold" and "All products remove data from sensitive locations", with no category list on the pages read, while the FTC order defines eight categories of Sensitive Locations.7synthesissupported as statedmedium
NAI's Precise Location Enhanced Standards were first issued on 22 June 2022 with Cuebiq, Foursquare and Precisely PlaceIQ as signatories. They were reissued 'Updated and effective October 2024', and the PDF's signatory page, 'Last updated March 2025', shows four logos: Cuebiq, Foursquare, InMarket and Outlogic. Within US activities they bar using or transferring activity correlated to a known Sensitive POI (11 definitive and 2 non-definitive categories) and law-enforcement, national-security or bounty-hunting uses, subject to section IV's exceptions for consented direct-relationship services, blocking directories, technical providers and compliance processing.7, 8direct recordsupported with qualificationhigh
The FTC's X-Mode Social/Outlogic order (Docket C-4802, issued 11 April 2024 after a proposed settlement announced in January 2024; final approval 3-0-2 announced 12 April 2024) bars selling, licensing, transferring, sharing, disclosing or using sensitive location data, with a direct-relationship consent exception, and runs 20 years; it does not ban sale of precise location data as such.7, 8direct recordsupported as statedhigh
At the cutoff Outlogic (X-Mode's successor) documents continued sale of precise location data to third parties: its site says the company may 'receive and sell the precise latitude and longitude coordinates of your mobile device', offers data 'to License Via Data Exchanges, Platform Partnerships, or directly to you' with observation and attribution delivery through Snowflake, AWS S3 and a REST API and audiences through Eyeota and Adsquare, claims 'No Bidstream Data', and states in its January 2026 privacy notice that it collects and sells precise geolocation while filtering sensitive health-based locations in specific states.7, 8vendor assertionsupported as statedhigh
Virginia bans the sale of precise geolocation data: Code of Virginia 59.1-578(A)(6), added by 2026 Acts ch. 820 (SB 338, approved 13 April 2026, effective 1 July 2026), requires a controller to "not sell or offer for sale precise geolocation data concerning a consumer", with no consent exception; other processing of sensitive data, including precise geolocation, still requires consent under 59.1-578(A)(5).7, 12direct recordcontradictedmedium
New Jersey P.L.2026, c.25 (A5328 1R), approved and effective 30 June 2026, amends N.J.S.A. 56:8-166.12(a)(6) so that no controller may sell sensitive data regardless of how many consumers' data it controls or processes, and separately bars any data broker or data collector from selling or licensing sensitive data; sensitive data includes precise geolocation data defined by a 1,750-foot radius, with no consent exception, making it a flat ban on sale of precise geolocation alongside Maryland's.7, 12direct recordsupported as statedhigh
The 2017 guidelines cover the assignment of device and user location for physical visitation and ad exposure on mobile and static devices (desktop, connected TV, OTT), place measurement as the reference for visitation and location targeting, and a benchmark for voluntary third-party audit; they are guidance and a benchmark, not a certification.8direct recordsupported as statedhigh
The guidelines require a fully disclosed universe for projections and, where vendors set minimum reporting thresholds, disclosure of them; they say vendors should disclose the share of each assignment method where methods are mixed, whether assignment is probabilistic or deterministic, editing volumes above about 5% of records, and should retain detailed data for at least one year.8direct recordsupported with qualificationhigh
The guidelines recommend, but do not require, annual third-party certification of every digital location-based measurement product used in buying and selling, and the document itself notes that at the time some US location products 'have been accredited by the MRC in some fashion'; conformance to the guidelines ('built to MRC guidelines') and MRC accreditation are therefore distinct states, and only the latter appears on MRC's lists.8direct recordsupported as statedhigh
The guidelines require clear opt-in for location collection, permission prompts on mobile web and in apps (re-requested when the user changes the device setting), and a privacy policy stating why location is collected and how it is shared, and point audited services to the IAB 2016 publisher guide, the DAA principles and the NAI Code.8direct recordsupported as statedhigh
On 24 October 2026, none of MRC's six accredited-services lists and none of its five under-review lists carries a visit, visitation, foot-traffic or location-determination metric. The closest under-review entries are Kevel's 'Conversions and incrementality' and Kroger's attributed and incremental sales. MRC's April–June and July–September 2026 communications record no location or visit action, and the Out-of-Home and Outside-the-U.S. accredited lists are empty.8direct recordsupported with qualificationhigh
Foursquare's Visits data set was granted MRC accreditation in July 2020 for 'location information reported in Visits data set', suspended in October 2022 and revoked in December 2022 (MRC communications of 13 October 2020 and 24 January 2023); Foursquare said its Attribution product was not audited. MRC's own September 2018 presentation already reported one accredited location service among six applicants without naming it, so the 2020 grant is not established as the first location accreditation.8direct recordsupported with qualificationhigh
GroundTruth's 'Location, Place, and Visit data set' was granted MRC accreditation in July 2021 and placed on a six-month hiatus at GroundTruth's request in September 2023. MRC's communication of 26 July 2024 reports its accreditation revoked following withdrawal from the accreditation process; the row is labelled February inside the April-June report, so the effective month is unconfirmed. GroundTruth's 2021 release claiming the accreditation is still online.8direct recordsupported with qualificationhigh
Epsilon holds the only accredited 'outcomes' metric on MRC's Digital list, 'Correlated Outcomes (online and offline)' in desktop, mobile web and mobile in-app, continued by letter of 1 October 2025; the letter cites the Minimum Standards, IVT 2.0, the Data Integration Guidelines and the IAB and MRC impression guidelines, not the Location-Based Advertising Measurement Guidelines, and does not define 'offline' outcomes as store visits, so the entry does not satisfy H6.8direct recordsupported as statedhigh
IAB's location-data guidance found by the cutoff runs from the gated 'Mobile Location Data Buyer's Guide' (July 2014) and the February 2016 'Mobile Location Data Guide for Publishers' to the April 2017 'Location-based Marketing Playbook for Retailers'. The playbook is buyer-facing and asks whether device data come 'through panels or pass through ad exchanges' and how store-visit-lift control groups are selected. It cites 'IAB Marketing ROI and Location Data' (February 2015) and '12 Questions Every Buyer Should Ask about Location Data'. No IAB or IAB Tech Lab location guide later than April 2017 was found in the sources screened.8direct recordcontradictedmedium
On 24 October 2026 Blis does not appear on MRC's Accredited Services: Digital list, its Services Under Review: Digital list or its accreditation landing page, so no Blis visit, lift or input metric is MRC-accredited or under MRC review in the sources screened.8direct recordsupported as statedhigh
On 24 October 2026 MRC's Accredited Services: Digital list and its Services Under Review: Digital list contain no entry for Foursquare or Placed, and the Out-of-Home accredited and under-review pages returned no readable list of services; this review found no current MRC accreditation or audit for any Foursquare product in the MRC sources screened.8direct recordsupported as statedmedium
MRC granted accreditation to 'GroundTruth's Location, Place, and Visit data set' in July 2021, as recorded in its communication of 20 October 2021; the scope is a data set, not a visit-lift or attribution metric.8direct recordsupported as statedhigh
MRC granted GroundTruth a six-month accreditation hiatus at its own request in September 2023, during which the service was not accredited, and later recorded the accreditation as revoked after the hiatus 'due to withdrawal from the MRC accreditation process' in a row labelled 'February' in its April-June 2024 communication dated 26 July 2024; the October-December 2023 and January-March 2024 communications carry no GroundTruth row, so the effective month is unconfirmed.8direct recordsupported as statedhigh
At 24 October 2026 GroundTruth appears on neither MRC's Accredited Services: Digital list nor its Services Under Review: Digital list, so no GroundTruth visit or visit-lift metric holds or is in process for MRC accreditation at the cutoff.8direct recordsupported as statedhigh
GroundTruth's own pages still present the MRC accreditation as current: its 3 August 2021 release remains online (page modified 4 February 2026) with no hiatus or revocation notice, and a comparison page last modified 9 November 2023, after the September 2023 hiatus began, states in present tense that GroundTruth is 'Accredited by the Media Rating Council (MRC) for our Place, Location, and Visitation datasets' and that 'The accreditation validates our accuracy of place-based visits.'8synthesissupported with qualificationhigh
On 24 October 2026 neither MRC’s Accredited Services: Digital list nor its Services Under Review: Digital list carries InMarket, NinthDecimal or any InMarket visit or lift metric; InMarket’s assurance claims (Comscore verification, Location Sciences certification, a Forrester TEI) are not accreditations.8direct recordsupported as statedhigh
No MRC accreditation, audit in progress or independent data-quality certification of Placer's visit metrics was found: Placer does not appear on MRC's accredited or under-review digital and out-of-home lists on 24 October 2026, and its documented certifications are information-security ones (ISO/IEC 27001:2022, SOC 2 Type II as stated by Placer, and a CSA STAR Level 1 self-assessment listed since 21 July 2026).8direct recordsupported as statedhigh
No Unacast or Gravy product appears on MRC's Accredited Services: Digital or Services Under Review: Digital lists on 24 October 2026; Unacast's privacy policy cites NAI membership "in good standing" with "annual reviews", a self-regulatory status with no public product-scoped result.8direct recordsupported as statedhigh
IAB's 'Digital Out-Of-Home (DOOH) Measurement Guide' was published in July 2025 (8 July per IAB's blog); IAB's page gates it, but the full PDF is publicly retrievable and was read in the final live sweep. It covers OTS and LTS impression types and dwell time, recommends synthetic-control and matched-market or matched-store tests for incrementality, and describes geo holdouts as a way to reduce control-group contamination (pp. 23-24).8, 9direct recordsupported with qualificationmedium
MRC's Out-of-Home Measurement Standards, Phase 1 & 2 Combined, Final December 2025 (developed with DPAA, Geopath and OAAA after public comment) treat location data as a foundational element where persons are not measured directly, require measurement services to ascertain the accuracy of third-party data with disclosure when a source cannot be independently verified, name 'mobile location' among deterministic inputs for adjusting likelihood-to-see to audience, and in their attribution section require a measurement organisation to collect at least a portion of characteristics directly; the 2017 Digital Place-Based Audience Measurement Standards (Version 1.0 Final, 15 March 2017) remain listed alongside them.8, 9direct recordsupported as statedhigh
At 24 October 2026 MRC's Out-of-Home accredited list is empty, the only OOH service under review is JCDecaux's Proof of Plays metric, and Geopath appears on no MRC list opened; the US out-of-home audience currency is therefore not MRC-accredited at the cutoff in the sources screened.8, 9direct recordsupported as statedhigh
Geopath's methodology overview states that it is not designed to provide a comprehensive statistical validation of Geopath data and reports no confidence intervals, referring such requests to its data science team.8, 9vendor assertionsupported as statedmedium
Geopath releases its audience estimates as annual planning datasets: the 2026 planning dataset went into preview on 30 September 2026 and, per Geopath's 19 October 2026 post, becomes the default transactional planning dataset on 12 November 2026 (a plan at the cutoff); that later post names Bentley Systems as Geopath's roadside data provider and says the 2026 dataset uses 'updated data sources' without listing them.8, 9direct recordsupported with qualificationhigh
Geopath's own 'Our Organization' page states it was 'Established in 1934' as 'the Traffic Audit Bureau for Media Measurement Inc.' and 'is a not-for-profit organization governed by a tripartite board' 'comprised of advertisers, agencies, and media companies'; the 1934 founding year conflicts with the 1933 used in the brief and in the author's essay.8, 9direct recordsupported as statedmedium
On 24 October 2026 Vistar had no entry on MRC's Accredited Services: Digital or Services Under Review: Digital lists, and MRC's Out-of-Home accredited and under-review pages returned no listed services, so no Vistar visit, lift, audience or impression metric was found to hold or be under MRC accreditation in the pages screened.8, 9direct recordsupported as statedmedium
The non-agentic baseline is further along than any agentic protocol: OpenRTB 2.6 defines a Geo object (lat, lon, type, accuracy, lastfix, ipservice, country, region, metro, city, zip, utcoffset) plus DOOH venue types and a qty impression multiplier, and Google Authorized Buyers documents production bid requests in which geo type is always set to IP (2) and accuracy reflects coarse IP-based geolocation, i.e. documented production use of coarse, inferred location rather than device-observed location.8, 10direct recordsupported as statedhigh
Geopath's public methodology documentation consists of Confluence pages: a 'Media Measurement Methodology Overview' (published 31 May 2023) naming Streetlytics and HERE road data and a mobile device panel; an 'OOH Measurement Methodology' index (last updated 11 August 2025) listing a 'Geopath Visibility Model 2021.11' and monthly release schedules for 2025 and 2026; a 'Mobile Device Location & Movement Patterns' page (31 May 2023) stating that source data from multiple location SDK aggregators covers more than 100 million unique US devices a month, that Intermx culls it to a sample of seven to ten million qualified devices a week, that records carry device ID, UTC timestamp, coordinates and horizontal precision in metres, with imprecise sightings removed under no stated numeric threshold; and a 'Movement Patterns' page (31 May 2023) recording AirSage-supplied origin-destination matrices for the 2019-2020 methodology and a 2021 expansion contracted to Standard Data.9vendor assertionsupported as statedmedium
Geopath's methodology documentation, published 31 May 2023, names MotionWorks device panels, Teralytics/Streetlytics and HERE Maps for roadways, HERE Maps for vehicle travel, and government agencies, MotionWorks and Claritas for demographics, with no proportions. That list is as documented in 2023: Geopath's 19 October 2026 post names Bentley Systems as its roadside data provider, and its 2026 Planning Dataset, which credits 'updated data sources' for pedestrian-impression changes, becomes the default only on 12 November 2026, after the cutoff.9direct recordsupported with qualificationhigh
Geopath's Mobile Device Panel page (31 May 2023) describes a weekly panel of GPS-sighted devices, active about eight hours a day with a consistent Census Block Group home, culled by Standard Data, and illustrates it with a 2020 example (19.5% of devices, 78% of locations). A companion 31 May 2023 page says the feeds cover 'more than 100 million unique devices in the United States every month' and that the sample is 'between seven and ten million qualified devices each week'. That is a documentation-dated disclosure with no stated observation vintage, not a current audited panel count.9direct recordsupported with qualificationhigh
Geopath's core outputs are 'likelihood-to-see impressions', audience composition and reach and frequency; opportunity-to-see counts are adjusted by its proprietary 'visual acuity index' (VAI) model for the probability of noticing the unit, audience composition is assigned by treating a device's longest-dwell location as its home and applying census-block demographics, and composition is computed as an annual average broken down by hour of day.9direct recordsupported as statedhigh
Between the 31 March 2026 release and the cutoff, this review found no Geopath or Ipsos document describing the pilot's data sources, panel or method in the sources screened: Ipsos's OOH Media Con session page (12 May 2026) refers to 'the groundbreaking OAAA/Geopath/Ipsos pilot' without method, and Geopath's homepage news list and its 30 September 2026 dataset post do not mention the pilot.9inferencesupported as statedlow
OpenRTB 2.6's Qty object carries 'multiplier' (float; required: the quantity of billable events deemed to occur, e.g. 'a DOOH opportunity may be considered to be 14.2 impressions'), 'sourcetype' (integer; recommended) and 'vendor' (string, 'required if sourcetype is present and type = 1': 'The top level business domain name of the measurement vendor providing the quantity measurement'); AdCOM's 'DOOH Multiplier Measurement Source Types' list enumerates 0 Unknown, 1 Measurement Vendor Provided, 2 Publisher Provided and 3 Exchange Provided; neither document records the vendor's mobility source, panel or method, and neither enumerates multiplier vendors.9direct recordsupported as statedhigh
WOO's PwC-aggregated study, announced 5 June 2026, puts global programmatic DOOH at 'approximately $1.4 billion in revenue globally in 2025 — equivalent to 7% of total DOOH expenditure' ('$1.339 billion in 2025' in a quoted figure), from data submitted by 11 participating SSPs (the page lists 12 names), with the Americas at $670m and 14.2% penetration, EMEA $521m and 9.4%, APAC $149m and 1.7%; PwC 'has not independently verified the information which it received from respondents', and the announcement says nothing about audience or mobility data, so it does not bear on mobility-based buying.9commissioned measurementsupported as statedmedium
The IAB published its DOOH Measurement Guide on 8 July 2025; IAB's page gates it behind a free account, but the 31-page PDF is publicly retrievable and was read in the final live sweep (24 October 2026). It recommends two methods for incrementality, synthetic control and matched-market or matched-store testing (p. 24), says that blending synthetic models with geo-based holdouts can reduce contamination of the control group, and lists control groups and A/B testing with geo holdouts as baselines for foot-traffic lift (p. 23).9direct recordsupported with qualificationmedium
Vistar Media's partner page for InMarket documents DOOH foot-traffic and sales attribution 'Powered by SDK-based location data from nearly 200M+ permission-based users' and 'transaction insights from over $2.5T+ anonymized commerce transactions' (the same page also says '~$122B+ verified transactions'), through a process in which 'The target audience is first exposed to Vistar advertising campaigns', 'InMarket then identifies the exposed audience and qualifies users who visited a retail location and/or completed a purchase' and 'LCI® quantifies the incremental lift in both visits and sales'; no control-group design, panel period or definition of 'users' is given.9vendor assertionsupported as statedmedium
On 11 February 2020 Vistar Media announced Foursquare as a DOOH measurement partner, combining Vistar's exposure data from 'direct integrations with more than 70 media owner networks' with 'Foursquare's location data' and the 'Placed powered by Foursquare attribution methodology' so that 'brands can analyze lift in foot traffic that was driven by DOOH media'; the release describes no control design or panel size.9vendor assertionsupported as statedmedium
Vistar Media's June 2023 partnership with Adsquare gives Vistar 'SDK-derived location data from Adsquare' to score poster locations, starting in EMEA and extending to the US, Canada and Australia. Vistar's partner directory lists 37 partners with role tags (audience segments, point-of-interest data, foot traffic, sales lift, device-ID passback) and region tags, and Vistar-hosted partner pages state the data behind several US audience partners: GroundTruth (first-party, third-party and bid-stream data), Adsquare (mobile location data), Foursquare (visitation-based segments), PlaceIQ (location-based segments) and T-Mobile (app-ownership data from devices on its network). None of these pages gives a panel size or period.9vendor assertionsupported with qualificationmedium
Place Exchange's 2026 sales presentation (now 'part of the Broadsign family') says 'PerView uses daily updated mobile data to calculate up-to-date reach, frequency, and impression metrics for any set of OOH assets', that its 'patented process of capturing exposed mobile IDs for consumers in the viewshed of every screen at the time of ad play' supplies exposure data for targeting and measurement, that it has 'preconfigured 15+ industry-leading measurement partners enabling server-to-server data', and that buyers can 'Plan against over 5,000 actionable data segments'; no mobile-data provider, panel size or partner name is given.9vendor assertionsupported as statedmedium
GroundTruth's DOOH attribution, announced on 9 October 2025 with Place Exchange, 'captures mobile device IDs within viewing range of a screen when an ad plays' and checks whether those devices later visit a store, using GroundTruth's own 'location and purchase data'; the release cites an omnichannel (DOOH plus mobile) belVita campaign credited with 221,000 Target store visits in one month at a 3.44% visitation rate, and a separate Place Exchange campaign for an unnamed national retailer with over 42,000 visits from exposed consumers in New York, Chicago and Los Angeles, 'more than half' called incremental with no control design described; captured IDs are reused for retargeting.9vendor assertioncontradictedmedium
Hivestack's footfall lift study for Zoom Media UK x Gillette (London campaign, 1-30 November 2022; 115 screens; 4,001,001 delivered impressions) defines the exposed group as 'MAIDs observed within a screen geofence when advertiser ad was playing' and the control group as 'MAIDs observed within a screen geofence when advertiser ad was not playing', reports a '2.12x lift' in exposed-versus-control visitation, 8,574 'Modeled incremental walk-ins' and a cost per incremental visit of £2.28, and scales walk-ins so that 'Modeled walk-in is multiplied based on ratio of data partner access to phones vs total GB population'; the data partner is unnamed and the control is a non-randomised time-split comparison, not a holdout.9vendor assertionsupported as statedmedium
Perion's DOOH page (2026 copyright; hivestack.com redirects to perion.com) says 'Perion connects campaign playlogs with anonymised device-level location data' and offers footfall lift 'comparing exposed audiences with a matched control group' without naming a data provider or matching method; an undated Perion blog says platforms 'like Perion' have pre-integrated partnerships with third-party footfall providers it names (Foursquare, Cuebiq, PlaceIQ, Adsquare) and advises partners to use matched-market or propensity-score matching, without saying which provider or method Perion's own product uses.9vendor assertionsupported with qualificationmedium
Route, the Great Britain out-of-home Joint Industry Currency for adults 15+, combines passive GPS tracking of a recruited, consented sample with volumetric counts and Lumen eye-tracking data; its People page discloses c.7,000 participants a year and 25,420 people's journeys collected September 2018 to February 2020 and September 2022 to September 2024, recruited and processed by Ipsos; it does not use a third-party smartphone SDK panel.9direct recordsupported with qualificationmedium
COMMB describes itself as 'the national not-for-profit organization for the Canadian out-of-home (OOH) industry' that is 'developing proprietary audience measurement methodologies for a variety of OOH media formats', with a Research Committee that 'approves all COMMB methodologies for outdoor, place-based, moving media etc.'; its public site is client-rendered and no methodology page with data sources could be read by the cutoff, so COMMB's mobility sources are coded 'not disclosed' in this review.9direct recordsupported as statedlow
Lamar Advertising received US$115.1 million in cash at the 3 February 2025 closing for its 20% equity interest in Vistar Media, with up to a further US$15.1 million payable on release from escrow (8-K Exhibit 99.1, 20 February 2025).9direct recordsupported as statedhigh
At the 13 January 2025 announcement, Vistar was to join T-Mobile Advertising Solutions at about US$600 million in cash, and the parties described a global network of more than 1.1 million digital screens from nearly 370 OOH media owners serving more than 3,000 advertisers.9vendor assertionsupported as statedmedium
Vistar's partner directory (37 cards, read 24 October 2026) tags 18 partners for audience segments in the USA and six USA-tagged foot-traffic measurement partners (Accretive, Arrivalist, Cuebiq, Foursquare, InMarket, Spotzi), while Lifesight is tagged only for Canada and APAC and Locala only for Canada.9synthesissupported as statedmedium
Vistar's InMarket partner page markets LCI for DOOH as measuring 'incremental lift in both visits and sales', 'Powered by SDK-based location data from nearly 200M+ permission-based users', with no control design, period, geography or definition of users, and the same page gives two different transaction figures (~$122B+ and $2.5T+).9vendor assertionsupported as statedmedium
Vistar has sold DOOH foot-traffic studies through rotating third parties since at least January 2019 (a suite with NinthDecimal, MFour, Cuebiq and PlaceIQ, with Factual also in the subhead) and added Foursquare on 11 February 2020, when it also claimed 'in-house' foot-traffic measurement.9vendor assertionsupported as statedmedium
Audience impressions reported in The Trade Desk for Vistar DOOH are, per Vistar's TTD guide, 'the result of impression multiplier calculations provided by SSPs & media owners (these are commonly sourced from verification partners like Route and Geopath)', while plain impressions count ad plays; the 2022 case says exposure for studies uses 'ad log timestamps, device location, venue type and screen location'.9vendor assertionsupported with qualificationmedium
Vistar's Services Privacy Notice (last updated 1 July 2026) says it may receive device location histories tied to device identifiers from clients, data suppliers and measurement partners, processes those histories as a CCPA 'business' while providing advertisement measurement as a 'service provider', does 'sell' and 'share' personal information, uses the data to learn whether exposed devices are more likely to visit locations, discloses device location histories to service providers, and does not share them with clients, advertising intermediaries or market research companies.9vendor assertionsupported with qualificationhigh
Vistar Media Inc. is on California's 2026 Data Broker Registry (2025 activities; last updated 29 July 2026) and declared 'Yes' to collecting consumers' precise geolocation, 'No' to reproductive health care data and 'No' to sharing or selling data to foreign actors, federal or state governments or law enforcement. In the 2025 registry file it is listed as Vistar Media, Inc. and declared 'No' to collecting precise geolocation; it was not found in the 2024 file.9direct recordsupported with qualificationhigh
The FCC's Forfeiture Order against T-Mobile USA (adopted 17 April 2024, released 29 April 2024) imposed US$80,080,000 for failing to take reasonable steps to protect customers' location information; the D.C. Circuit denied review on 15 August 2025 and rehearing on 23 January 2026, and the carriers' certiorari petition (No. 25-1422) was distributed on 14 October 2026 for the 6 November 2026 conference.9direct recordsupported as statedhigh
Vistar's 23 September 2026 'store locator effect' study, run by its Creative Studio with Omnicom Media and Annalect, randomised 7,200 consumers aged 18-59 in the Netherlands (February to April 2026) to a control creative or one of three store-locator placements and reports stated visit and purchase intent (for example 9% higher visit intent versus control for bottom placement in retail and QSR); it measures intent, not visits, and is not US.9vendor assertionsupported as statedmedium
AdCP v3.2.6 represents DOOH delivery and visit outcomes in its delivery-metrics schema: a top-level plays count, a dooh_metrics block (loop_plays, screens_used, screen_time_seconds, sov_achieved, calculation_notes and a per-venue venue_breakdown with venue_id, venue_type, impressions, loop_plays and screens_used), a measurement_source slug whose examples include geopath and route, an experimental ooh_metrics block whose estimated_impressions carry a currency_measured or seller_modeled tier, and a foot_traffic metric defined as incremental visits over baseline that is qualified by attribution_methodology (panel_based, deterministic_purchase, probabilistic, modeled) but carries no field declaring the control design.9, 10direct recordsupported as statedhigh
AdCP v3.2.6 represents venue identifiers for DOOH: placement identifiers accept the types venue_id, screen_id and openooh_venue_type and authority-prefixed external IDs (the schema's example is geopath:30961), DOOH placements declare slot and loop durations, and the experimental static-OOH panel identifiers accept a geopath Spot ID scheme; the sales_dooh compliance specialism tests a seller exposing a venue_id and reporting plays and dooh_metrics.9, 10direct recordsupported as statedhigh
Of six DOOH footfall-attribution products or cases screened (four US, one UK, one global), none documents a randomised or holdout control: Hivestack's 2022 UK study compares passers-by at the same screens when the ad was and was not playing; Perion asserts 'a matched control group' without method; Broadsign cites 'non-exposed control groups' without method; Vistar's InMarket and Foursquare pages and GroundTruth's Place Exchange release describe no control (GroundTruth calls 'more than half' of a national retailer's 42,000 exposed-consumer visits incremental without a comparator). Coded 0 randomised or holdout, 1 matched asserted, 2 unexposed comparisons, 3 not disclosed.9, 12synthesissupported with qualificationmedium
Identifier-based place targeting (geo_places, geo_places_exclude) entered AdCP through PR #6093, merged on 15 August 2026, first published in the pre-release 3.2.0-beta.0 (17 August 2026) and first in a stable release in 3.2.1 (1 October 2026); it keys places by stable IDs in a declared system (geonames, google_ads, microsoft_ads or an owner HTTPS URI) and a place_type drawn from administrative units plus airport, so its registered vocabulary names places such as cities and neighbourhoods rather than store-level points of interest, and the PR explicitly defers place-level forecasting and delivery breakdowns.10direct recordsupported with qualificationhigh
An implemented AdCP connector maps administrative geo targeting into an ad server: the Prebid Sales Agent v2.0.0 (1 July 2026), built against AdCP spec 3.1.0-beta.3 (adcp Python SDK 5.7.0) rather than 3.2.6, translates geo_countries, geo_regions and geo_metros (Nielsen DMA only) and their exclusions into Google Ad Manager targetedLocations, but rejects geo_postal_areas with an explicit error ('not implemented in GAM static mapping') and contains no handling for geo_proximity, store_catchments or geo_places in the targeting manager read.10direct recordsupported with qualificationhigh
The strongest public claims of location signals in agent-driven AdCP buys are vendor releases that do not record the signal or the protocol version: PubMatic and Butler/Till (15 December 2025) describe an AdCP-enabled CTV campaign for Clubtails "delivering geo-targeted, premium CTV inventory" without naming a field or geographic unit, and Broadsign (27 May 2026) describes a Netherlands OOH campaign in which agents using AdCP informed "audience and venue targeting" without naming identifiers or delivery metrics; neither reaches documented production use of a named location signal under H7's rule.10vendor assertionsupported as statedmedium
IAB Tech Lab's AAMP components represent geography only as coarse codes at schema level: OpenProposal 3.0 draft 1 (published for comment 22 September 2026) gives the targeting envelope a settable geo object with an allowed[] list of geo codes, iab-agentic-primitives 0.5.1 (a pre-release) gives packages geo_targets as ISO 3166-2 codes and linear-TV quotes Nielsen DMA codes, and the reference seller-agent 2.4.2 carries geo_targets in its media kit, but a grep of its ad-server clients found no mapping of geo_targets into Google Ad Manager geo targeting even though its GAM model declares a geoTargeting field.10direct recordsupported as statedmedium
ARTF 1.0 (released 12 November 2025) carries location only inside the embedded OpenRTB 2.x BidRequest that agents receive; its eight mutation intents (activate segments, activate or suppress deals, adjust deal floor or margin, bid shade, add metrics, add content IDs) include none specific to geography, so an ARTF agent can read device.geo and could activate a location-derived audience segment by segment ID, but has no standard intent to change or add a geographic field.10direct recordsupported with qualificationhigh
Among location vendors, this review found agent interfaces only outside agent-driven buying: Foursquare publishes an MCP server (created January 2025, last pushed April 2025) whose tools search places and snap coordinates to Foursquare place IDs; Mapbox publishes an MCP server (v0.16.0, 15 October 2026) for geocoding, POI search and isochrones; Radar runs a public documentation MCP endpoint and, announced 14 October 2026, an authenticated enterprise pilot with read-only tools over a customer's own location records; and Placer.ai documents an enterprise MCP server, Pi for Placer MCP, whose page was updated 22 October 2026. No MCP server or AdCP agent was found for GroundTruth, Blis, InMarket or Vistar Media, and none of these vendors appears among the 34 agents in the AAO registry.10synthesissupported with qualificationmedium
Inference for H7 at 24 October 2026: across AdCP (3.2.6 schema; the only connector found is built on 3.1.0-beta.3), AAMP components, ARTF 1.0 and the location-vendor interfaces screened, the highest documented state for any location signal in open-protocol agent-driven buying is an implemented connector (AdCP administrative geo to Google Ad Manager in the Prebid Sales Agent v2.0.0, AdCP 3.1.0-beta.3); geographic cells reach no state, geo_proximity, store catchments, geo_places, venue identifiers, DOOH metrics and foot_traffic reach schema representation only, no interoperability test result is public, the two vendor-claimed agentic AdCP campaigns do not record a location field, and proprietary DOOH seller agents reached over MCP (VIOOH, Displayce) claim geographic and proximity handling without naming fields or reporting a transaction, so H7 is unresolved under its registered rule.10inferencesupported with qualificationmedium
Radar runs two MCP servers: the public docs.radar.com/mcp endpoint serves documentation search and retrieval (plus a docs-feedback tool), and an authenticated server at mcp.radar.com/mcp, announced 14 October 2026 and in pilot for enterprise customers by request, gives AI assistants read-only tools to query a customer’s own location records (query_data, get_query_page, render_locations_map); Radar pitches it for fraud investigation, operations and building first-party audience exports, and neither server is an advertising-transaction interface.10vendor assertionsupported with qualificationmedium
In the public AAO agent registry on 24 October 2026, none of the 34 registered agents shows a passing geo or DOOH conformance test: geo_region_targeting, geo_region_all_values_support, geo_region_exclusion_support and geo_place_targeting appear only on the two agents graded on AdCP 3.2.6 (goTom Sandbox and Publink) and are untested (0/0 steps) on both, no agent declares the sales-dooh specialism, and the 11 agents holding a verified badge hold it only in spec mode, none in the live-traffic mode.10, 13direct recordsupported with qualificationmedium
Seven scored products carry the author's privacy risk cap because a regulator order, entered judgment or confirmed breach involving their location data falls inside the three years before the cutoff: InMarket's measurement and audience products, Mobilewalla's audiences, Unacast's foot-traffic and device-level data, Collective Data Solutions' feeds and Outlogic's Observation Panel. Kochava's DOOH measurement keeps the order as an event flag without the cap, because no link between the order and that product's data is established. With the cap removed and each cohort's field mean recomputed, the seven Ground Quotients rise by 2 to 5 points. Three would move up a band (InMarket visit-lift measurement and Outlogic Observation Panel from Partly to Well documented, Mobilewalla audiences from Least to Partly documented), and two uncapped products would move down as their cohorts' field means rise (Placer.ai from Most to Well documented, Veraset from Well to Partly documented).11synthesissupported as statedhigh
On 5 October 2026 Vistar announced enhanced T-Mobile audience segments for DOOH (thousands of segments on an 'expanded universe of consented data', now including 'location insights'), available exclusively through the Vistar DSP, which T-Mobile turns into area-level audience scores that Vistar matches to screens. T-Mobile app-ownership and engagement segments had been available through Vistar's self-service DSP since 6 May 2025.abstract, 1, 2, 6, 9vendor assertionsupported with qualificationmedium
PlaceIQ's undated A/B case for a national big-box retailer reports a Place Visit Rate of 2.75% for exposed devices against 2.13% for a standing 10% holdout never served a PlaceIQ ad (29% lift). The document says how the holdout is maintained but not how it is selected. Against the open population the rate is 0.67% (310% 'open lift'). The same campaign therefore shows a 10.7-fold larger lift when the comparator is unexposed non-targeted users rather than the holdout. The case does not show whether PlaceIQ (now Precisely) runs this design today.abstract, 1, 5vendor assertionsupported with qualificationmedium
Under the Q1 coding rule, the visit numbers sold by cohort A products are documented as projected for Foursquare Attribution, InMarket LCI (projected store visits), GroundTruth Projected Visits and Azira (extrapolated total visits), and as observed for GroundTruth Observed Visits, Azira observed visits and InMarket's exposed device visits. Arrivalist MediaInsights' spend lift is declared (card transactions), while the basis of its arrival counts is not stated (the page lists location pings as well as cards). The basis is 'not disclosed' for Blis, Reveal, Adsquare, Cuebiq, Vistar, Kochava, Lifesight and Precisely. Declared card-based sales metrics are also sold by Foursquare, InMarket (RSA) and Cuebiq (Affinity Solutions).abstract, 1, 5, 9synthesissupported with qualificationmedium
MRC's only location-specific standard is the 'MRC Location-Based Advertising Measurement Guidelines', Final Version 1.0, dated March 2017 and sponsored by MRC, IAB and MMA; it was issued in draft for a 30-day public comment period in November 2016, finalised on 29 March 2017, and MRC's standards index at 24 October 2026 shows it as issued March 2017 with no later update.abstract, 1, 8direct recordsupported as statedhigh
ZeroToOne.AI announced on 25 March 2026 that it had acquired GroundTruth (terms and seller undisclosed), GroundTruth's site now describes itself as 'a ZeroToOne.AI company', and the acquirer's counsel confirmed the transaction on 24 April 2026; the event is an acquisition, announced as completed.abstract, 2vendor assertionsupported as statedmedium
Infillion, which owns Gimbal, announced on 18 September 2026 an agreement to acquire Foursquare (terms undisclosed), describing closing as a future event. By 24 October 2026 Foursquare's homepage says it "has joined Infillion", co-founder Dennis Crowley wrote on 20 October 2026 that Foursquare had been acquired about a month earlier, and a shareholder wrote on 24 September 2026 that it had been sold. No closing release, filing or exact closing date was found, so completion rests on participants' statements.abstract, 2vendor assertionsupported with qualificationmedium
T-Mobile US completed its acquisitions of Vistar Media on 3 February 2025 (agreement 20 December 2024) and of Blis Holdco Limited on 3 March 2025 (agreement 18 February 2025), transferring cash of US$621 million and US$180 million respectively. Excluding payments that settled preexisting relationships, the 10-K puts the fair value of consideration at US$617 million (Vistar) and US$174 million (Blis), both provisional. Blis's homepage is titled 'Blis, part of T-Ads | Omnichannel DSP'.abstract, 2, 6, 9direct recordsupported with qualificationhigh
In the sources screened by the cutoff, this review found no filing, official platform statement or independent measurement that attributes a quantified change in US SDK-sourced location supply to a named Apple or Google permission change; the Telenav FY2019 and FY2020 10-Ks do not mention iOS 13 or location permissions, the Near S-4/A attributes no figure, and EDGAR full-text searches for 10-Ks pairing location data with App Tracking Transparency, iOS 13 or background location returned no location vendor.abstract, 3synthesissupported with qualificationlow
The InMarket order (C-4803, issued 29 April 2024) bans selling or licensing Location Data and bars sensitive-location products; for Historic Location Data (data collected without affirmative express consent) it requires deletion within 90 days of data collected through InMarket's own apps unless the consumer gives affirmative express consent to retention, deletion, deidentification or rendering non-sensitive within 120 days of data obtained from third parties, and deletion of audience segments built from historic data within 120 days. The order runs 20 years.abstract, 7direct recordsupported with qualificationhigh
In an undated notice to Norway's Datatilsynet (filed by BakerHostetler, published by NRK), Gravy Analytics, a Unacast subsidiary, said it was informed on 4 January 2025, by the intruder, of unauthorised access to its AWS cloud storage, apparently through a misappropriated access key; that the intruder obtained some files whose contents and personal-data status were under investigation; that the incident's duration was under investigation; that it took its data-processing platform offline and had it operational again as of 9 January 2025; that it was still assessing whether the incident was a reportable personal data breach; and that it was also informing the UK ICO. This is a security incident, not an enforcement action.abstract, 7direct recordsupported with qualificationmedium
On 31 March 2026 Geopath and the OAAA announced that their measurement modernisation 'began in early 2025', that 'Ipsos has been selected to support an industry pilot launching in the second half of 2026' to 'evaluate a next-generation OOH audience measurement system across multiple formats and environments' 'including updated methods for estimating impressions, reach, and frequency', with 'an orderly transition from the current Geopath measurement system to a next-generation framework beginning in 2027' and 'full adoption in 2028'; the release names no data sources.abstract, 8, 9direct recordsupported as statedhigh
Of six US DOOH products and currencies coded (Geopath; Vistar attribution; Vistar audience targeting; Place Exchange PerView; Broadsign; Perion; Talon is excluded as coded only from a UK-hosted global page), three name their location-data sources in their own or the operator's documentation: Geopath, Vistar attribution (InMarket, Foursquare/Placed) and Vistar audience targeting (Vistar-hosted partner pages naming GroundTruth's first-party, third-party and bid-stream data and Adsquare mobile location data). Place Exchange, Broadsign and Perion do not. Only Geopath states a panel size with a period: 7–10M qualified devices weekly from more than 100M US devices monthly, in 31 May 2023 documentation with no observation vintage stated. Counts: 3 of 6 disclose a source and 1 of 6 a panel size.abstract, 9, 12synthesissupported with qualificationmedium
H2 (ground-truth agreement) is unresolved overall: no independent multi-site comparison of any vendor's projected retail visits with door counts or transactions was found. The independent evidence that exists is historical and narrow, and for SafeGraph's 2018-vintage panel it is adverse (lower coverage at polling places with older and non-white voters).abstract, 11, 12, appendixsynthesissupported as statedmedium
H6 (a US visit metric holds current MRC accreditation) is contradicted as of 24 October 2026: none of MRC's eleven accredited-services and under-review lists carries a visit, visitation, foot-traffic or location metric, and both visit data sets MRC once accredited have lost accreditation.abstract, 11, 12, appendixsynthesissupported as statedhigh
H1 (supply contraction and substitution) is unresolved: no vendor discloses a US panel series on one definition from before 2021 to after 2023, and no filing or official statement attributes a quantified change in US SDK location supply to a named platform change, in the sources screened by the cutoff.abstract, 12, appendixsynthesissupported as statedmedium
H3 (randomised or holdout control by default) is contradicted: of the eight cohort A seed products that document a general lift method, six use a matched or synthetic control and two a randomised or holdout control (Azira, Blis); a ninth product documents exposed-only visit counts with no lift claim, and counted with it seven of nine documented visit-measurement methods are non-holdout. Five products document no default.abstract, 12, appendixsynthesissupported as statedhigh
H4 (bidstream or IP as the main source of location audiences) is unresolved: fewer than four cohort B products document a primary source, and the vendors that list several sources (Foursquare, InMarket, Azira) do not say which is primary.abstract, 12, appendixsynthesissupported as statedmedium
H5 (the five FTC-ordered companies no longer sell precise or sensitive location data) is contradicted: Outlogic and Collective Data Solutions (Kochava's subsidiary) market precise-location offers at the cutoff, and Gravy Analytics, trading as Unacast, offers device-level data and reports selling precise geolocation in the preceding year; Mobilewalla is unclear on precision and InMarket documents no such product.abstract, 12, appendixsynthesissupported as statedhigh
H7 (location signals in production use in agent-driven buying) is unresolved: the highest state any location signal reaches is an implemented connector (the Prebid Sales Agent, targeting AdCP 3.1.0-beta.3), no interoperability test result is public, and geographic cells reach no state.abstract, 12, appendixsynthesissupported as statedmedium
Machine-readable copy with passages and limitations: data/claim-ledger.csv.

The corrections

Every substantive change after the verification passes, with what questioned it, what was checked, the verdict, the change and how it was verified.

Corrections ledger

Every substantive change made after the verification and challenge passes, including withdrawn claims. Already reflected in the chapters; reproduced so the difference between first research and final text can be audited.

IDOriginal claim or scoreChallengeEvidence checkedVerdictChange madeReasonAffected
R2-01MRC's only location-specific standard is the 'MRC Location-Based Advertising Measurement Guidelines', Final Version 1.0, dated March 2017 and sponsored by MRC, IAB and MMA; it was issued in draft for a 30-day public comment period in November 2016, finalised on 29 March 2017, and MRC's standards index at 24 October 2026 shows it as issued March 2017 with no later update.The March 2017 version, three sponsoring associations, November 2016 consultation and 29 March 2017 final release are confirmed. Bound the update claim to the MRC index opened on 24 October 2026; that index lists this dedicated location guideline without a later update.Reviewer opened: https://mediaratingcouncil.org/standards-and-guidelines https://mediaratingcouncil.org/sites/default/files/Standards/MRC%20Location-Based%20Advertising%20Measurement%20Guidelines%20Final%20March%202017.pdf https://www.iab.com/wp-content/uploads/2017/03/March2017-Location-Based-Guidelines-PR_final.pdf supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F01; data/claims-overlay.json
R2-02H6 test: on 24 October 2026 none of MRC's six accredited-services lists (Digital, Multimedia, Out-of-Home, Television, Radio, Outside the U.S.) carries an accredited visit, visitation, foot-traffic, store-visit or location-determination metric for any product, none of the five under-review lists (Digital, Out-of-Home, Television, Radio, Services Outside the U.S.) shows a location or visit audit in progress, and MRC's two most recent decision communications (April-June and July-September 2026) record no location or visit action; the Out-of-Home and Outside-the-U.S. accredited lists are empty.All six accredited lists and five under-review lists were opened. I found no listed visit, visitation, footfall or location-determination metric; Q2 and Q3 decisions add none. Kevel conversions and Kroger sales are not visit accreditation. The verifier is right. Date this conclusion 24 October, not the still-future 30 October freeze. The empty OOH and outside-US accredited lists are confirmed. The digest's television enumeration is incomplete because the live list also includes Nielsen, without changing H6.Source check G1 (24 October 2026, primary sources opened): R2-02: H6 zero confirmed on re-fetch (24 Oct). Fix the enumeration: TV accredited = Comscore TV, iSpot.tv and Nielsen Media Research, and correct the under-review counts to match the verifier (Digital ~15, TV 1, Radio 2). https://mediaratingcouncil.org/accreditation/services-under-review/digital https://mediaratingcouncil.org/accreditation/services-under-review/digital https://mediaratingcouncil.org/sites/default/files/News/Accreditation-Matters/MRC_Accreditation_Status_Quarterly_Update_Q3_2026.pdf https://mediaratingcouncil.org/accreditation/out-of-home supported with qualificationOn 24 October 2026, none of MRC's six accredited-services lists and none of its five under-review lists carries a visit, visitation, foot-traffic or location-determination metric. The closest under-review entries are Kevel's 'Conversions and incrementality' and Kroger's attributed and incremental sales. MRC's April–June and July–September 2026 communications record no location or visit action, and the Out-of-Home and Outside-the-U.S. accredited lists are empty.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F10; data/claims-overlay.json
R2-03Foursquare's Visits data set was granted MRC accreditation in July 2020 for 'location information reported in Visits data set' (the first accreditation under the 2017 guidelines), was suspended in October 2022 and was revoked in December 2022; Foursquare's own release said the accreditation did not extend to its Attribution product, and MediaPost reported that Placed powered by Foursquare was not audited.MRC records confirm July 2020 grant, October 2022 suspension and December 2022 revocation. Foursquare explicitly excludes Attribution from the accreditation. Preserve the narrower description: the first since the 2017 guidelines, not the first location-related accreditation of any kind.Reviewer opened: https://mediaratingcouncil.org/sites/default/files/News/Accreditation-Matters/101320%20MRC%20Accreditation%20Status%20Communication.pdf https://mediaratingcouncil.org/sites/default/files/News/Accreditation-Matters/012423%20MRC%20Accreditation%20Status%20Communication.pdf https://foursquare.com/resources/blog/news/foursquare-visits-receives-first-media-rating-coun/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F11; data/claims-overlay.json
R2-04GroundTruth's 'Location, Place, and Visit data set' was granted MRC accreditation in July 2021, placed on a six-month hiatus at GroundTruth's request in September 2023 (not accredited during the hiatus), and revoked after the hiatus 'due to withdrawal from the MRC accreditation process' (row labelled February, reported in MRC's communication of 26 July 2024); GroundTruth's 2021 release claiming the accreditation is still online.MRC confirms July 2021 grant, September 2023 six-month hiatus and no accreditation during hiatus. The July 2024 communication labels revocation February; preserve both the action label and communication date rather than silently assigning a new month. GroundTruth's 2021 announcement remains online.Reviewer opened: https://mediaratingcouncil.org/sites/default/files/News/Accreditation-Matters/102021%20MRC%20Accreditation%20Status%20Communication.pdf https://mediaratingcouncil.org/sites/default/files/News/Accreditation-Matters/101623_MRC_Accreditation_Status_Communication.pdf https://mediaratingcouncil.org/sites/default/files/News/MRC%20Accreditation%20Status%20Quarterly%20Update_Q2%2024%207.26.pdf https://www.groundtruth.com/article/groundtruth-earns-mrc-accreditation-for-visitation-data/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F12; data/claims-overlay.json
R2-05OpenRTB 2.6's Geo object carries lat and lon as floats, a 'type' for the source of location (AdCOM Location Types: 1 GPS/Location Services, 2 IP Address, 3 User Provided), 'accuracy' in metres as reported by the device (recommended for type 1), 'lastfix' in seconds since the fix, and 'ipservice' (AdCOM IP Location Services, beginning ip2location, Neustar (Quova), MaxMind), and it states that lat/lon should be passed only if they conform to the accuracy of the stated type and that a postal-code centroid should not be passed; the 2.6 text contains no rule on truncating or rounding coordinates.The Geo fields, units, source codes and postal-centroid warning match the opened specifications. Section 3.2.19 provides no coordinate-rounding rule. Record a commit hash or archived copy because both cited branches can change; coordinate precision is not guaranteed accuracy.Reviewer opened: https://github.com/InteractiveAdvertisingBureau/openrtb2.x/blob/main/2.6.md https://github.com/InteractiveAdvertisingBureau/AdCOM/blob/main/AdCOM%20v1.0%20FINAL.md supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F16; data/claims-overlay.json
R2-06NAI's Precise Location Information Solution Provider Voluntary Enhanced Standards were first issued on 22 June 2022 with Cuebiq, Foursquare and Precisely PlaceIQ as the initial signatories, and reissued as 'Updated and effective October 2024'; they apply only to signatories' US activities, bar any use, licensing, sale or transfer of device or user activity correlated to a known Sensitive POI (eleven definitive categories including places of worship, correctional facilities, shelters, addiction treatment and sensitive-condition medical facilities, plus two non-definitive categories), bar use o…The verifier correctly adds contractual downstream restrictions and limited exceptions. Apply the bans subject to section IV: consented direct-relationship services requested by consumers, compliance processing and tightly limited technical services. The 2022 release confirms Cuebiq, Foursquare and Precisely PlaceIQ. Visual inspection of the current PDF's final page identifies five logos: Cuebiq, Precisely PlaceIQ, Foursquare, Outlogic and Veraset; label this list last updated March 2025, rather than saying it cannot be read or treating it as a fresh October 2026 audit. Eleven definitive and two non-definitive POI categories, US scope and annual NAI staff assessment are confirmed.Source check G1 (24 October 2026, primary sources opened): R2-06: the reviewer's five-logo list is wrong. The March 2025 page shows four logos (Cuebiq, Foursquare, InMarket, Outlogic), with no PlaceIQ and no Veraset. Replace 'could not be read' with these four and add the section IV exceptions. https://thenai.org/wp-content/uploads/2025/03/NAI-Precise-Location-Information-Solution-Provider-Voluntary-Enhanced-Standards.pdf https://thenai.org/press/leading-companies-commit-to-privacy-first-nai-enhanced-standards-for-precise-location-information/ https://thenai.org/wp-content/uploads/2025/03/NAI-Precise-Location-Information-Solution-Provider-Voluntary-Enhanced-Standards.pdf https://thenai.org/wp-content/uploads/2025/03/NAI-Precise-Location-Information-Solution-Provider-Voluntary-Enhanced-Standards.pdf supported with qualificationNAI's Precise Location Enhanced Standards were first issued on 22 June 2022 with Cuebiq, Foursquare and Precisely PlaceIQ as signatories. They were reissued 'Updated and effective October 2024', and the PDF's signatory page, 'Last updated March 2025', shows four logos: Cuebiq, Foursquare, InMarket and Outlogic. Within US activities they bar using or transferring activity correlated to a known Sensitive POI (11 definitive and 2 non-definitive categories) and law-enforcement, national-security or bounty-hunting uses, subject to section IV's exceptions for consented direct-relationship services, blocking directories, technical providers and compliance processing.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F20; data/claims-overlay.json
R2-07An independent audit of SafeGraph's point-of-interest data (about 47 million US devices) against North Carolina's 2018 general-election voter file found that polling places with older and with more non-white voters had lower coverage: rank correlations of coverage with the share of voters over 65 of -0.14 (p<0.001) and with the share of non-white voters of -0.11 (p=0.0067).The 2018 North Carolina SafeGraph study reports age-65-plus correlation −0.14 (p<0.001) and non-white share correlation −0.11 (p=0.0067). These concern polling-place coverage, not current retail-visit accuracy. The verifier is right.Reviewer opened: https://arxiv.org/pdf/2011.07194 supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-B-F01; data/claims-overlay.json
R2-08Across 2018-2022 SafeGraph's monthly panel of residing devices averaged 7.5% of the US population (range 4.5% to 14.5%); device counts tracked census population closely at county level (Pearson r 0.986 for urban and 0.934 for rural counties) and more loosely at tract level (r above 0.683 for urban and 0.830 for rural tracts).Accept the verifier's correction. The 4.5–14.5% extrema span the national, urban and rural monthly series; the national extremes cited in the paper are 4.9% and 13.4%. The quoted county and tract correlations describe the 2019 figure, not a pooled five-year fit; urban-tract r² falls to 0.375 in 2022. These are representativeness comparisons against population, not validation of projected store visits.Source check G2 (24 October 2026, primary sources opened): R2-08 accepted with one change. All statistics match the paper, but the paper never labels 13.4%/4.9% as the national series, so the wording now says 'overall trend' and drops 'national'. https://pmc.ncbi.nlm.nih.gov/articles/PMC10798630/ https://pmc.ncbi.nlm.nih.gov/articles/PMC10798630/ https://pmc.ncbi.nlm.nih.gov/articles/PMC10798630/ https://pmc.ncbi.nlm.nih.gov/articles/PMC10798630/ supported with qualificationAcross 2018-2022, SafeGraph's monthly sampling rate (residing devices divided by total population) averaged 7.5%. Monthly values ranged from 4.5% to 14.5% across the national, urban and rural series, and the overall trend peaked at 13.4% in May 2022 before falling to 4.9% in July 2022. In 2019, device counts tracked census population closely at county level (Pearson r 0.986 urban, 0.934 rural) and moderately at tract level (r above 0.683 urban, above 0.830 rural). The urban-tract fit weakened to r-squared 0.375 by 2022. These results compare the panel with population counts and do not validate visit counts.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-B-F05; data/claims-overlay.json
R2-09In Yellowstone, SafeGraph Patterns visits (January 2018-November 2020) correlated with NPS monthly recreation visits at r=0.88 and r=0.85 for the two most-visited POIs, with a trail counter's daily counts at r=0.76 (2018) and 0.77 (2019), and with park-wide gate vehicle counts at r=0.79 in 2019 but only 0.47 in 2020, when the compared facility imposed indoor capacity limits.Downloaded and read the primary PDF directly after the browser fetch failed. All six quoted correlations and the January 2018–November 2020 Patterns range match. Specify that individual facility POI series are compared with wider park reference counts; these correlations do not establish count agreement. Capacity limits are offered as a potential explanation for the 2020 mismatch, not an experimentally identified cause.Reviewer opened: https://par.nsf.gov/servlets/purl/10451340 supported with qualificationDownloaded and read the primary PDF directly after the browser fetch failed. All six quoted correlations and the January 2018–November 2020 Patterns range match. Specify that individual facility POI series are compared with wider park reference counts; these correlations do not establish count agreement. Capacity limits are offered as a potential explanation for the 2020 mismatch, not an experimentally identified cause.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-B-F10; data/claims-overlay.json
R2-10The only independent comparison of Placer.ai found by the cutoff, a University of Minnesota Extension case study at one Minnesota recreation area in summer 2021, recorded 10,138 visits on automated trail counters against mobile-platform estimates of 13,233 and 14,544 (Placer.ai and StreetLight; the slide does not make the assignment legible) with no statistically significant difference, but the platforms showed weekends 7 times busier than weekdays against 2.1 times in the counter data, and their inferred demographics differed significantly from the intercept survey on race, education and inc…Downloaded the April 2024 primary report and visually checked slide 19: Placer.ai is 13,233 and StreetLight 14,544 versus 10,138 counter visits during 29 May–6 September 2021. The verifier assigns the figures correctly. State that these are 30.5% and 43.5% higher totals, not proof of equivalent accuracy. The report identifies unequal polygons, event handling and activity populations; StreetLight trips are multiplied by three passengers. The 7× versus 2.1× weekend comparison and demographic differences are reported, with these comparability limits. Bound any only-study claim to the sources screened.Source check G2 (24 October 2026, primary sources opened): R2-10 accepted. Slide 19 visually confirms Placer.ai 13,233 and StreetLight 14,544, and the report states the three-passenger adjustment. https://conservancy.umn.edu/server/api/core/bitstreams/fdf3b6a9-7824-4e64-b330-f6392f4491b4/content https://conservancy.umn.edu/server/api/core/bitstreams/fdf3b6a9-7824-4e64-b330-f6392f4491b4/content https://conservancy.umn.edu/server/api/core/bitstreams/fdf3b6a9-7824-4e64-b330-f6392f4491b4/content supported with qualificationIn the only independent comparison of Placer.ai found in the sources screened, a University of Minnesota Extension case study (April 2024) at one Minnesota recreation area, Placer.ai estimated 13,233 visits and StreetLight 14,544 for 29 May-6 September 2021. Those totals are 30.5% and 43.5% above the 10,138 recorded by trail counters. StreetLight's figure is vehicle trips multiplied by a median of three passengers. The authors found no statistically significant difference, but the comparison is not like for like: polygons differ, counters cover only the cross-country trails, and events are handled differently. The 7x versus 2.1x weekend ratio and the demographic differences should be read with those limits.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-B-F12; data/claims-overlay.json
R2-11Across 15 US Facebook advertising campaigns run as randomised controlled trials in 2015 (500 million user-experiment observations, 1.6 billion impressions), matching and regression methods using rich individual-level data mostly overestimated lift relative to the experiments, and in half of the studies the estimated percentage increase in purchases was off by a factor of three across all methods.The experiment year, 15 US campaigns, 500 million user-experiment observations, 1.6 billion impressions and factor-of-three conclusion match the paper. Qualify the evidence label: this is an academic–Facebook collaboration with two Facebook-employed coauthors; the two academics disclose no financial interest or compensation. It is useful methodological evidence, but not wholly independent of the platform studied. The internal verifier checked the numbers but missed this authorship qualification.Source check G2 (24 October 2026, primary sources opened): R2-11 accepted with one change: relabel the evidence class from independent measurement to academic-platform collaboration, since two coauthors list Facebook affiliations. The figures are all correct, and the researcher had already noted the coauthors. https://www.kellogg.northwestern.edu/faculty/gordon_b/files/fb_comparison.pdf https://www.kellogg.northwestern.edu/faculty/gordon_b/files/fb_comparison.pdf https://www.kellogg.northwestern.edu/faculty/gordon_b/files/fb_comparison.pdf supported with qualificationFifteen US Facebook advertising campaigns run as randomised controlled trials in 2015 (500 million user-experiment observations, 1.6 billion impressions) were used to test observational methods. Matching and regression methods using rich individual-level data mostly overestimated lift relative to the experiments, and in half of the studies the purchase lift was off by a factor of three across all methods. The study is an academic-Facebook collaboration on Facebook's own data: two coauthors are affiliated with Facebook, and the two Kellogg academics declare no financial interest or compensation.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-B-F23; data/claims-overlay.json
R2-12This review found no independent, published comparison of any named US vendor's projected visit counts with door counts or transactions across many retail places and months, and no vendor-published held-out validation with error statistics, in the sources screened by the cutoff; the independent ground-truth evidence consists of park-visitation correlations for SafeGraph (0.47-0.88), Advan (0.875) and a single-site counter comparison for Placer.ai, so H2 is unresolved for every product in the register.The internal verifier is right that the summary omits the 2018 SafeGraph polling-place audit and that blanket H2-unresolved wording fails the registered systematic-bias rule. Include that audit and record a historical, use-specific adverse result. Retain unresolved status for current retail projections lacking matched validation; do not carry an old panel verdict to all current products. The sources opened here do not independently establish the digest's entire bounded absence claim.Reviewer opened: https://arxiv.org/pdf/2011.07194 https://conservancy.umn.edu/server/api/core/bitstreams/fdf3b6a9-7824-4e64-b330-f6392f4491b4/content https://par.nsf.gov/servlets/purl/10451340 contradictedThe internal verifier is right that the summary omits the 2018 SafeGraph polling-place audit and that blanket H2-unresolved wording fails the registered systematic-bias rule. Include that audit and record a historical, use-specific adverse result. Retain unresolved status for current retail projections lacking matched validation; do not carry an old panel verdict to all current products. The sources opened here do not independently establish the digest's entire bounded absence claim.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-B-F31; data/claims-overlay.json
R2-13Azira's methodology page (footer 2025) is the only cohort A vendor document opened in this stream that documents a randomised control as the default: 10-15% of impressions serve public-service creative as a PSA holdout, with a synthetic control from its identity graph as the alternative, polygon-based visits, extrapolation of observed visits by a detection probability capped at 20x, minimums of about 1,000 observed visits and 100,000 exposed devices for breakouts, 99% confidence intervals and a two-tailed t-test.The source supports the stated methodology as Azira's own account. Its footer year is not a publication date. Keep the claim labelled vendor assertion.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology supported with qualificationThe source supports the stated methodology as Azira's own account. Its footer year is not a publication date. Keep the claim labelled vendor assertion.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-C-F05; data/claims-overlay.json
R2-14PlaceIQ's undated A/B case for a national big-box retailer reports a Place Visit Rate of 2.75% for exposed devices against 2.13% for a standing 10% holdout never served a PlaceIQ ad (29% lift) and 0.67% for the open population (310% 'open lift'), so the same campaign shows a 10.7-fold larger lift when the comparator is unexposed non-targeted users rather than the randomised holdout.The reported rates and lifts match: exposed 2.75%, holdout 2.13%, open population 0.67%; rounded lifts 29% and 310%, a 10.7-fold ratio. The verifier is right to remove 'randomised': the PDF does not state the assignment procedure. The undated case does not establish a current default.Source check G2 (24 October 2026, primary sources opened): R2-14 accepted. The PDF never calls the holdout random, and all figures recompute. https://mmaglobal.com/files/a-b_control_case_study_final.pdf https://mmaglobal.com/files/a-b_control_case_study_final.pdf https://mmaglobal.com/files/a-b_control_case_study_final.pdf supported with qualificationPlaceIQ's undated A/B case for a national big-box retailer reports a Place Visit Rate of 2.75% for exposed devices against 2.13% for a standing 10% holdout never served a PlaceIQ ad (29% lift). The document says how the holdout is maintained but not how it is selected. Against the open population the rate is 0.67% (310% 'open lift'). The same campaign therefore shows a 10.7-fold larger lift when the comparator is unexposed non-targeted users rather than the holdout. The case does not show whether PlaceIQ (now Precisely) runs this design today.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-C-F11; data/claims-overlay.json
R2-15Vistar Media's two US DOOH cases measured by Foursquare report, for Target (flight 2021-08-15 to 2022-01-29; 22 states; $1.2M+ budget), 72 million+ impressions, 533,000 store visits inside a four-day look-back and a 6.51% lift in visitation 'compared with non-exposed consumers', and for Jack in the Box (twelve markets; undated), 49M+ impressions, 1.3M+ store visits and an 8.8% lift; exposure is inferred from ad-log timestamps, device location, venue type and screen location, and the OAAA document says Vistar's studies 'compare control versus exposed groups' without describing the control.The opened vendor cases support the Target flight, budget, states, 72M-plus impressions, 533,000 visits, four-day lookback and 6.51% lift, and Jack in the Box's twelve markets, 49M-plus impressions, 1.3M-plus visits and 8.8% lift. Retain their vendor-case evidence class: the PDFs do not establish randomized controls or independently validated causal effects.Reviewer opened: https://oaaa.org/wp-content/uploads/2022/12/Target_MPA_2022_FINAL.pdf https://oaaa.org/wp-content/uploads/2024/02/Vistar-Media-US-Case-Study-DOOH-QSR-Jack-in-the-Box.pdf supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-C-F14; data/claims-overlay.json
R2-16Arrivalist's 2021 Lee County analysis scaled 492,897 panel trips to 9,861,477 projected US adult trips (a factor of 20.0) and 932,706 panel point-of-interest trips to 22,730,788, with only 60,609 'panel attributed arrivals' tied to media exposure, from a panel described as GPS data 'accurate to 30 feet' balanced monthly to the US Census and excluding international visitors, under-18s, trips under 50 miles or under 4 hours, one-way trips and commuters.The panel and projected trip counts, approximately 20.0-fold overall expansion, geographic/trip exclusions and vendor accuracy claim are supported. Preserve the slide's caveat: 60,609 panel-attributed arrivals are a small subset of all attributed arrivals, not the total attributed-arrival figure. The inclusion slide also lists connected-vehicle panel trips.Reviewer opened: https://www.visitfortmyers.com/sites/default/files/2022-03/LVCB%20-%20Industry%20Meeting%20-%20Arrivalist%20Distribution%20Version.pdf supported with qualificationThe panel and projected trip counts, approximately 20.0-fold overall expansion, geographic/trip exclusions and vendor accuracy claim are supported. Preserve the slide's caveat: 60,609 panel-attributed arrivals are a small subset of all attributed arrivals, not the total attributed-arrival figure. The inclusion slide also lists connected-vehicle panel trips.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-C-F22; data/claims-overlay.json
R2-17Across the cohort A seed vendors whose documentation states a default control design in the sources opened by this stream, one (Azira) documents a randomised PSA holdout as the default, four (Foursquare, InMarket, Cuebiq, adsquare) document a modelled, matched or synthetic control, and one (GroundTruth) reports exposed-only observed visits with no control; Simpli.fi, Vistar, Blis and Reveal either report exposed-only visitation or assert a control without a method; PlaceIQ documents a standing holdout in one undated case whose current status is unknown.The limited Stream C screen and Stream E's broader screen need reconciling, not competing randomization counts. Blis's older smoothie case does not state a method, while its dedicated product page describes a machine-balanced geographic holdout. Neither opened Blis page establishes random assignment or use by default. Code available design separately from documented default. InMarket's cited root opened only a sign-in page here, so its contribution to the exact count remains unresolved in this review.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://cuebiq.com/blog/advanced-measurement-targeting-platform/ https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://help.groundtruth.com/hc/en-us/articles/360000695267-Observed-Visits https://blis.com/tropical-smoothie-cafe-case-study/ https://blis.com/omnichannel-measurement/ https://lciadminconsole.inmarket.com/ supported with qualificationThe limited Stream C screen and Stream E's broader screen need reconciling, not competing randomization counts. Blis's older smoothie case does not state a method, while its dedicated product page describes a machine-balanced geographic holdout. Neither opened Blis page establishes random assignment or use by default. Code available design separately from documented default. InMarket's cited root opened only a sign-in page here, so its contribution to the exact count remains unresolved in this review.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-C-F23; data/claims-overlay.json
R2-18Only two of the vendor documents opened disclose minimum-sample and significance rules for visit lift: InMarket (10 million or 25 million impressions per campaign depending on channel; '>95%' confidence; standard error reported) and Azira (about 1,000 observed visits and 100,000 exposed devices; 99% confidence intervals; two-tailed t-test); Vistar states only that it requires 'enough scale', Reveal shows a '95%' label, and Foursquare, Cuebiq, adsquare, Blis, Simpli.fi and GroundTruth state none on the pages opened.Azira's numeric minima and significance rules are verified. InMarket's cited glossary was not accessible: both direct and search-result opens redirected to sign-in, so its thresholds and the exact 'only two' total remain unresolved. Reveal's current measurement page discloses confidence intervals, p-values and computation using formulas/simulations, beyond a dashboard's 95% label; no numeric minimum is stated there. Bound all absence claims to the pages actually screened.Reviewer opened: https://lciadminconsole.inmarket.com/ https://business.azira.com/azira-location-measurement-and-attribution-methodology https://oaaa.org/wp-content/uploads/2022/12/Target_MPA_2022_FINAL.pdf https://revealmobile.com/solutions/measurement https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://cuebiq.com/blog/advanced-measurement-targeting-platform/ https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://blis.com/omnichannel-measurement/ supported with qualificationInMarket's minimum-sample and significance thresholds sit in a glossary behind a sign-in and are marked unverified from public sources; Choozle documents a different minimum (30 days and 1 million impressions a month) for its InMarket Visit Stream integration only (see LOC-C-F24 final wording).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-C-F24
R2-19T-Mobile US agreed on 20 December 2024 to acquire 100% of Vistar Media Inc., completed the acquisition on 3 February 2025 and transferred cash of US$621 million, per its FY2025 Form 10-K; the event is an acquisition (completed).The agreement date, 100% stake, completion date and cash transferred are supported by T-Mobile’s September 2025 10-Q acquisition note. The cited FY2025 10-K exceeded the retrieval size limit; cite the opened note instead. Preserve “cash transferred”; it includes settlement of pre-existing relationships and is not identical to acquisition consideration.Source check G3 (24 October 2026, primary sources opened): LOC-D-F01: added 'cash transferred' vs US$617m consideration (10-K Note 2); kept the 10-K citation, since the reviewer's claim that it was unretrievable is wrong (curl with SEC UA works). https://www.sec.gov/Archives/edgar/data/1283699/000128369925000154/R11.htm https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm supported with qualificationT-Mobile US agreed on 20 December 2024 to acquire 100% of Vistar Media Inc. and completed the acquisition on 3 February 2025, transferring cash of US$621 million, per its FY2025 Form 10-K. Note 2 of that filing puts the fair value of consideration transferred at US$617 million, because part of the payment settled preexisting relationships with Vistar.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-D-F01; data/claims-overlay.json
R2-20The Delaware court approved the sale of substantially all of Near Intelligence's assets to BTC Near Holdco LLC (Blue Torch) on 22 February 2024 for a credit bid; the sale closed on 1 March 2024; the plan of liquidation was confirmed on 15 March 2024 and became effective on 27 March 2024, when all common stock and warrants were cancelled; a Form 15 deregistration was filed on 28 March 2024.The sale, credit bid, court approval, confirmation, effective date and cancellation are supported. The actual Form 15 was opened and is signed 27 March 2024; the claimed filing date of 28 March could not be independently verified because the SEC submissions JSON and filing-index routes were inaccessible. Keep signature and filing dates distinct; the verifier’s unqualified support is too broad.Source check G3 (24 October 2026, primary sources opened): LOC-D-F07: kept the 28 March filing date (EDGAR index: Filing Date 2024-03-28, accepted 2024-03-27 17:52) and added the 27 March signature date. The reviewer's 'unverifiable' is wrong. https://www.sec.gov/Archives/edgar/data/1826671/000121390024026702/ea0202622-1512g_nearintel.htm https://www.sec.gov/Archives/edgar/data/1826671/000121390024026702/0001213900-24-026702-index.htm supported with qualification... a Form 15-12G deregistration, signed 27 March 2024, was filed with the SEC on 28 March 2024 (EDGAR filing date; accepted the evening of 27 March).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-D-F07; data/claims-overlay.json
R2-21Foursquare announced its acquisition of Placed from Snap on 30 May 2019 with terms undisclosed; Snap's 10-Q records that it divested its membership interest in Placed, LLC to Foursquare Labs, Inc. in June 2019 for total cash of US$77.8 million, of which US$66.9 million was purchase consideration, recognising a US$39.9 million gain; the event is an acquisition (completed June 2019).Retain. Foursquare’s dated 30 May 2019 announcement describes signing, while Snap’s filing establishes June completion, $77.8m total cash, $66.9m purchase consideration and $39.9m gain. Cite the original Foursquare announcement in place of trade reporting for announcement timing.Reviewer opened: https://www.sec.gov/Archives/edgar/data/1564408/000156459019037449/R12.htm https://foursquare.com/resources/blog/news/foursquare-to-acquire-placed-from-snap-inc-to-deepen-its-location-technology-platform/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-D-F10; data/claims-overlay.json
R2-22ZeroToOne.AI announced on 25 March 2026 that it had acquired GroundTruth (terms and seller undisclosed), GroundTruth's site now describes itself as 'a ZeroToOne.AI company', and the acquirer's counsel confirmed the transaction on 24 April 2026; the event is an acquisition, announced as completed.Retain “acquisition, announced as completed”: the company release dated 25 March 2026 and acquirer counsel’s 24 April release support this classification. Neither opened source supplies purchase terms or the seller.Reviewer opened: https://www.groundtruth.com/article/zerotooneai-acquires-groundtruth/ https://www.nelsonmullins.com/insights/news/press_releases/nelson-mullins-advises-zerotoone-ai-in-acquisition-of-groundtruth supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-D-F15; data/claims-overlay.json
R2-23The FTC's January 2024 complaint describes InMarket Media, LLC as a Delaware LLC based in Austin, Texas, whose SDK was incorporated into more than 300 third-party apps downloaded onto over 390 million unique devices since 2017 (its own apps onto over 30 million), and alleges that from 2016 'about 100 million unique devices sent Respondent location data each year'.Retain, attributed to the FTC complaint as allegations. The 390m third-party-app downloads and 30m own-app downloads are cumulative since 2017; the approximately 100m figure is annual devices, not monthly active devices or a current 2026 panel.Reviewer opened: https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-InMarketMediaLLC.pdf supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-D-F19; data/claims-overlay.json
R2-24In the filings, official statements and vendor pages opened by this review, no US location vendor discloses a US panel series on a constant definition that spans a pre-2021 figure and a post-2023 figure, and no filing or official statement attributes a supply change to a named Apple or Google permission change; the dated figures found use incompatible units (monthly devices, opted-in panel, devices worldwide, unique devices per year, unique user IDs, daily signals, active devices), so H1 is unresolved on workstream D's evidence.The opened records do not establish a comparable pre-2021/post-2023 US panel series: SafeGraph gives a July 2020 carrier snapshot, Placer a September 2024 presentation with active-device figures lacking a stated observation period, InMarket annual devices, and Gravy daily signals/devices. Keep H1 unresolved on that evidence. The broader absence claim across all filings and vendor pages was not independently reproduced; retain an explicit screened-source scope. No market-wide contraction or substitution follows from these figures.Source check G2 (24 October 2026, primary sources opened): R2-24 accepted with one addition. All four unit descriptions are confirmed, and the Utah deck carries two different Placer device counts (30M active and 25M+), neither with a period. https://www.utah.gov/pmn/files/1194509.pdf https://docs.safegraph.com/docs/monthly-patterns https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-InMarketMediaLLC.pdf https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers supported with qualificationIn the filings, official statements and vendor pages this review opened, no US location vendor discloses a US panel series on one definition spanning a pre-2021 and a post-2023 figure. The dated figures use incompatible units: SafeGraph's July 2020 carrier breakdown, InMarket's 'about 100 million unique devices' a year, Gravy's daily signals from about a billion devices, and Placer's undated '30M Active Devices' and '25M+ devices' in a September 2024 deck. H1 is therefore unresolved on this evidence. The absence holds only for the sources screened, and none of these figures shows a market-wide contraction or substitution.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-D-F41; data/claims-overlay.json
R2-25GroundTruth's Observed Visits metric is an observed, exposed-only count with no control group: a visit is a user visiting the brand or drive-to location within 14 days of exposure, credited last-touch, verified after 7 days, and the help centre states that observed visits may be lower than actual visits because not all users are trackable.The stated fourteen-day window, seven-day verification and incomplete observation caveat are supported. This help page describes an exposed-only visit metric and specifies no control comparison. Do not turn that bounded observation into proof that every GroundTruth measurement product lacks a control, or count Observed Visits as a falsely labelled lift metric without evidence of that label.Reviewer opened: https://help.groundtruth.com/hc/en-us/articles/360000695267-Observed-Visits https://help.groundtruth.com/hc/en-us/articles/12770162930707-Projected-Visits supported with qualificationThe stated fourteen-day window, seven-day verification and incomplete observation caveat are supported. This help page describes an exposed-only visit metric and specifies no control comparison. Do not turn that bounded observation into proof that every GroundTruth measurement product lacks a control, or count Observed Visits as a falsely labelled lift metric without evidence of that label.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F10; data/claims-overlay.json
R2-26GroundTruth's Projected Visits is a panel-based probabilistic projection: a panel of impressed devices with frequent location signals is built per campaign and its visitation applied to all impressed devices, anchored in Observed Visits including first-party WeatherBug data, shown only once a campaign reaches about 40 Observed Visits and 350,000 impressions, cumulative, with no uncertainty reported.The campaign-specific impressed-device panel, WeatherBug input, usual thresholds of forty observed visits and 350,000 impressions, and cumulative reporting are supported. Replace 'with no uncertainty reported' with 'this help page publishes no uncertainty interval'; absence from a help article does not establish absence from all delivered reports. The page says panels refresh daily.Reviewer opened: https://help.groundtruth.com/hc/en-us/articles/12770162930707-Projected-Visits supported with qualificationThe campaign-specific impressed-device panel, WeatherBug input, usual thresholds of forty observed visits and 350,000 impressions, and cumulative reporting are supported. Replace 'with no uncertainty reported' with 'this help page publishes no uncertainty interval'; absence from a help article does not establish absence from all delivered reports. The page says panels refresh daily.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F11; data/claims-overlay.json
R2-27Blis's Smart Holdout Groups, released globally on 10 October 2024, is a geographic holdout design: machine learning splits an audience into statistically balanced target and control zip codes on demographics and income, allows for commuting between zip codes, and inserts buffer zones where ads are neither served nor measured; footfall lift is 'Only available in the US', and the page documents no data source, visit definition, minimum size or significance rule.Blis's own release dates its global-release announcement to 9 October 2024, not 10 October. The product page supports machine-balanced geographic target/control groups, commuting adjustments, buffer zones and US-only footfall lift. The verifier correctly says randomization is not stated; neither source establishes that this design is the default for all Blis visit-lift reporting. Use the primary release rather than its next-day syndication to date the announcement.Source check G2 (24 October 2026, primary sources opened): R2-27 accepted: Blis's own release is dated 9 October 2024. The 10 October date came from a MarTech Series syndication. https://blis.com/blis-rolls-out-omnichannel-measurement-solution-into-broader-market/ https://blis.com/omnichannel-measurement/ contradictedBlis announced the global release of Smart Holdout Groups on 9 October 2024. It is a geographic holdout design: machine learning splits an audience into statistically balanced target and control zip codes on demographics and income, allows for commuting, and inserts buffer zones where ads are neither served nor measured. Blis does not describe the assignment as randomised and does not say the design is the default for all its visit-lift reporting. Footfall lift is 'Only available in the US', and the page documents no data source, visit definition, minimum size or significance rule.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F14; data/claims-overlay.json
R2-28Azira's technical white paper documents a randomised PSA-based control as 'the default approach' (typically 10 to 15 per cent of impressions served public-service content), a synthetic control weighted to Census block groups when PSAs are not used, 99 per cent confidence intervals, a two-tailed t-test, minimum samples of about 100,000 exposed devices and 1,000 observed visits, and attribution windows of 7 days or 14 to 30 days by category.Accept the verifier's qualification: sample minimums apply to lift breakouts, and attribution windows are configurable. Retain vendor-assertion status and do not derive a publication date from the copyright year.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology supported with qualificationAccept the verifier's qualification: sample minimums apply to lift breakouts, and attribution windows are configurable. Retain vendor-assertion status and do not derive a publication date from the copyright year.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F16; data/claims-overlay.json
R2-29Azira's technical white paper documents a randomised PSA-based control as 'the default approach' (typically 10 to 15 per cent of impressions served public-service content), a synthetic control weighted to Census block groups when PSAs are not used, 99 per cent confidence intervals, a two-tailed t-test, minimum samples of about 100,000 exposed devices and 1,000 observed visits, and attribution windows of 7 days or 14 to 30 days by category.Separate mathematical caution: the paper defines lift as a relative rate increase, then multiplies it directly by exposed devices. Under that definition incremental visits require the control visit rate too, or the absolute rate difference times exposed devices. Confirm the vendor's notation before endorsing its formula.Source check G2 (24 October 2026, primary sources opened): R2-29 accepted. The paper defines lift as a fraction over the control rate, then multiplies it by exposed devices, so its incremental-visits formula is dimensionally wrong as written. https://business.azira.com/azira-location-measurement-and-attribution-methodology https://business.azira.com/azira-location-measurement-and-attribution-methodology supported with qualificationAzira's white paper defines lift as (exposed rate - control rate) / control rate, but then computes incremental visits as 'Exposed Group Lift * Exposed Group Devices'. Read literally, that multiplies a relative lift by a device count. Under the paper's own definition, incremental visits are (exposed rate - control rate) x exposed devices. Do not reproduce or endorse the published formula without that correction.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F16; data/claims-overlay.json
R2-30Across the fourteen cohort A seed products, nine document a default control design: two randomised or holdout (Azira's PSA control; Blis's zip-code holdout), six matched or synthetic (Foursquare, InMarket LCI, Reveal, Adsquare, Cuebiq, Arrivalist) and one exposed-only (GroundTruth); five document none (Unacast, Lifesight, Vistar, Kochava, Precisely). Seven of nine documented defaults are matched, synthetic or exposed-only, which meets H3's 'contradicted' rule as coded by this stream.Do not publish nine documented defaults or two randomized defaults from these records. Blis documents an available, algorithmically balanced geographic holdout; default use is not established. Its nonrandom assignment does not exclude it from the preregistered 'randomised or holdout' category if default use is later established. The verifier's proposed eight-or-nine-of-nine stricter coding changes the registered rule. InMarket's method could not be reopened here. GroundTruth's exposed visit count must be kept distinct from lift. Rebuild the exact count at current product/metric level; the opened Foursquare, Reveal, Adsquare, Cuebiq and Arrivalist materials do describe modeled/matched methods.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology https://blis.com/omnichannel-measurement/ https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://revealmobile.com/solutions/measurement https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://cuebiq.com/blog/ctv-ltv-attribution/ https://www.arrivalist.com/media-insights https://help.groundtruth.com/hc/en-us/articles/360000695267-Observed-Visits https://lciadminconsole.inmarket.com/ contradictedDo not publish nine documented defaults or two randomized defaults from these records. Blis documents an available, algorithmically balanced geographic holdout; default use is not established. Its nonrandom assignment does not exclude it from the preregistered 'randomised or holdout' category if default use is later established. The verifier's proposed eight-or-nine-of-nine stricter coding changes the registered rule. InMarket's method could not be reopened here. GroundTruth's exposed visit count must be kept distinct from lift. Rebuild the exact count at current product/metric level; the opened Foursquare, Reveal, Adsquare, Cuebiq and Arrivalist materials do describe modeled/matched methods.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F28; data/claims-overlay.json
R2-31Under the Q1 coding rule, the visit numbers sold by cohort A products are documented as projected for Foursquare Attribution, InMarket LCI (projected store visits), GroundTruth Projected Visits and Azira (extrapolated total visits); as observed for GroundTruth Observed Visits and InMarket's exposed device visits; as declared for Arrivalist MediaInsights (card transactions); and as 'not disclosed' for Blis, Reveal, Adsquare, Cuebiq, Vistar, Kochava, Lifesight and Precisely.Accept the central verifier correction: Arrivalist's card-based spend metric is declared, but this does not establish that its arrival counts are transactions. Its Media Insights page lists location pings as well as card data. Foursquare and GroundTruth describe projected counts; retain Azira's observed/projected distinction. InMarket's specific formula could not be reopened behind sign-in. Code each metric separately rather than assigning one basis to a product that reports visits and sales.Reviewer opened: https://foursquare.com/resources/blog/ad-tech/location-foursquares-attribution-methodology-takes-your-media-dollars-further/ https://help.groundtruth.com/hc/en-us/articles/12770162930707-Projected-Visits https://business.azira.com/azira-location-measurement-and-attribution-methodology https://www.arrivalist.com/media-insights https://lciadminconsole.inmarket.com/ contradictedAccept the central verifier correction: Arrivalist's card-based spend metric is declared, but this does not establish that its arrival counts are transactions. Its Media Insights page lists location pings as well as card data. Foursquare and GroundTruth describe projected counts; retain Azira's observed/projected distinction. InMarket's specific formula could not be reopened behind sign-in. Code each metric separately rather than assigning one basis to a product that reports visits and sales.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F29; data/claims-overlay.json
R2-32GroundTruth Ads Manager (live, US, $0 minimum spend) sells four location-targeting layers documented in its help centre as of 23 September 2026: Target Locations (city to precise business address, lat/long or nationwide), Target by Audience (historic visitation, with Deterministic first-party, Predictive and Datonics 'Premium' tiers), Target Neighborhoods (trade-area lookalikes) and Target On-Premise (real-time, mobile only, with In Store, On Lot, Retail Block and Radial boundaries); the platform calls geofencing 'Location Targeting'.Retain as vendor-documented functionality. The help article dated 23 September 2026 supports the geography plus three optional layers, the Datonics premium tier and four on-premise boundaries. The product page advertises $0 minimum spend. These are product claims, not independently verified targeting accuracy.Reviewer opened: https://help.groundtruth.com/hc/en-us/articles/53523927168659-Location-Audience-Targeting https://www.groundtruth.com/solutions/ads-manager/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F02; data/claims-overlay.json
R2-33The FTC's final order against Mobilewalla (14 January 2025, vote 4-1) bans the sale of sensitive location data, bans collecting consumer data from real-time bidding exchanges 'for purposes other than participating in those auctions', and bars using, transferring, selling or disclosing location data from sensitive locations 'such as health clinics, religious organizations, correctional facilities'; it is the only record in this stream that documents bidstream as a location source for a cohort B vendor.State: the order was issued 13 January 2025 and its finalization was publicly announced 14 January (4–1 vote). It restricts auction-derived collection/retention to auction participation and prohibits sensitive-location use or disclosure under its definitions and conversion proviso. Accept the verifier’s change from “only record” to “only regulator record in this stream”: Azira’s current data page separately names bid-stream as a source.Source check G4 (24 October 2026, primary sources opened): R2-33 accepted: Mobilewalla D&O issued 13 Jan 2025 (release 14 Jan, 4-1); Provision II auction rule and Provision III conversion proviso verified at the order PDF; "only record" narrowed to "only regulator record" (Azira names bid-stream). https://www.ftc.gov/system/files/ftc_gov/pdf/Mobilewalla-D&O.pdf https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-banning-mobilewalla-selling-sensitive-location-data https://www.ftc.gov/system/files/ftc_gov/pdf/Mobilewalla-D&O.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Mobilewalla-D&O.pdf supported with qualificationThe FTC's Mobilewalla Decision and Order (Docket C-4811) was issued 13 January 2025 and its finalisation announced 14 January 2025 on a 4-1 vote; it bars Mobilewalla from collecting or retaining information it accesses in online advertising auctions for any purpose other than participating in them, and from selling, sharing, disclosing or otherwise using Sensitive Location Data for the sensitive locations it must identify, except to convert that data into non-sensitive or non-location data. It is the only regulator record in this stream that documents bidstream as a cohort B location source; Azira's own data page also names bid-stream among its sources.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F10; data/claims-overlay.json
R2-34Vistar Media's DOOH audience targeting (the product URL returned 404 on 24 October 2026) is documented in its own guide as screen selection from 'aggregated and anonymized location data' plus third-party audience partners (Epsilon with 'over 3,000 readily-available audiences', Eyeota, InMarket, Affinity Answers), and since 5 October 2026 T-Mobile segments 'built from app ownership data, from devices within T-Mobile's network', which trade reporting says are exclusive to Vistar's DSP 'because of tightening regulations around location data and the use of mobile device IDs for ad targeting'.Accept the verifier’s qualification. Vistar documents aggregated movement/location targeting and the named partners. The opened 5 October 2026 report describes both mobile location data and app installation/use inferred from network requests, with OOH-proximity exposure for users opting into location tracking. Keep those distinct inputs separate. Exclusivity and the regulatory rationale are attributed to T-Mobile’s executive, not an independent legal conclusion. A past 404 is an access observation, not evidence of product retirement.Source check G3 (24 October 2026, primary sources opened): LOC-F-F12: kept location and app-usage inputs separate, attributed the regulatory rationale to Zhu, recorded the 404 as an access note only; AdExchanger's 'January 2025' Vistar date conflicts with the 10-K (3 Feb 2025). https://www.vistarmedia.com/blog/vistar-media-dooh-audience-targeting https://www.adexchanger.com/digital-out-of-home/t-mobile-brings-its-mobile-data-exclusively-to-vistar-to-scale-up-dooh-targeting/ https://www.adexchanger.com/digital-out-of-home/t-mobile-brings-its-mobile-data-exclusively-to-vistar-to-scale-up-dooh-targeting/ https://www.vistarmedia.com/blog/vistar-media-dooh-audience-targeting supported with qualificationVistar Media's own guide documents DOOH audience targeting from 'aggregated and anonymized location data' plus third-party partners (Epsilon, Eyeota, InMarket, Affinity Answers). Since 5 October 2026 T-Mobile's data has been available for OOH targeting exclusively through Vistar; per AdExchanger it combines mobile location data with app installation and usage that T-Mobile infers from network requests, with OOH-proximity exposure only for users who opted into location tracking. T-Mobile's Jess Zhu attributes the exclusivity to tightening regulation of location data and mobile device IDs.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F12; data/claims-overlay.json
R2-35Broadsign Ads' DOOH audience targeting (found in discovery; not in the register) is the only DOOH audience product opened whose documentation names both the mobility supplier and the collection route: Native Touch data 'pulled from active application SDKs and APIs', collected 'from smartphones once audiences enter the defined location boundaries', including 'device IDs, languages, app IDs, age, gender', translated into 6 targeting groups and over 190 personas per screen; no panel size, consent route or region is stated.Replace the failed old URL with the opened /audiences/ page. The page supports Native Touch, SDK/API collection inside venue boundaries, the listed device attributes, six groups and more than 190 personas. It states no panel period/size or US coverage on that page. Keep the discovery as a cohort-B candidate; do not score it as US-available until a source establishes US availability. “Only opened DOOH product” is limited to the original screen, not the whole market.Reviewer opened: https://broadsign.com/audiences/ supported with qualificationReplace the failed old URL with the opened /audiences/ page. The page supports Native Touch, SDK/API collection inside venue boundaries, the listed device attributes, six groups and more than 190 personas. It states no panel period/size or US coverage on that page. Keep the discovery as a cohort-B candidate; do not score it as US-available until a source establishes US availability. “Only opened DOOH product” is limited to the original screen, not the whole market.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F17; data/claims-overlay.json
R2-36None of the cohort B product documentation opened by 24 October 2026 describes suppression of sensitive places (health facilities, places of worship, shelters or the categories named in FTC orders and state laws); the only sensitive-location handling on record for these vendors is imposed by FTC orders (InMarket 2024, Mobilewalla 2025, Kochava and Collective Data Solutions 2026), GroundTruth's policy states it may sell sensitive personal data, and Ads Manager's one documented category control is an alcohol age gate.The internal verifier is right that the original “only handling on record is imposed by FTC orders” is false. Foursquare publishes sensitive-place restrictions, Mobilewalla disclaims knowing collection at sensitive sites, and Azira describes sensitive-location removal. Describe these as public policy statements, not verified enforcement. GroundTruth’s sensitive-personal-data sale notice is present but does not establish sale of sensitive-place visits. Retain any absence claim only for the exact product pages originally screened.Source check G2 (24 October 2026, primary sources opened): R2-36 accepted. All four privacy pages say what the reviewer reports, so 'only FTC-imposed handling' is false. GroundTruth's notice is the generic state-law sensitive-data notice. https://foursquare.com/legal/privacy-center/foursquare-privacy-policy-consumer-services/ https://www.mobilewalla.com/privacy-center https://www.azira.com/platform/privacy https://www.groundtruth.com/privacy-policy/ contradictedNone of the cohort B product pages opened describes sensitive-place suppression, but vendor privacy documents do. Foursquare commits to the NAI enhanced standard and lists 13 sensitive-place categories. Mobilewalla says it does not knowingly collect visits to places of worship, shelters, treatment centres or reproductive health clinics. Azira describes a sensitive-location data program that removes such data. These are self-attested policy statements with no verified enforcement, alongside FTC orders imposing programs on InMarket, Mobilewalla, and Kochava with Collective Data Solutions. GroundTruth's notice that it 'may sell your sensitive personal data' is a state-law disclosure and does not show that it sells sensitive-place visits.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F19; data/claims-overlay.json
R2-37H4 is unresolved on the brief's rule: of the fourteen cohort B seed products, twelve were readable and only one (GroundTruth Ads Manager, via its privacy policy) documents its location sources, as a blend without proportions; eleven are coded 'not disclosed' from current documentation (opt-in, consented, proprietary, GPS or mobility signals without a route) and two could not be read (Blis bot-blocked; Kochava Collective absent from its URL), so fewer than four products document a primary source and neither the bidstream/IP count (0) nor the SDK/panel count (0) can be compared.The original source-disclosure count is wrong, but the verifier’s replacement is also too strong. Foursquare describes SDK/API partners AND suppliers/brokers/ad networks providing location data. InMarket’s location-data page lists its own apps, partner SDK network AND trusted third-party sources. Neither proves the primary location source or proportions. Code both “multiple disclosed sources; primary source not established,” unless product-specific method documentation settles dominance. Azira expressly discloses an SDK/bid-stream/transaction blend. H4 remains unresolved; rebuild counts from primary-source evidence and the revised register rather than reusing 0/0 or the verifier’s two SDK votes.Source check G2 (24 October 2026, primary sources opened): R2-37 accepted. InMarket's data page lists a third item, 'Trusted & certified third-party sources', and Foursquare's policy names brokers and ad networks supplying location data, so neither vendor can be coded as SDK-primary. https://foursquare.com/legal/privacy-center/foursquare-privacy-policy-consumer-services/ https://inmarket.com/data/ https://www.azira.com/platform/data contradictedH4 remains unresolved, and the cohort B source counts must be rebuilt. Foursquare (SDK/API partners plus data suppliers, brokers and ad networks) and InMarket (own app, partner SDK network and 'trusted & certified third-party sources') disclose multiple sources without naming a primary one, so code both 'multiple disclosed sources; primary source not established'. Azira (SDK, bid-stream and transactions) and GroundTruth disclose blends without proportions. No product documents a primary source, so neither the earlier 0/0 count nor the verifier's two SDK votes stands.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F20; data/claims-overlay.json
R2-38iOS 14 (announced 22 June 2020, released 16 September 2020) let users grant apps approximate instead of precise location; Apple's WWDC20 session states apps cannot opt out, that reduced-accuracy fixes are quantised to a region with a typical radius of about five kilometres (a couple of kilometres in dense cities, ten kilometres or more in rural areas), recomputed about four times per hour, and that region monitoring requires full accuracy.Retain. Apple’s dated announcement/release and WWDC transcript support user-controlled reduced accuracy, variable quantization region size, approximately four updates per hour, no app opt-out and full-accuracy requirement for region notifications. These describe permission behavior, not an observed vendor supply decline.Reviewer opened: https://www.apple.com/newsroom/2020/06/apple-reimagines-the-iphone-experience-with-ios-14/ https://www.apple.com/newsroom/2020/09/ios-14-is-available-today/ https://developer.apple.com/videos/play/wwdc2020/10660/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-G-F02; data/claims-overlay.json
R2-39App Tracking Transparency was announced on 22 June 2020 as an iOS 14 requirement, deferred on 3 September 2020 to 'early next year', and became mandatory for all apps on 26 April 2021 with iOS 14.5; Apple's definition of tracking includes sharing user or device data with data brokers.Retain the announcement/deferment/enforcement sequence and broker-sharing scope. Keep ATT permission separate from Core Location permission; ATT does not itself remove an app’s location entitlement.Reviewer opened: https://www.apple.com/newsroom/2020/06/apple-reimagines-the-iphone-experience-with-ios-14/ https://developer.apple.com/news/?id=hx9s63c5 https://developer.apple.com/news/?id=ecvrtzt2 https://www.apple.com/newsroom/2021/04/ios-14-5-offers-unlock-iphone-with-apple-watch-diverse-siri-voices-and-more/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-G-F03; data/claims-overlay.json
R2-40iCloud Private Relay, released as a public beta with iOS 15 on 20 September 2021 for iCloud+ subscribers, replaces the client IP with a relay IP that maps to a roughly city-level area by default ('Maintain general location', a four-character geohash of roughly 800 square kilometres) or to country and time zone, and covers Safari browsing, DNS queries and unencrypted (insecure HTTP) app traffic only, leaving encrypted in-app traffic and its IP geolocation untouched.Accept the verifier’s qualification: the four-character geohash is the location hint for selecting the relay IP, not a guarantee that every relay IP maps to that exact area. Private Relay requires an eligible user to enable it, preserves coarse location by default and covers Safari, DNS and unencrypted app connections; do not imply that it masks HTTPS in-app transport or changes Core Location permissions. The 20 September 2021 release/public-beta timing is supported.Reviewer opened: https://www.apple.com/newsroom/2021/09/ios-15-is-available-today/ https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/ supported with qualificationAccept the verifier’s qualification: the four-character geohash is the location hint for selecting the relay IP, not a guarantee that every relay IP maps to that exact area. Private Relay requires an eligible user to enable it, preserves coarse location by default and covers Safari, DNS and unencrypted app connections; do not imply that it masks HTTPS in-app transport or changes Core Location permissions. The 20 September 2021 release/public-beta timing is supported.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-G-F06; data/claims-overlay.json
R2-41Android 12 (source pushed to AOSP on 4 October 2021) lets users grant only approximate location even when an app requests precise location, offers Precise and Approximate options in the permission dialog, lets users set the accuracy for any app in Settings regardless of its target SDK, and Google documents approximate location as accurate to within about 3 square kilometres.Retain, with the scope already supplied by Google: the approximate estimate applies to LocationManagerService/FusedLocationProvider. The 4 October 2021 AOSP date, approximate/precise choice and Settings control regardless of target SDK are supported. This is an approximate area, not a 3km radius.Reviewer opened: https://android-developers.googleblog.com/2021/10/android-12-is-live-in-aosp.html https://developer.android.com/develop/sensors-and-location/location/permissions/runtime https://developer.android.com/develop/sensors-and-location/location/permissions supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-G-F09; data/claims-overlay.json
R2-42On 17 October 2025 Google announced it would retire the Attribution Reporting API, Protected Audience and Topics on both Chrome and Android, together with Protected App Signals, SDK Runtime, IP Protection, On-Device Personalization, Private Aggregation, Related Website Sets and SelectURL, with phase-outs to follow Chrome and Android processes and no retirement dates given; CHIPS, FedCM and Private State Tokens continue.Retain the named retirement decisions and continuing CHIPS/FedCM/Private State Tokens. Attribute “no retirement dates” to this 17 October 2025 announcement, which says phaseout will follow Chrome/Android processes; it is not a claim that no later implementation dates exist.Reviewer opened: https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-G-F15; data/claims-overlay.json
R2-43In the sources screened by the cutoff, this review found no filing, official platform statement or independent measurement that attributes a quantified change in US SDK-sourced location supply to a named Apple or Google permission change; the Telenav FY2019 and FY2020 10-Ks do not mention iOS 13 or location permissions, the Near S-4/A attributes no figure, and EDGAR full-text searches for 10-Ks pairing location data with App Tracking Transparency, iOS 13 or background location returned no location vendor.The opened Telenav FY2020 filing yielded no matches for “iOS 13” or “location permissions”; Google’s policy page states policy changes, not quantified US vendor-panel effects. The cited Near S-4/A was inaccessible, and the original EDGAR search inventory was not reproduced. The verifier correctly narrows the absence, but this review cannot support the entire negative claim. Keep H1 unresolved and record the unreviewed filings/searches explicitly.Reviewer opened: https://www.sec.gov/Archives/edgar/data/1474439/000147443920000029/tnav630202010k.htm https://android-developers.googleblog.com/2020/02/safer-location-access.html supported with qualificationThe opened Telenav FY2020 filing yielded no matches for “iOS 13” or “location permissions”; Google’s policy page states policy changes, not quantified US vendor-panel effects. The cited Near S-4/A was inaccessible, and the original EDGAR search inventory was not reproduced. The verifier correctly narrows the absence, but this review cannot support the entire negative claim. Keep H1 unresolved and record the unreviewed filings/searches explicitly.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-G-F20; data/claims-overlay.json
R2-44The InMarket order (Docket C-4803, proposed package dated 18 January 2024, issued 29 April 2024, finalisation announced 1 May 2024 by a 3-0-2 vote) is the only one of the five that bans selling or licensing precise Location Data outright ('in exchange for any valuable consideration'); it separately bars products that categorise or target consumers by sensitive location data across nine categories, requires deletion of Historic Location Data within 90 days and audience segments within 120 days, and runs 20 years.The sale prohibition and dates are supported, but the verifier missed material remediation qualifications. XII.A requires deletion of historic data collected through InMarket apps within 90 days, with an option to obtain affirmative consent for retention. XII.B gives 120 days to delete, deidentify or render non-sensitive third-party historic data. XII.C requires deletion of segments made from historic data within 120 days. Replace the blanket 90-day deletion statement with these distinct duties. Historic data means data obtained without affirmative express consent.Source check G4 (24 October 2026, primary sources opened): R2-44 accepted: InMarket XII split verified at the order PDF (A: own-app data 90 days + consent option; B: third-party data 120 days delete/deidentify/render non-sensitive; C: segments 120 days); blanket "delete within 90 days" was wrong. https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf supported with qualificationThe InMarket order (C-4803, issued 29 April 2024) bans selling or licensing Location Data and bars sensitive-location products; for Historic Location Data (data collected without affirmative express consent) it requires deletion within 90 days of data collected through InMarket's own apps unless the consumer gives affirmative express consent to retention, deletion, deidentification or rendering non-sensitive within 120 days of data obtained from third parties, and deletion of audience segments built from historic data within 120 days. The order runs 20 years.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F03; data/claims-overlay.json
R2-45FTC v. Kochava (D. Idaho, No. 2:22-cv-00377-BLW) was litigated for almost four years: complaint filed 29 August 2022; first motion to dismiss granted with leave to amend 4 May 2023 (Dkt. 24); First Amended Complaint 5 June 2023; motion to dismiss it denied 3 February 2024 (Dkt. 71); Kochava transferred its data-broker business to subsidiary Collective Data Solutions, LLC, so a Second Amended Complaint naming CDS was filed 15 July 2024 (Dkt. 86); motion to dismiss it denied 3 February 2025 (Dkt. 101); a stipulated order was announced 4 May 2026 (Commission vote 2-0) and entered 25 June 2026 (D…The opened docket decisions support the dismissal and amendment history, the transfer of the broker business to CDS, and June 25, 2026 entry of the stipulated order. Preserve the distinction between FTC approval/announcement and court entry. No correction to the chronology identified.Reviewer opened: https://www.ftc.gov/system/files/ftc_gov/pdf/1.%20Complaint.pdf https://www.govinfo.gov/content/pkg/USCOURTS-idd-2_22-cv-00377/pdf/USCOURTS-idd-2_22-cv-00377-0.pdf https://www.govinfo.gov/content/pkg/USCOURTS-idd-2_22-cv-00377/pdf/USCOURTS-idd-2_22-cv-00377-2.pdf https://www.govinfo.gov/content/pkg/USCOURTS-idd-2_22-cv-00377/pdf/USCOURTS-idd-2_22-cv-00377-3.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F06; data/claims-overlay.json
R2-46The Kochava stipulated order bans Kochava and Collective Data Solutions from selling, licensing, transferring, sharing or disclosing Sensitive Location Data (Precise Location Data tied to five categories of Sensitive Locations, narrower than the administrative orders), with the same direct-relationship consent exception, a 1,850-foot coarse carve-out, a Supplier Assessment Program, third-party incident reports within 30 days, deidentification (not deletion) of Historical Location Data within 90 days, a deletion-request mechanism and a 10-year term; defendants neither admit nor deny, and sale …The central prohibition is supported. Amend historical remediation to deidentify OR render non-sensitive within 90 days; XII also allows retention where records confirming consent are obtained within that period. The definition of precise data additionally excludes specified security, federal national-security and imminent-harm uses. Record these defined exclusions when comparing orders. The verifier missed these qualifications.Source check G4 (24 October 2026, primary sources opened): R2-46 accepted with changes: Kochava XII.A "deidentify or render non-sensitive" + consent-records retention proviso and Def. G exclusions verified; reviewer overstates that the verifier missed them (verifier quoted XII.A and the exclusions; only the retention proviso was missing). https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf supported with qualificationThe Kochava order (entered 25 June 2026, 10-year term) requires defendants within 90 days to deidentify or render non-sensitive all Historical Location Data, unless they obtain within that period records showing consumers consented to its collection, use and disclosure. Its definition of Precise Location Data excludes coarse data (radius of at least 1,850 feet) and data used for security purposes, federal national-security purposes, or a law enforcement response to an imminent risk of death or serious bodily harm.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F07; data/claims-overlay.json
R2-47Gravy Analytics (a Unacast subsidiary) told the Norwegian Data Protection Authority that on 4 January 2025 it identified unauthorised access to its AWS cloud storage, apparently through a misappropriated access key, that the intruder 'obtained some files' whose contents and personal-data status were under investigation, that it took its data-processing platform offline and restored it by 9 January 2025, and that it was also informing the UK ICO; this is a security incident, not an enforcement action.The cited DocumentCloud PDF and its viewer/asset alternatives returned inaccessible or HTTP 403 responses, including a direct download attempt. I could not independently check the notice, its dates, the intruder-notification account or the verifier correction. Keep unresolved pending an accessible copy of the primary notice.Reviewer opened: supported with qualificationThe cited DocumentCloud PDF and its viewer/asset alternatives returned inaccessible or HTTP 403 responses, including a direct download attempt. I could not independently check the notice, its dates, the intruder-notification account or the verifier correction. Keep unresolved pending an accessible copy of the primary notice.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F08; data/claims-overlay.json
R2-48Maryland's Online Data Privacy Act of 2024 (Chapter 455, SB 541, approved 9 May 2024, effective 1 October 2025) prohibits a controller from selling sensitive data, which includes precise geolocation data defined by a 1,750-foot radius, making it a flat ban on sale of precise geolocation; it also bars geofences within 1,750 feet of mental health or reproductive or sexual health facilities for consumer-health-data purposes.The sensitive-data sale prohibition and 1,750-foot health-facility geofence restriction are supported, subject to statutory coverage and exemptions. The verifier correctly distinguishes the any-person geofence provision. Its April 1, 2026 note belongs specifically to section 14-4612, as the chapter says; do not recast it as a general postponement of the entire law or sale prohibition.Source check G4 (24 October 2026, primary sources opened): R2-48 accepted: MD ch. 455 Section 2 ties the 1 April 2026 date to 14-4612 alone (the exemptions section in the enacted text); verifier wording already correct; keep "subject to coverage and exemptions". https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf supported with qualificationMaryland's Online Data Privacy Act (2024 ch. 455, SB 541, approved 9 May 2024, effective 1 October 2025) bars a controller from selling sensitive data, which includes precise geolocation defined by a 1,750-foot radius, with no consent exception, subject to the act's coverage thresholds and exemptions; it also bars any person from using a geofence within 1,750 feet of a mental health or reproductive or sexual health facility to identify, track, collect data from or notify consumers about their consumer health data. Section 2 of the chapter makes section 14-4612 as enacted apply only prospectively, not to processing before 1 April 2026; that clause does not postpone the act or the sale ban.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F10; data/claims-overlay.json
R2-49Under the preregistered rule, H5 is contradicted: four of the five FTC-ordered companies (Outlogic; Gravy Analytics as Unacast with Venntel; Mobilewalla; Kochava through Collective Data Solutions) document at the cutoff continued sale or licensing of precise or device-level location data to third parties, in each case alongside sensitive-location suppression language that tracks their orders; InMarket, the only company whose order bans sale of precise location data outright, documents no such product while disclosing CCPA-sense sale or sharing of precise geolocation.H5 has current marketed counterexamples: Outlogic explicitly identifies precise-coordinate sales and Collective Data Solutions markets precision-location feeds. Unacast currently markets location products and explicitly discloses precise-geolocation sales over the preceding twelve months, a qualified third disclosure rather than conclusive evidence of a precise feed still sold on 24 October. Mobilewalla documents licensing and device-linked coordinates but not the precision or currently licensed fields. Replace the unqualified four-company current precise-seller count with this company-level evidence. Foundry visit reporting is not the proof for CDS raw-data licensing; continued sale alone establishes no order violation.Source check G5 (24 October 2026, primary sources opened): R2-49: four-company count cut to three documented (Outlogic, CDS, Unacast) plus Mobilewalla unclear; reviewer's Unacast 'qualified' downgrade rejected (policy dated Sep 2026 plus current device-level product); CDS strengthened by its 1 Oct 2026 'resold ... precise geolocation' disclosure. https://outlogic.io/ https://collectivedata.io/ https://www.unacast.com/privacy-policy https://www.mobilewalla.com/california-privacy-notice-2023 supported with qualificationUnder the preregistered rule H5 is contradicted. Three of the five ordered companies document at the cutoff the sale or licensing of precise geolocation to third parties: Outlogic, Collective Data Solutions for Kochava, and Gravy Analytics trading as Unacast, each in its own current policy or product pages. Mobilewalla documents licensing of device-linked lat/long data but not the precision of what it licenses, and InMarket documents no such product. Compliance with the orders is not assessed.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F23; data/claims-overlay.json
R2-50Geopath's methodology documentation (published 31 May 2023) names its inputs as a proprietary OOH inventory database, roadway data from Teralytics ('Terralytics' on one page) with Streetlytics and HERE Maps, vehicle-travel data from HERE Maps, 'recurring activity patterns from anonymized mobile device panels (from MotionWorks)' and demographics from government agencies, MotionWorks and Claritas; it gives no proportions.The 31 May 2023 pages support the named historical inputs, including MotionWorks and the roadway suppliers. The verifier is right to date that list: Geopath’s 19 October 2026 announcement names Bentley Systems for roadside data and says the 2026 dataset has updated sources. Describe the list as 2023 documentation; the 2026 planning dataset is announced to become the default on 12 November, after both this review and the proposed freeze.Source check G1 (24 October 2026, primary sources opened): R2-50: accepted. Label the provider list 'as documented 31 May 2023'. Bentley Systems is the roadside provider per the 19 Oct 2026 post, and the 2026 dataset is the default from 12 Nov (post-cutoff). https://geopath.atlassian.net/wiki/spaces/GEOP/pages/2323447855/Geopath+High-Level+Media+Measurement+Process https://blog.geopath.org/2026/10/19/2026-planning-dataset-to-become-default-on-november-12/ https://blog.geopath.org/2026/10/19/2026-planning-dataset-to-become-default-on-november-12/ https://blog.geopath.org/2026/10/19/2026-planning-dataset-to-become-default-on-november-12/ supported with qualificationGeopath's methodology documentation, published 31 May 2023, names MotionWorks device panels, Teralytics/Streetlytics and HERE Maps for roadways, HERE Maps for vehicle travel, and government agencies, MotionWorks and Claritas for demographics, with no proportions. That list is as documented in 2023: Geopath's 19 October 2026 post names Bentley Systems as its roadside data provider, and its 2026 Planning Dataset, which credits 'updated data sources' for pedestrian-impression changes, becomes the default only on 12 November 2026, after the cutoff.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F01; data/claims-overlay.json
R2-51Geopath's Mobile Device Panel page (31 May 2023) describes a weekly sample of GPS-sighted devices selected for roughly eight active hours a day and a consistent Census Block Group home, states that about 80% of GPS sightings come from 20% of devices, and quantifies the panel only through one example (week of 9 August 2020: panel devices were 19.5% of devices processed and 78% of locations processed); it discloses no absolute US panel size and names no provider on the page.The original page supports the weekly selection criteria, the approximate 80/20 distribution and the August 2020 19.5%/78% example, but it explicitly names Standard Data, contrary to the original “names no provider” wording. The verifier is right on that omission. Its broader implication of no published absolute US panel size also needs qualification: a separate 31 May 2023 Geopath page states over 100M unique US devices monthly and a selected sample of 7–10M qualified devices weekly, without a clear observation vintage. Record this as documentation-dated disclosure, not a current audited panel count. The figure’s absolute counts and the separate 2% assertion were not independently checked.Source check G1 (24 October 2026, primary sources opened): R2-51: accepted. Standard Data is named on the panel page, and page 2323449264 (31 May 2023) gives >100M monthly devices and 7–10M qualified devices weekly. Code the panel size as documentation-dated, vintage unstated. https://geopath.atlassian.net/wiki/spaces/GEOP/pages/2323449407 https://geopath.atlassian.net/wiki/spaces/GEOP/pages/2323449264/Geopath+Mobile+Device+Location+Movement+Patterns https://geopath.atlassian.net/wiki/spaces/GEOP/pages/2323449407 supported with qualificationGeopath's Mobile Device Panel page (31 May 2023) describes a weekly panel of GPS-sighted devices, active about eight hours a day with a consistent Census Block Group home, culled by Standard Data, and illustrates it with a 2020 example (19.5% of devices, 78% of locations). A companion 31 May 2023 page says the feeds cover 'more than 100 million unique devices in the United States every month' and that the sample is 'between seven and ten million qualified devices each week'. That is a documentation-dated disclosure with no stated observation vintage, not a current audited panel count.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F02; data/claims-overlay.json
R2-52On 31 March 2026 Geopath and the OAAA announced that their measurement modernisation 'began in early 2025', that 'Ipsos has been selected to support an industry pilot launching in the second half of 2026' to 'evaluate a next-generation OOH audience measurement system across multiple formats and environments' 'including updated methods for estimating impressions, reach, and frequency', with 'an orderly transition from the current Geopath measurement system to a next-generation framework beginning in 2027' and 'full adoption in 2028'; the release names no data sources.Retain as an announced plan: the opened syndicated Geopath/OAAA release is datelined 31 March 2026 and supports the early-2025 initiative, second-half-2026 pilot, anticipated 2027 transition and 2028 adoption. It does not establish that the pilot has actually begun. The verifier’s supported verdict is appropriate.Reviewer opened: https://martechedge.com/press-release/ooh-industry-advances-effort-to-modernize-audience-measurement-and-selects-ipsos-for-pilot-program supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F05; data/claims-overlay.json
R2-53OpenRTB 2.6's Qty object carries 'multiplier' (float; required: the quantity of billable events deemed to occur, e.g. 'a DOOH opportunity may be considered to be 14.2 impressions'), 'sourcetype' (integer; recommended) and 'vendor' (string, 'required if sourcetype is present and type = 1': 'The top level business domain name of the measurement vendor providing the quantity measurement'); AdCOM's 'DOOH Multiplier Measurement Source Types' list enumerates 0 Unknown, 1 Measurement Vendor Provided, 2 Publisher Provided and 3 Exchange Provided; neither document records the vendor's mobility source,…The opened Qty table and AdCOM list support multiplier, recommended sourcetype, conditional vendor domain and source types 0–3. They do not define a standard field for a named provider’s underlying mobility panel or sampling method. Bound the absence claim to these standard objects; vendor extensions remain possible. Pin a release or commit for the evidence freeze because both cited URLs follow main.Reviewer opened: https://raw.githubusercontent.com/InteractiveAdvertisingBureau/openrtb2.x/main/2.6.md https://raw.githubusercontent.com/InteractiveAdvertisingBureau/AdCOM/main/AdCOM%20v1.0%20FINAL.md supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F09; data/claims-overlay.json
R2-54Across the US DOOH currency and SSP products screened by the cutoff, only Geopath names its mobility-data providers in its own methodology documentation (MotionWorks device panels; Teralytics and HERE for roadway and vehicle data); Vistar Media documents named partner sources on its own partner pages (InMarket SDK data, Foursquare/Placed); Place Exchange and Broadsign, Perion (Hivestack) and Talon describe 'mobile data', 'anonymised device-level location data' or 'mobility and partner data' without a provider; and no screened product or currency discloses a panel size with a period, so every …The original 0-panel-disclosed tally is wrong under Q2’s registered size-plus-period rule: Geopath’s 2023 documentation discloses 7–10M qualified devices weekly and over 100M unique US input devices monthly, with observation vintage unstated. Code disclosure present but documentation-dated, with current panel size unverified. The verifier is also right that Vistar’s own role- and region-tagged partner pages document audience-targeting sources, including GroundTruth’s mixed first-party/partner/bidstream supply and Adsquare mobile location data. Do not silently change the denominator: its visible correction splits Vistar into attribution and targeting while dropping Talon from the original six. Publish an explicit per-product row set before recomputing totals; retain Talon or explain its exclusion. The full verifier correction is truncated in the digest, so only its visible proposal could…Source check G1 (24 October 2026, primary sources opened): R2-54: accept with changes. Recode Geopath to panel disclosed (7–10M weekly, documentation-dated 2023) and Vistar targeting to source disclosed (3/3; 1/5). Reject the claim that Talon was dropped: the original derivation already excluded Talon, and the claim prose should say so. https://geopath.atlassian.net/wiki/spaces/GEOP/pages/2323449264/Geopath+Mobile+Device+Location+Movement+Patterns https://www.vistarmedia.com/partner-groundtruth https://www.vistarmedia.com/partner-groundtruth supported with qualificationOf six US DOOH products and currencies coded (Geopath; Vistar attribution; Vistar audience targeting; Place Exchange PerView; Broadsign; Perion; Talon is excluded as coded only from a UK-hosted global page), three name their location-data sources in their own or the operator's documentation: Geopath, Vistar attribution (InMarket, Foursquare/Placed) and Vistar audience targeting (Vistar-hosted partner pages naming GroundTruth's first-party, third-party and bid-stream data and Adsquare mobile location data). Place Exchange, Broadsign and Perion do not. Only Geopath states a panel size with a period: 7–10M qualified devices weekly from more than 100M US devices monthly, in 31 May 2023 documentation with no observation vintage stated. Counts: 3 of 6 disclose a source and 1 of 6 a panel size.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F23; data/claims-overlay.json
R2-55None of the DOOH attribution products or case studies screened documents a randomised or holdout control as its default: Hivestack's documented control is unexposed passers-by at the same screens by playlog timing (UK, 2022), Perion's current page asserts 'a matched control group' without method, Broadsign cites 'non-exposed control groups' without method, and Vistar's InMarket and Foursquare partner pages and GroundTruth's Place Exchange release describe no control; coded under H3 that is 0 randomised or holdout, 1 matched asserted without method (Perion), 2 unexposed comparisons without mat…Opened sources confirm Perion asserts a matched control, Broadsign’s Netherlands Decathlon case names non-exposed controls, and the opened Vistar and GroundTruth releases give no randomization procedure. These are bounded documentation findings, not proof of each product’s default. The IAB UK Hivestack PDF was inaccessible on repeated opens, so the six-case tally and its UK control method were not independently verified. Preserve the verifier’s geography qualification and mark that component unresolved; do not treat a campaign-specific comparator as a product default.Reviewer opened: https://perion.com/channels/dooh/ https://broadsign.com/measurement-attribution/ https://www.vistarmedia.com/partner-inmarket https://www.vistarmedia.com/news/foursquare-dooh-measurement-partner https://www.groundtruth.com/article/groundtruth-expands-into-digital-out-of-home-with-measurable-foot-traffic-attribution/ supported with qualificationOpened sources confirm Perion asserts a matched control, Broadsign’s Netherlands Decathlon case names non-exposed controls, and the opened Vistar and GroundTruth releases give no randomization procedure. These are bounded documentation findings, not proof of each product’s default. The IAB UK Hivestack PDF was inaccessible on repeated opens, so the six-case tally and its UK control method were not independently verified. Preserve the verifier’s geography qualification and mark that component unresolved; do not treat a campaign-specific comparator as a product default.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F24; data/claims-overlay.json
R2-56Hierarchical geographic cells are not part of AdCP at the cutoff versions: issue #5969 (geo_cells / geo_cells_exclude with an h3, s2, geohash or custom cell-system enum), opened by the paper's author on 21 July 2026, is OPEN with milestone 3.4.0 and labels rfc and needs-wg-review, its two companions (#6013 conversion, #6014 cell-grain delivery reporting) are also OPEN on milestone 3.4.0, no geo_cells pull request was found, and neither v3.2.6 nor v3.3.0-beta.0 contains a geo_cells field; under the brief's rules the proposal earns no protocol state.Verified through the GitHub connector: issue 5969 and companions 6013/6014 are open on milestone 3.4.0; creation dates and labels match. Neither the v3.2.6 nor v3.3.0-beta.0 targeting properties contain geo_cells. A repository PR search for geo_cells returned zero results. Retain the proposal/no-state distinction and bound the PR absence to that search.Reviewer opened: https://github.com/adcontextprotocol/adcp/issues/5969 https://api.github.com/repos/adcontextprotocol/adcp/issues/5969 https://api.github.com/repos/adcontextprotocol/adcp/issues/6013 https://api.github.com/repos/adcontextprotocol/adcp/issues/6014 https://github.com/adcontextprotocol/adcp/blob/v3.2.6/static/schemas/source/core/targeting.json https://github.com/adcontextprotocol/adcp/blob/v3.3.0-beta.0/static/schemas/source/core/targeting.json https://api.github.com/search/issues?q=repo%3Aadcontextprotocol%2Fadcp%20is%3Apr%20geo_cells supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-J-F05; data/claims-overlay.json
R2-57An implemented AdCP connector maps administrative geo targeting into an ad server: the Prebid Sales Agent v2.0.0 (1 July 2026) translates geo_countries, geo_regions and geo_metros (Nielsen DMA only) and their exclusions into Google Ad Manager targetedLocations, but rejects geo_postal_areas with an explicit error ("not implemented in GAM static mapping") and contains no handling for geo_proximity, store_catchments or geo_places in the targeting manager read.The verifier is correct: release v2.0.0 was published 1 July 2026; pyproject pins adcp Python SDK 5.7.0 and explicitly identifies spec 3.1.0-beta.3. The manager maps country, region and Nielsen-DMA targets and exclusions, raises on postal targeting/exclusion, and contains none of geo_proximity, store_catchments or geo_places. This establishes a versioned implementation, not a successful live buy or an observed failed postal-targeted transaction.Reviewer opened: https://github.com/prebid/salesagent/blob/v2.0.0/src/adapters/gam/managers/targeting.py https://github.com/prebid/salesagent/blob/v2.0.0/pyproject.toml https://api.github.com/repos/prebid/salesagent/releases/tags/v2.0.0 supported with qualificationThe verifier is correct: release v2.0.0 was published 1 July 2026; pyproject pins adcp Python SDK 5.7.0 and explicitly identifies spec 3.1.0-beta.3. The manager maps country, region and Nielsen-DMA targets and exclusions, raises on postal targeting/exclusion, and contains none of geo_proximity, store_catchments or geo_places. This establishes a versioned implementation, not a successful live buy or an observed failed postal-targeted transaction.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-J-F06; data/claims-overlay.json
R2-58In the public AAO agent registry on 24 October 2026, none of the 34 registered agents shows a passing geo or DOOH conformance test: geo_region_targeting, geo_region_all_values_support, geo_region_exclusion_support and geo_place_targeting appear only on the two agents graded on AdCP 3.2.6 (goTom Sandbox and Publink) and are untested (0/0 steps) on both, no agent declares the sales-dooh specialism, and the 11 agents holding a verified badge hold it only in spec mode, none in the live-traffic mode.The API at https://agenticadvertising.org/api/registry/agents?limit=500 was inaccessible through the web tool, and direct HTTP returned 403. The registry UI opened only an empty shell. Therefore none of the 34/11/0 counts, per-agent storyboards, three-versus-two spec-version correction or badge-mode tally was independently verified. Retain as unresolved until the dated raw list and per-agent compliance responses are supplied; neither the original nor the verifier’s correction earns support from this review.Reviewer opened: https://agenticadvertising.org/registry/?tab=agents supported with qualificationThe API at https://agenticadvertising.org/api/registry/agents?limit=500 was inaccessible through the web tool, and direct HTTP returned 403. The registry UI opened only an empty shell. Therefore none of the 34/11/0 counts, per-agent storyboards, three-versus-two spec-version correction or badge-mode tally was independently verified. Retain as unresolved until the dated raw list and per-agent compliance responses are supplied; neither the original nor the verifier’s correction earns support from this review.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-J-F07; data/claims-overlay.json
R2-59The strongest public claims of location signals in agent-driven AdCP buys are vendor releases that do not record the signal or the protocol version: PubMatic and Butler/Till (15 December 2025) describe an AdCP-enabled CTV campaign for Clubtails "delivering geo-targeted, premium CTV inventory" without naming a field or geographic unit, and Broadsign (27 May 2026) describes a Netherlands OOH campaign in which agents using AdCP informed "audience and venue targeting" without naming identifiers or delivery metrics; neither reaches documented production use of a named location signal under H7's ru…The full PubMatic/Butler-Till release and full Broadsign release were opened. They report executed/live campaigns using AdCP and geographic or venue targeting, but neither identifies a protocol version or a specific carried location field. The verifier’s distinction is correct under H7’s strict rule. Keep the positive vendor production claims visible while stating that they fall short of this paper’s field-and-version evidence requirement; do not describe them as merely future launches.Reviewer opened: https://www.businesswire.com/news/home/20251215976339/en/PubMatic-and-ButlerTill-Launch-AdCP-Enabled-Agentic-AI-Campaign-Across-CTV https://broadsign.com/blog/broadsigns-sell-side-ai-agent-joins-with-global-netherlands-and-draft-digital-to-deliver-first-ever-end-to-end-agentic-ai-powered-ooh-campaign/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-J-F08; data/claims-overlay.json
R2-60The non-agentic baseline is further along than any agentic protocol: OpenRTB 2.6 defines a Geo object (lat, lon, type, accuracy, lastfix, ipservice, country, region, metro, city, zip, utcoffset) plus DOOH venue types and a qty impression multiplier, and Google Authorized Buyers documents production bid requests in which geo type is always set to IP (2) and accuracy reflects coarse IP-based geolocation, i.e. documented production use of coarse, inferred location rather than device-observed location.The OpenRTB Geo/Qty/DOOH definitions and Google’s documented coarse IP-based request population support the baseline claim. Google marks the type field as optional, so “always IP” describes its value when populated, not presence in every request. Replace the universal comparison with “the opened Google baseline reaches documented use, whereas the screened agentic evidence has not satisfied H7’s field-and-version criterion.” These sources alone do not establish superiority over every agentic protocol.Reviewer opened: https://raw.githubusercontent.com/InteractiveAdvertisingBureau/openrtb2.x/main/2.6.md https://developers.google.com/authorized-buyers/rtb/openrtb-guide supported with qualificationThe OpenRTB Geo/Qty/DOOH definitions and Google’s documented coarse IP-based request population support the baseline claim. Google marks the type field as optional, so “always IP” describes its value when populated, not presence in every request. Replace the universal comparison with “the opened Google baseline reaches documented use, whereas the screened agentic evidence has not satisfied H7’s field-and-version criterion.” These sources alone do not establish superiority over every agentic protocol.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-J-F11; data/claims-overlay.json
R2-61Inference for H7 at 24 October 2026: across AdCP 3.2.6, AAMP components, ARTF 1.0 and the location-vendor interfaces screened, the highest documented state for any location signal in agent-driven buying is an implemented connector (AdCP administrative geo to Google Ad Manager in the Prebid Sales Agent); geographic cells reach no state, geo_proximity, store catchments, geo_places, venue identifiers, DOOH metrics and foot_traffic reach schema representation only, no interoperability test result is public, and the two vendor-claimed agentic campaigns do not record a location field, so H7 is unre…The highest state independently established here is the Prebid administrative-geo connector against AdCP 3.1.0-beta.3; v3.2.6 contains additional geographic and DOOH schema fields. The verifier’s version qualification is sound. The campaign releases do not meet H7’s version-and-signal test. However, the registry API could not be checked, vendor-interface and all-protocol absence was not exhaustively re-established, and source-code postal refusal creates a rule-interpretation issue. Report H7 unresolved on the verified positive record, with these explicit limits; bound all no-interoperability/no-production statements to the searched evidence.Reviewer opened: https://github.com/adcontextprotocol/adcp/blob/v3.2.6/static/schemas/source/core/targeting.json https://github.com/adcontextprotocol/adcp/blob/v3.2.6/static/schemas/source/core/delivery-metrics.json https://github.com/adcontextprotocol/adcp/blob/v3.2.6/static/schemas/source/core/placement.json https://github.com/prebid/salesagent/blob/v2.0.0/src/adapters/gam/managers/targeting.py https://github.com/prebid/salesagent/blob/v2.0.0/pyproject.toml https://github.com/IABTechLab/OpenProposal/blob/main/spec/openproposal-3.0.md https://github.com/IABTechLab/agentic-real-time-framework/blob/main/proto/agenticrtbframework.proto https://www.businesswire.com/news/home/20251215976339/en/PubMatic-and-ButlerTill-Launch-AdCP-Enabled-Agentic-AI-Campaign-Across-CTV https://broadsign.com/blog/broadsigns-sell-side-ai-agent-joins-with-global-netherlands-and-draft-digital-to-deliver-first-eve… supported with qualificationThe highest state independently established here is the Prebid administrative-geo connector against AdCP 3.1.0-beta.3; v3.2.6 contains additional geographic and DOOH schema fields. The verifier’s version qualification is sound. The campaign releases do not meet H7’s version-and-signal test. However, the registry API could not be checked, vendor-interface and all-protocol absence was not exhaustively re-established, and source-code postal refusal creates a rule-interpretation issue. Report H7 unresolved on the verified positive record, with these explicit limits; bound all no-interoperability/no-production statements to the searched evidence.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-J-F13; data/claims-overlay.json
R2-62Mobvista (HKEX: 1860) presents itself at the cutoff as a mobile app-growth company whose product lines are Mintegral (user acquisition and monetisation), GameAnalytics, Nativex, Mindworks, Playturbo and XMP; its homepage names no location product, so it is excluded from the location cohorts.The opened homepage’s listed businesses match the claim. No separately named location-advertising product was identified in that page’s product menu. Exclusion on this bounded product-admission basis is supported; it is not evidence that no product exists anywhere.Reviewer opened: https://www.mobvista.com/en/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F01; data/claims-overlay.json
R2-63Infillion announced on 18 September 2026 an agreement to acquire Foursquare (terms undisclosed); the release refers to leadership joining 'after the transaction closes', so on the settling party's own record the event is an acquisition announced and pending, even though Foursquare's homepage banner reads 'Foursquare has joined Infillion' at 24 October 2026.The September 18 announcement establishes an announced acquisition and describes closing as future then. The currently opened Foursquare page says it has joined Infillion. Those sources do not establish a closing date or prove that the transaction remained pending on October 24. Record announced September 18; current company website says joined; closing date/status not independently settled. The verifier’s definite pending classification at the later date is too strong.Source check G3 (24 October 2026, primary sources opened): LOC-U-F02: reclassified from 'announced, pending' to 'announced; target says joined; closing date unconfirmed'. No closing release found 24 Oct; secondary 'acquired' claims were unopenable. https://infillion.com/blog/infillion-to-acquire-foursquare-closing-the-loop-between-advertising-and-real-world-results/ https://foursquare.com/ https://finance.yahoo.com/media-advertising/articles/exclusive-infillion-acquires-location-data-192246542.html supported with qualificationInfillion announced on 18 September 2026 that it is acquiring Foursquare (no terms disclosed), and the release treats closing as a future event. By 24 October 2026 Foursquare's homepage says it 'has joined Infillion', but no closing announcement or date was found, so completion is unconfirmed rather than pending.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F02; data/claims-overlay.json
R2-64T-Mobile US owns both a DOOH SSP and a location-led DSP from the seed list: it completed the acquisition of Vistar Media on 3 February 2025 for US$621 million in cash (agreement 20 December 2024) and of Blis Holdco Limited on 3 March 2025 for US$180 million (agreement 18 February 2025), and Blis's homepage title reads 'Blis, part of T-Ads | Omnichannel DSP'.Closing dates and gross cash amounts are supported. Label $621m for Vistar and $180m for Blis as cash transferred, not acquisition fair values. The 10-K excludes settlement of preexisting relationships: acquisition consideration is $617m for Vistar and $174m for Blis. The verifier identified only the Blis distinction. Both full SEC filings were downloaded and read after the web fetcher’s size limit.Source check G3 (24 October 2026, primary sources opened): LOC-U-F05: labelled 621/180 'cash transferred' and added 617/174 consideration for both deals (verifier had only Blis). https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm evidence/verify/U.json supported with qualificationT-Mobile US completed its acquisitions of Vistar Media on 3 February 2025 (agreement 20 December 2024) and of Blis Holdco Limited on 3 March 2025 (agreement 18 February 2025), transferring cash of US$621 million and US$180 million respectively. Excluding payments that settled preexisting relationships, the 10-K puts the fair value of consideration at US$617 million (Vistar) and US$174 million (Blis), both provisional. Blis's homepage is titled 'Blis, part of T-Ads | Omnichannel DSP'.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F05; data/claims-overlay.json
R2-65Bluedot, the seed developer-geofencing vendor, is no longer independent: Rezolve AI plc agreed on 4 February 2025 to buy the share capital of Bluedot Industries, Inc. (Delaware) and Bluedot Industries Pty. Ltd. and closed on 20 February 2025 for 819,737 ordinary shares, a related-party deal (the seller DBLP is wholly owned by a Rezolve director) accounted for as a common-control transfer; bluedot.io now redirects to rezolve.com.The opened full 20-F supports the named entities, February 4 agreement, February 20 close, 819,737 shares and related-party/common-control accounting; the domain redirects to Rezolve. Preserve the entity scope: Rezolve separately acquired Bluedot Innovation in March 2025, so this transaction is not necessarily the full consideration for every business operating under the Bluedot brand.Reviewer opened: https://www.sec.gov/Archives/edgar/data/1920294/000119312526132456/rzlv-20251231.htm https://bluedot.io/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F07; data/claims-overlay.json
R2-66Outlogic (formerly X-Mode, under an FTC order banning sale of sensitive location data) still licenses an 'Observation Panel', attribution data and audiences at the cutoff through Snowflake, daily and hourly AWS S3 exports, a REST API, Eyeota and Adsquare, and its homepage notice under Texas law says it 'may receive and sell the precise latitude and longitude coordinates of your mobile device'.The opened homepage confirms the Observation Panel and delivery routes, the no-bidstream assertion, and the Texas notice about possible precise-coordinate sales. Attribute these to Outlogic. Availability plus that notice supports continued marketed licensing; it does not establish any prohibited sensitive-location sale.Reviewer opened: https://outlogic.io/ supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F10; data/claims-overlay.json
R2-67Product names in the seed register have drifted by the cutoff in ways that change rows: Reveal sells the 'Mira Console' OOH measurement platform (no 'VISIT Local'); Azira sells Azira One, Azira Insights, Azira Audience, Azira Campaigns and Azira Measurement; Foursquare adds Proximity and the Spatial suite; Cuebiq sells Footfall Measurement and Cuebiq Audiences; Advan sells FIT, REI, REVEAL, SPENDVIEW and Patterns+; Kochava sells store visitation through Kochava Foundry; Bluedot is owned by Rezolve; and the name 'Reveal' now denotes three different products (Reveal Mobile, Advan REVEAL, Radar …The current names are largely confirmed, with two qualifications beyond the seed: Mira Console is a self-serve interface to Reveal’s measurement service, not proof that the whole product was renamed Mira; Kochava describes store visitation as an outcome available through partnerships/Foundry, not a separately named visitation SKU. Current menus establish present names, not a dated one-to-one rename history. Keep vendor-qualified names for the three different Reveal brands.Source check G3 (24 October 2026, primary sources opened): LOC-U-F26: Mira Console = self-serve UI, not a product rename; Kochava visitation = outcome, not a SKU; Advan has six products (REP added). https://revealmobile.com/ https://advanresearch.com/ https://www.kochava.com/ https://www.sec.gov/Archives/edgar/data/1920294/000119312526132456/rzlv-20251231.htm supported with qualificationBy the cutoff, vendors' current pages use these names: Reveal Mobile offers OOH measurement with reporting through its self-serve 'Mira Console' (no 'VISIT Local'); Azira lists Azira One, Insights, Audience, Campaigns and Measurement; Foursquare adds Proximity and the Spatial suite; Cuebiq lists Footfall Measurement and Cuebiq Audiences; Advan lists FIT, REI, REVEAL, SPENDVIEW, Patterns+ and REP. Kochava lists store/footfall visitation as a measurable outcome via data partnerships and Kochava Foundry reporting rather than a named product, Bluedot is owned by Rezolve (acquisitions closed February and March 2025), and 'Reveal' denotes three vendors' products (Reveal Mobile, Advan REVEAL, Radar Reveal). These are current names, not a dated rename history.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F26; data/claims-overlay.json
R2-68IAB's location-data guidance is a 2016 publisher guide and a 2014 buyer's guide: the 'IAB Mobile Location Data Guide for Publishers' (February 2016, revised; IAB Mobile Location Working Group, with contributors including Factual, Foursquare, NinthDecimal, Thinknear and xAd) defines accuracy and precision and gives the two-decimal (about 1 km) and four-decimal (about 10 m) equivalences, while the 'Mobile Location Data Buyer's Guide' (1 July 2014) is gated; this review found no later IAB or IAB Tech Lab location-data buyer or seller guide in the sources screened by the cutoff.The internal verifier is right: IAB published the buyer-facing Location-based Marketing Playbook for Retailers in April 2017. It asks about panel versus ad-exchange collection and control selection, and cites February 2015 Marketing ROI and Location Data plus 12 Questions Every Buyer Should Ask. The original bounded search missed a later guide; do not present 2016 as the newest located IAB guidance.Source check G1 (24 October 2026, primary sources opened): R2-68: accepted. The April 2017 IAB retail playbook supersedes the '2016 is newest' framing. Disclose Verve as a contributor. https://www.iab.com/wp-content/uploads/2017/04/IAB_Location-Playbook-for-Retail-Marketers_FINAL.pdf https://www.iab.com/wp-content/uploads/2017/04/IAB_Location-Playbook-for-Retail-Marketers_FINAL.pdf https://www.iab.com/wp-content/uploads/2017/04/IAB_Location-Playbook-for-Retail-Marketers_FINAL.pdf contradictedIAB's location-data guidance found by the cutoff runs from the gated 'Mobile Location Data Buyer's Guide' (July 2014) and the February 2016 'Mobile Location Data Guide for Publishers' to the April 2017 'Location-based Marketing Playbook for Retailers'. The playbook is buyer-facing and asks whether device data come 'through panels or pass through ad exchanges' and how store-visit-lift control groups are selected. It cites 'IAB Marketing ROI and Location Data' (February 2015) and '12 Questions Every Buyer Should Ask about Location Data'. No IAB or IAB Tech Lab location guide later than April 2017 was found in the sources screened.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-A-F22; data/claims-overlay.json
R2-69None of the opened documentation for the fourteen cohort A products publishes a comparison of its visit numbers with an independent reference (door counts, transactions or official visitor statistics) with error statistics; the validation claims found are vendor assertions without a document: InMarket's 'Comscore-Verified Visit Methodology' and GroundTruth's Blueprints 'verified using a selection of trusted location sources'.The verifier is right: Azira reports MAPE 10% and correlation 0.85 against sales/counters. The page supplies no reproducible sample, period, places or held-out design. Report this as a vendor assertion, not independent validation.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology contradictedThe verifier is right: Azira reports MAPE 10% and correlation 0.85 against sales/counters. The page supplies no reproducible sample, period, places or held-out design. Report this as a vendor assertion, not independent validation.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-E-F31; data/claims-overlay.json
R2-70Azira Audience (live, 2026) builds segments 'based on real-world visitation, purchase behavior, and consumer intent' from '13T Global Mobility Signals', '35.6 Billions consumer transactions' and '43M Points of Interest', activates through Azira's own Advance DSP (claimed 80-90% addressability) across desktop, mobile, CTV, audio, DOOH and social, supports custom polygons and visit duration, and uses device graphs that 'analyze IP addresses and home or daytime locations'; no collection route for the mobility signals is stated.The verifier correctly rejects “no collection route”: Azira discloses a blend without proportions. Keep the 80–90% addressability number attributed to its 5 January 2025 marketing blog, without treating it as measured accuracy. The current data page shows 45m+ global POIs while the digest cites 43m from a different page; retain URL/access-date-specific values. The proposed “within 3m precision” addition was not found on the opened current Audience page and should remain unresolved without its exact captured source.Reviewer opened: https://www.azira.com/platform/data https://www.azira.com/solutions/azira-audience https://www.azira.com/platform/privacy https://www.azira.com/blogs/how-to-use-a-next-generation-demand-side-platform-powered-by-single-data-set-to-boost-return-on-ad-spend contradictedThe verifier correctly rejects “no collection route”: Azira discloses a blend without proportions. Keep the 80–90% addressability number attributed to its 5 January 2025 marketing blog, without treating it as measured accuracy. The current data page shows 45m+ global POIs while the digest cites 43m from a different page; retain URL/access-date-specific values. The proposed “within 3m precision” addition was not found on the opened current Audience page and should remain unresolved without its exact captured source.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F07; data/claims-overlay.json
R2-71GroundTruth Ads Manager documents the widest channel set of any cohort B product opened (mobile, CTV and OTT, audio, DOOH with '1M+ digital out-of-home screens across the US', and direct mail) but names no third-party DSP activation, only reporting integrations with TapClicks, NinjaCat and Agency Analytics; Foursquare, Adsquare, Precisely, Reveal and Mobilewalla name external DSPs or marketplaces, while Azira, Vistar and Simpli.fi activate through their own platforms.The verifier is right to add GroundTruth’s desktop/tablet channel and reject unique “widest” status. GroundTruth documents six categories including direct mail; Azira documents desktop/mobile, audio, video, CTV, DOOH and social. Under the brief’s common channel taxonomy both have mobile, desktop/web, CTV, audio and DOOH, plus one additional category. State the channel sets; remove the superlative unless all cohort rows are recoded consistently. GroundTruth’s named reporting integrations do not by themselves establish audience activation into third-party DSPs.Reviewer opened: https://www.groundtruth.com/solutions/ads-manager/ https://www.azira.com/solutions/azira-campaigns https://www.azira.com/blogs/how-to-use-a-next-generation-demand-side-platform-powered-by-single-data-set-to-boost-return-on-ad-spend contradictedThe verifier is right to add GroundTruth’s desktop/tablet channel and reject unique “widest” status. GroundTruth documents six categories including direct mail; Azira documents desktop/mobile, audio, video, CTV, DOOH and social. Under the brief’s common channel taxonomy both have mobile, desktop/web, CTV, audio and DOOH, plus one additional category. State the channel sets; remove the superlative unless all cohort rows are recoded consistently. GroundTruth’s named reporting integrations do not by themselves establish audience activation into third-party DSPs.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-F-F24; data/claims-overlay.json
R2-72Connecticut's Public Act 25-113 (SB 1295) amends the Connecticut Data Privacy Act effective 1 July 2026 so a controller shall 'not sell the sensitive data of a consumer without the consumer's consent' (sensitive data includes precise geolocation data, defined by a 1,750-foot radius), a consent rule rather than a sale ban, and restricts collection of minors' precise geolocation to what is strictly necessary with a persistent signal.The original consent-only description is outdated at this review date. Connecticut’s Attorney General states that the October 1, 2026 changes under PA 26-64 include a precise-geolocation sale ban, confirming the verifier’s core correction. The official act PDF repeatedly returned 502/503, so I have not independently checked every subsection, exception or approval-date detail in its proposed replacement; cite the opened AG notice for the confirmed change.Source check G4 (24 October 2026, primary sources opened): R2-72 accepted: PA 26-64 Secs. 14-15 sale ban (eff. 1 Oct 2026, approved 27 May 2026) read at cga.ct.gov (opened fine, no 502) and matches the AG notice of 16 Sep 2026; consent-only reading is outdated. https://portal.ct.gov/ag/press-releases/2026-press-releases/rights-and-requirements-related-to-new-and-updated-privacy-laws https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF contradictedConnecticut bans the sale of precise geolocation data: Public Act 26-64 (SB 4, approved 27 May 2026, effective 1 October 2026) provides that no controller and no third party shall sell any consumer's precise geolocation data (1,750-foot radius; content of communications and utility metering data excepted), replacing the consent-to-sell rule PA 25-113 had put in place from 1 July 2026. Data brokers selling or licensing brokered personal data in Connecticut must be registered from 1 January 2027.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F13; data/claims-overlay.json
R2-73Virginia's Consumer Data Protection Act (Code 59.1-575) defines precise geolocation data by a 1,750-foot radius and counts it as sensitive data, the category to which the act's consent requirement attaches; no Virginia sale ban or geofencing ban on precise geolocation was found in the section opened.The verifier is right on the operative rule. Section 59.1-578(A)(6) expressly bars sale or offers for sale of precise geolocation; the adjacent sensitive-data processing consent rule does not supply a consent exception to that sale ban. A definitions-only lookup cannot support the original current-law reading.Source check G4 (24 October 2026, primary sources opened): R2-73 accepted: VA 59.1-578(A)(6) sale ban verified at law.lis.virginia.gov; ch. 820 (SB 338) approved 13 Apr 2026, effective 1 Jul 2026 per LIS bill history (replaces the Willkie-sourced date). https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/ https://lis.virginia.gov/bill-details/20261/SB338/text/CHAP0820 https://lis.virginia.gov/bill-details/20261/SB338 contradictedVirginia bans the sale of precise geolocation data: Code of Virginia 59.1-578(A)(6), added by 2026 Acts ch. 820 (SB 338, approved 13 April 2026, effective 1 July 2026), requires a controller to "not sell or offer for sale precise geolocation data concerning a consumer", with no consent exception; other processing of sensitive data, including precise geolocation, still requires consent under 59.1-578(A)(5).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F16; data/claims-overlay.json
R2-74GroundTruth's DOOH attribution, announced on 9 October 2025 with Place Exchange, 'captures mobile device IDs within viewing range of a screen when an ad plays' and links them to later store visits using GroundTruth's own 'location and purchase data' based on 'observed real-world consumer behavior'; the release cites a belVita campaign with Target reported at 221,000 in-store visits in one month and a 3.44% visitation rate, with 'more than half of those visits being incremental', and describes no control design beyond offering 'third-party lift studies'.The verifier is correct. The 221,000 Target visits and 3.44% rate belong to the belVita omnichannel DOOH-plus-mobile case. The claim that over half the visits were incremental belongs to a separate unnamed national retailer’s 42,000-plus visits in New York, Chicago and Los Angeles. Keep the two cases separate and vendor-attributed; the release gives no comparator design for the incremental assertion.Reviewer opened: https://www.groundtruth.com/article/groundtruth-expands-into-digital-out-of-home-with-measurable-foot-traffic-attribution/ https://billboardinsider.com/ground-truth-partners-with-place-exchange-for-foot-traffic-attribution/ contradictedThe verifier is correct. The 221,000 Target visits and 3.44% rate belong to the belVita omnichannel DOOH-plus-mobile case. The claim that over half the visits were incremental belongs to a separate unnamed national retailer’s 42,000-plus visits in New York, Chicago and Los Angeles. Keep the two cases separate and vendor-attributed; the release gives no comparator design for the incremental assertion.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-I-F17; data/claims-overlay.json
R2-75Three seed data suppliers describe their supply as SDK or server-to-server first-party app data with explicit counts at the cutoff: Quadrant ('an Appen company', '1+ billion opted in devices', '50+ billion daily location events', compiled 'through a server to server (S2S) integration'), Complementics ('over 1 billion global devices', location events 'from multiple supply sources') and Outlogic ('No Bidstream Data'); none gives a US-only count or a period.The verifier’s correction is supported. Quadrant supplies the S2S route and global counts; Complementics supplies a global count and multiple supply sources without establishing that route; Outlogic supplies first-party/no-bidstream claims without a count. Complementics is absent from the seed register. Do not turn those three different disclosures into three documented SDK/S2S sources with counts.Reviewer opened: https://www.quadrant.io/ https://complementics.com/ https://outlogic.io/ contradictedThe verifier’s correction is supported. Quadrant supplies the S2S route and global counts; Complementics supplies a global count and multiple supply sources without establishing that route; Outlogic supplies first-party/no-bidstream claims without a count. Complementics is absent from the seed register. Do not turn those three different disclosures into three documented SDK/S2S sources with counts.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-U-F15; data/claims-overlay.json
R2-76In the California Data Broker Registry download of 24 October 2026 (603 rows, covering brokers that operated in 2025), Collective Data Solutions, LLC (Sandpoint, Idaho), Outlogic, LLC, InMarket Media, LLC, Mobilewalla, Inc., Unacast, Inc. and Venntel, Inc. are all registered and each reports collecting consumers' precise geolocation; Unacast and Venntel also report having shared or sold consumers' data to the federal government and to other state governments in the past year; Kochava Inc. itself is not listed.The downloaded CSV contains 603 rows. CDS, Outlogic, InMarket, Mobilewalla, Unacast and Venntel each self-report collecting precise geolocation; Unacast and Venntel report past-year federal and state-government sale/sharing. Kochava Inc. is not a row. These are submitted disclosures covering prior activity, not regulatory verification or proof of precise-data sales at the October 2026 cutoff. In particular, a collection checkbox cannot resolve Mobilewalla's sold-product precision.Source check G5 (24 October 2026, primary sources opened): R2-76: every number and flag reproduced from registry.csv; qualification (self-reported, collection not sale, 2025 activity) added; 115/603 denominator added. https://cppa.ca.gov/data_broker_registry/registry.csv https://cppa.ca.gov/data_broker_registry/registry.csv https://cppa.ca.gov/data_broker_registry/registry.csv https://cppa.ca.gov/data_broker_registry/registry.csv supported with qualificationIn the California Data Broker Registry file (603 registrants that operated as data brokers in 2025; file dated 29 July 2026, downloaded 24 October 2026), Collective Data Solutions, Outlogic, InMarket, Mobilewalla, Unacast, Inc. and Venntel each self-report collecting precise geolocation (115 of the 603 registrants do), and Unacast and Venntel report past-year sale or sharing to the federal government and other state governments. Kochava Inc. is not listed. These are the brokers' own declarations about collection in 2025, not evidence of what they sold at the cutoff.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.evidence/research LOC-H-F15; data/claims-overlay.json
R2-77H1The unresolved reading follows the registered rule on the opened evidence: no comparable falling US panel series plus a documented primary-source shift was established. Permission announcements cannot supply the missing outcome. A constant-definition pre/post series for at least two vendors, or a qualifying official attribution combined with a documented shift away from SDK primary supply, would change the reading. Do not infer contraction from corporate exits or unlike reach units.Reviewer opened: https://www.ftc.gov/system/files/ftc_gov/pdf/Complaint-InMarketMediaLLC.pdf https://docs.safegraph.com/docs/monthly-patterns https://www.utah.gov/pmn/files/1194509.pdf supported as statedNone: H1 stays unresolved under its registered rule.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H1
R2-78H2The registered rule produces a contradicted reading for the historical SafeGraph polling-place use tested, because published demographic bias is documented without a stated error. It does not produce one verdict for every vendor, product and vintage. Current retail projections remain unresolved where comparable validation is absent.Reviewer opened: https://arxiv.org/pdf/2011.07194 supported with qualificationSuperseded by the reviewer's own revision (R2B-35): the 2018 SafeGraph polling-place coverage bias is reported as adverse historical evidence; its formal contradicted reading for that panel is conditional on the error claim and on no equal-or-better rebuttal; H2 is unresolved overall, with no single verdict across products and vintages.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H2; LOC-B-F31
R2-79H3The exact documented-default count is not securely established by this review. Five opened product descriptions describe modeled/matched methods and Azira explicitly calls its PSA design the default, but the former need product-level evidence that the description governs default reporting. H3 would be contradicted if those five qualify; report that conditional result separately from an adjudicated default count. Blis documents a geographic holdout without proof of random assignment or default use, and that holdout can qualify under the broad registered category. Rebuild the product/metric default table and report disclosure coverage before finalizing the reading.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology https://blis.com/omnichannel-measurement/ https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://revealmobile.com/solutions/measurement https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://cuebiq.com/blog/ctv-ltv-attribution/ https://www.arrivalist.com/media-insights supported with qualificationSuperseded by the 14-product recount (R2B-09 to R2B-23, checked in G7): 6 matched or synthetic, 2 randomised or holdout (Azira randomised PSA; Blis geographic holdout, randomisation not documented), 1 exposed-only (GroundTruth), 5 not documented. 7 of 9 documented defaults are non-holdout, so H3 reads contradicted; the strict lift-claim count (GroundTruth excluded) is 6 of 8. Every sensitivity variant (without Adsquare; without the InMarket mapping) stays contradicted.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H3; LOC-E-F28; LOC-C-F23
R2-80H4The unresolved reading is defensible, but the original and verifier denominators are not ready to publish. Source presence is not documented dominance. Treat Foursquare, InMarket and Azira as mixed/disclosed-but-primary-unknown on the opened records. Rebuild product-specific coding after U changes and count Broadsign only once US eligibility is established. H4 needs at least four products with an established primary source; a supplier list or opt-in claim cannot meet that threshold.Reviewer opened: https://foursquare.com/legal/privacy-center/foursquare-privacy-policy-consumer-services/ https://inmarket.com/data/ https://www.azira.com/platform/data https://broadsign.com/audiences/ supported as statedNone: H4 stays unresolved; Foursquare, InMarket and Azira recoded 'multiple sources disclosed, primary not established' (R2-37).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H4; LOC-F-F20
R2-81H5The contradicted reading follows the existential rule from Outlogic’s and CDS’s current explicit precise-data marketing. Unacast adds a qualified preceding-year precise-sale disclosure alongside current location products; Mobilewalla’s sold-product precision remains unknown. The exact four-company current-seller count does not follow. Clarify precedence: a verified counterexample refutes universal withdrawal even if other product sets remain unreadable or precision-unclear; keep those company-specific unknowns unresolved. Record this as a rule clarification, not a compliance judgment.Source check G5 (24 October 2026, primary sources opened): R2-81: precedence note added (counterexample beats partial unreadability); count is 3 documented + Mobilewalla unclear, not 4 and not 2. research/location-2026/data/hypotheses.json (H5) https://www.unacast.com/privacy-policy https://www.mobilewalla.com/california-privacy-notice-2023 https://www.mobilewalla.com/privacy-center supported with qualificationH5 is contradicted: Outlogic and Collective Data Solutions (for Kochava) market precise-location offers at the cutoff, and Gravy Analytics dba Unacast documents a current device-level data offer plus a preceding-year precise-sale notice; Mobilewalla is unclear on precision; InMarket documents none (check G5). Precedence clarified in hypotheses.json (dated).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H5; LOC-H-F23
R2-82Gravy Analytics, Inc. dba ‘UnacastThe current Unacast menu markets location-data products, and Gravy dba Unacast’s current policy lists precise-geolocation sales to third parties over the preceding twelve months. This supports a continuing location business plus a time-window precise-sale disclosure; it does not by itself settle the precision of a feed still sold on 24 October. Record a qualified third disclosure, counting the group once. Current precise-data products under Venntel and their fit to the order’s government-use exclusions were not separately established.Source check G5 (24 October 2026, primary sources opened): R2-82: Unacast kept as a documented seller (Gravy dba Unacast, policy Sep 2026 + current device-level product); reviewer's 'qualified' downgrade only partly accepted; Venntel left open. https://www.unacast.com/privacy-policy https://www.unacast.com/privacy-policy https://www.unacast.com/products/location-data https://www.unacast.com/products/location-data supported with qualificationGravy Analytics, Inc., trading as Unacast, documents at the cutoff the sale of precise geolocation: its policy dated September 2026 lists 'Precise Geolocation Data' among categories sold in the preceding twelve months, and its current product page offers 'device-level location data'. The group counts once. Venntel's current precise-data products and their fit to the order's federal national-security exclusion were not established.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.H5: Gravy Analytics / Unacast / Venntel
R2-83we do not sell (in the plain language sense of that word) or license to customersThe policy also lists precise geolocation among data sold or shared for targeted advertising in the preceding year. It expressly denies ordinary-language precise-data sale or customer licensing. The broad statutory sale/share notice therefore does not establish a licensed precise-data product or an order breach. Record product withdrawal as not contradicted by this notice, rather than claiming public proof that no prohibited disclosure occurs.Source check G5 (24 October 2026, primary sources opened): R2-83: both InMarket passages and order Provision II confirmed verbatim; coded 'not contradicted by the notice', not 'proven withdrawn'. https://inmarket.com/privacy/ https://inmarket.com/privacy/ https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf supported with qualificationInMarket documents no product that sells or licenses precise location data at the cutoff: its policy (updated 30 June 2026) says it does 'not sell (in the plain language sense of that word) or license to customers' precise geolocation. The same policy discloses state-law 'sale (or sharing for interest-based advertising)' of precise geolocation to third-party partners. That notice neither establishes a licensed product nor shows that no prohibited disclosure occurs.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.H5: InMarket
R2-84H5: Kochava / Collective Data SolutionsCounts through Collective Data Solutions’ explicit marketed precision-location data feeds, which were read via direct HTML download after the web fetch failed. Use that legal entity and feed disclosure, not Kochava Foundry’s outcome-reporting page. The sensitive-location prohibition and direct-service consent exception do not ban all non-sensitive precise-location licensing. Compliance is not assessed.Source check G5 (24 October 2026, primary sources opened): R2-84: CDS-Kochava link sourced to Dkt. 101 and Dkt. 138; CDS evidence strengthened with its own 'resold ... precise geolocation' disclosure; Foundry not relied on. https://collectivedata.io/ https://www.govinfo.gov/content/pkg/USCOURTS-idd-2_22-cv-00377/pdf/USCOURTS-idd-2_22-cv-00377-3.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf https://collectivedata.io/ supported with qualificationKochava counts through its subsidiary Collective Data Solutions, LLC, to which it transferred its data-broker business (D. Idaho Dkt. 101) and which is a co-defendant bound by the June 2026 stipulated order. CDS markets 'precision location' data feeds and states in its 1 October 2026 policy that it has resold precise geolocation, including lat-long coordinates, in the preceding twelve months. The order bans only sensitive-location data, with a direct-relationship consent exception, so this is not a compliance finding.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.H5: Kochava / Collective Data Solutions
R2-85Mobilewalla does process “movement data” that includes mobile advertising ID (MAID), latitude and longitudeCommercial licensing and movement-data processing are documented, but coordinates/device IDs alone do not disclose spatial precision or prove which fields are licensed. The order excludes coarse location. Do not count this as a fourth confirmed precise-data seller without a current feed schema, precision threshold or product statement tying that data to licensing. Do not infer withdrawal either.Source check G5 (24 October 2026, primary sources opened): R2-85: unclear kept; California notice (30 Jun 2026) added, which states the held data's precision but not the licensed fields. https://www.mobilewalla.com/privacy-center https://www.mobilewalla.com/privacy-center https://www.mobilewalla.com/california-privacy-notice-2023 https://www.ftc.gov/system/files/ftc_gov/pdf/Mobilewalla-D&O.pdf supported with qualificationMobilewalla is coded unclear. Its current notices say it licenses personal information to clients, processes MAID-linked lat/long 'movement data', holds CCPA-precise geolocation (1,850 ft) as its only sensitive category, and 'may use Sensitive Personal Information as a part of its marketing and advertising products'. None says that the licensed products deliver precise coordinates, so it is neither a confirmed precise-data seller nor shown to have withdrawn.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.H5: Mobilewalla
R2-86we may receive and sell the precise latitude and longitude coordinates of your mobile device.Counts as a documented marketed precise-data seller: the product is licensed and the company explicitly identifies precise-coordinate sales. The order restricts sensitive-location data and imposes other controls; it is not a blanket prohibition on every precise-data product. This is an existential counterexample to universal withdrawal, not a compliance judgment.Source check G5 (24 October 2026, primary sources opened): R2-86: confirmed verbatim on outlogic.io and its privacy notice (past-12-months sold = Yes for lat/long); no change beyond adding the privacy-notice table. https://outlogic.io/ https://outlogic.io/ https://www.ftc.gov/system/files/ftc_gov/pdf/X-ModeSocialDecisionandOrder.pdf supported with qualificationOutlogic (formerly X-Mode) documents at the cutoff the licensing of location data through Snowflake, S3 exports and an API, and states that it 'may receive and sell the precise latitude and longitude coordinates of your mobile device'; its privacy notice reports selling lat/long geolocation in the past 12 months. Its order bans sensitive-location data, not all precise data, so this is an existential counterexample to H5, not a compliance finding.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.H5: Outlogic
R2-87H6The registered rule yields contradicted as of 24 October 2026: the opened MRC lists contain no accredited visit or visit-lift metric. Neither the former Foursquare nor GroundTruth status changes that. A final cutoff verdict requires rereading the lists on or after the planned 30 October freeze.Reviewer opened: https://mediaratingcouncil.org/accreditation/digital https://mediaratingcouncil.org/accreditation/multimedia https://mediaratingcouncil.org/accreditation/out-of-home https://mediaratingcouncil.org/accreditation/television https://mediaratingcouncil.org/accreditation/radio https://mediaratingcouncil.org/accreditation/outside-US https://mediaratingcouncil.org/accreditation/services-under-review/digital https://mediaratingcouncil.org/accreditation/services-under-review/out-of-home https://mediaratingcouncil.org/accreditation/services-under-review/television https://mediaratingcouncil.org/accreditation/services-under-review/radio https://mediaratingcouncil.org/accreditation/services-under-review/services-outside-US supported as statedNone now: H6 contradicted as of 24 October 2026; MRC's lists are re-read at the 30 October freeze.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H6
R2-88adcp==5.7.0The supported branch is not met: the opened campaign releases omit protocol version and the carried field, and source code alone is below production use. The contradicted branch cannot be assigned from source code alone if “in a workflow or interoperability test” requires an observed attempt. Report unresolved provisionally with the verified connector state and the postal-branch ambiguity. A dated runtime trace or test recording a postal-targeting request and rejection would change the reading under the present literal negative rule.Reviewer opened: https://github.com/prebid/salesagent/blob/v2.0.0/src/adapters/gam/managers/targeting.py https://github.com/prebid/salesagent/blob/v2.0.0/pyproject.toml https://www.businesswire.com/news/home/20251215976339/en/PubMatic-and-ButlerTill-Launch-AdCP-Enabled-Agentic-AI-Campaign-Across-CTV https://broadsign.com/blog/broadsigns-sell-side-ai-agent-joins-with-global-netherlands-and-draft-digital-to-deliver-first-ever-end-to-end-agentic-ai-powered-ooh-campaign/ supported as statedNone: H7 unresolved. Author ruling (24 October 2026) recorded as a dated clarification: a by-design refusal seen only in code is not a signal that 'could not be carried'.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H7
R2-89n/a comes only from the cohort's applicability mask (cohorts[].applicable), never vendor by vendor.The masks do not fit the admitted outputs. Cohort C includes place-only datasets, raw movement feeds and projected footfall dashboards, while every C row must be scored for visit definition, visit-count validation and projection. Cohort D includes Places APIs alongside visit-detection SDKs, and A includes visitation reporting alongside lift. Register output-specific subcohorts or fixed task masks before scoring; otherwise a product that does not purport to project visits is treated as undocumented on an irrelevant capability. Do not use n/e to stand for non-applicability.Reviewer opened: structuralCohorts narrowed by product, not company: cohort D keeps geofencing and visit-detection SDKs and APIs; places and maps APIs and place-only datasets are listed; cohort C split into C1 (foot-traffic and visit analytics) and C2 (raw movement data) with fix-level anchors; cohort A kept whole with causal design scored as causal capability (R2B-01, R2B-37).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json cohorts; data/product-register.json
R2-90A product that reports observed counts only and documents that it does not project is scored against the 'documented as observed-only' notescoring-rules.json/dimensions/projection refers to an observed-only note but supplies no observed-only numeric anchors: anchors 1–5 all require a projection method. Supply explicit anchors or a preregistered subcohort mask before scoring raw feeds and observed-only products. Documenting that no projection is performed cannot be mapped reproducibly to the existing 0–5 ladder.Reviewer opened: structuralProjection removed from the Ground Quotient for every row and kept as a separate module for products making population claims (R2B-02).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json dimensions, modules.projection, composite_index.groups
R2-91Daily figures are not converted to monthly; they are scored on the monthly thresholds divided by four, marked derived.Remove the divide-by-four rule for daily unique devices. It assumes an undocumented daily-to-monthly turnover ratio. A panel with 12.5M identical devices every day has 12.5M monthly devices yet clears the 50M monthly tier under this rule. Additive API request counts need a separate rule: 1B requests a day over a stated 30-day month is 30B monthly requests, whereas the current divide-by-four ladder gives it tier 4 rather than tier 5 before evidence caps. Keep unique-device periods distinct; aggregate request counts only over a documented period.Reviewer opened: structuralDivide-by-four rule removed. Daily uniques set a labelled lower bound on monthly uniques on the same basis; daily API requests summed over a documented month; generic annualisation removed (R2B-03).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json scale (renamed documented production volume)
R2-92Bidstream 'devices seen' or 'reach' is an attribute, never a panel, and caps the cell at 2.Keep the distinction between a panel and bidstream reach, but do not call the resulting number a pure scale score. The anchor imposes a source-quality penalty even when production volume is documented, while source quality, precision and validation already have their own dimensions. Report volume and collection route separately or state explicitly that this is qualified panel scale. The campaign-count alternative in A also measures a different unit from devices; retain the unit and do not interpret the two as equivalent measurement coverage.Reviewer opened: structuralDimension renamed 'Documented production volume'; the bidstream ceiling at 2 is stated as an author policy and bidstream reach is never a panel.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json scale
R2-935,000,000 or more US places with polygons documented, with the place-base definition and date statedTreat the scale and place-count thresholds as author-set breadth categories, not demonstrated thresholds of accuracy or buyer suitability. A bespoke product that correctly measures the buyer's 200 stores can score 1 for coverage, while a much broader place base can score 5 without a stated minimum observation density per place. Separate mapped POI inventory from places with usable observations and a stated minimum reportability rule. Keep US scope, but report how bands change at the threshold boundaries and avoid implying that a larger panel or POI catalogue is intrinsically better for every buying task.Reviewer opened: structuralCoverage thresholds described as author-set breadth categories; places with reportable observations used where disclosed, otherwise the mapped base, and the cell says which.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json coverage
R2-94Group means plus shrinkage avoid both.The quotient still rewards omission of a documented weakness; change this claim. Worked example using the registered formula: six admitted A rows, all cells 3 except one row's privacy=0. That row has Raw=2.7, field mean F=2.95, k=12 and GQ=55.25. Replacing its privacy 0 with n/e gives Raw=3, recomputed F=3, k=11 and GQ=60; it remains band-eligible. Deletion sensitivity exposes this 4.75-point gain but does not prevent it. Describe the quotient as conditional on observed evidence and surface missingness beside it; do not claim shrinkage removes the incentive to omit poor evidence.Reviewer opened: structuralReproduced exactly (GQ 55.25 with the privacy 0; 60.00 with it as n/e). The quotient text now says shrinkage limits but does not remove the reward for omission and that the quotient is conditional on the evidence observed; the formula is the shared method's and is unchanged.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json composite_index.why_not_a_sum
R2-95a regulator order, court finding or documented breach involving the product's location dataSeparate the three-year adverse-record flag from current privacy controls. The current privacy anchor equates a breach, a consent order and an adverse court finding, locks the score at 0 despite independently verified remediation, and permits an abrupt change when the event leaves the window. Record event type, product scope, responsible entity, event date and remediation separately; score current controls from current evidence and retain a visible recent-event warning. If the author instead wants a non-compensable risk rule, label it as an author-defined exclusion or flag rather than a measure of current consent posture. Do not infer liability or noncompliance from a consent order alone.Reviewer opened: structuralAuthor ruling (24 October 2026), refined by R2B-05: the cell records current controls (anchors 1-5) and an event flag; the GQ uses an author-defined risk-adjusted value, min(current controls, 1), while a qualifying event is inside the three-year window, shown beside the uncapped score with its effect on GQ; 0 only for a positively documented current failure; n/e is never imputed as 1.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json privacy
R2-96a commissioned third-party certification or audit of the product's segments or data practicesThe B/C/D assurance ladders are not monotone in assurance achieved: a completed commissioned audit scores 2, while an independent audit merely in progress scores 3. Payment, conflict of interest, auditor independence, audit scope, published result and currency are distinct attributes. Define them separately and require an achieved, scoped result to outrank a process with no result. Keep security-only certifications under privacy. A's top anchor should also say every visit or lift metric actually sold, rather than literally requiring both visit and lift metrics from a visitation-only product.Reviewer opened: structuralAssurance ladders made monotone in achieved scope (R2B-04); a pending audit is a status flag, not a score; withdrawal or lapse is a history flag, not 0.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json assurance
R2-97Independent means produced by a party with no financial interest; unknown funding is not independent.Keep commissioned evidence labelled and distinguish it from a study with no vendor funding, but do not silently apply a different independence test across cohorts. MRC assurance is judged from an accreditor record in A, while paid certifier audits are capped at 2 in B/C/D. Specify when an independently governed external auditor can provide assurance despite being paid, and when a sponsor's influence instead makes the evidence vendor-commissioned validation. Otherwise the score ranks institutional form and funding model as well as audit quality.Reviewer opened: structuralOne independence test in every cohort: verified scheme governance, impartiality controls, published criteria and a public scope and result; normal fees do not disqualify. cell_rules.evidence_grade amended to match.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json assurance, cell_rules
R2-98all of those documented, with a published detection error statisticSeveral anchors measure the completeness of documentation rather than the level of capability: publishing any detection-error statistic advances visit-definition scoring without a required performance threshold. Ground-truth evidence also counts under ground_truth, assurance and method_disclosure, while source disclosure counts under both source_transparency and method_disclosure. With A's equal within-group averaging, direct source transparency and method disclosure alone carry 19% of Raw; the same validation can affect another 19% through ground_truth and assurance. Retain this as an evidence matrix, make repeated use of evidence explicit, and avoid presenting its quotient as accuracy or product-performance quality.Reviewer opened: structuralOverlap between source transparency and disclosure element 1, and between ground truth and disclosure element 5, disclosed in the quotient limits; no performance thresholds set because no evidence base exists for them.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json composite_index.limits
R2-99Among cohort A products with a documented default method, more than halfThe H3 rule is a valid descriptive test of disclosed defaults, not the whole market. On the prompt's provisional counts, 7 matched/synthetic/exposed-only of 9 documented, under the prompt’s provisional coding, equals 77.8%, but 7 of the full 14 equals 50%; assigning all five unknowns to randomised removes a population majority. Publish both denominators and missing-default bounds. Add an explicit minimum of four to supported and contradicted, and an unresolved tie rule: as written, 2 of 3 can simultaneously satisfy supported and fewer-than-four unresolved, while a 2–2 tie has no stated verdict. Preserve the original rule and log any amendment after seeing evidence. Keep random assignment, geographic holdout and matched-control attributes distinct: the registered randomised-or-holdout category is broader than randomization alone. An alternative randomization-only test is a sensitivity an…Reviewer opened: structuralH3 decision tree recorded as a dated clarification (minimum of four in both branches; exactly half unresolved; both denominators published).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H3.clarifications
R2-100more document bidstream or IP-derived location as the primary source than document SDK or panel observation.H4 tests a relative product count between two source families, not whether most cohort-B products or most location observations are bidstream/IP-derived. For example, among four documented products, one bidstream, zero SDK and three telco products would satisfy supported although bidstream represents only one quarter. Retitle the estimand as bidstream/IP versus SDK/panel among products documenting either, or prospectively require a majority of all classified products for the word mainly. Keep blends and other source families visible in the denominator; do not infer source volume from vendor counts.Reviewer opened: structuralH4 estimand recorded as a dated clarification: bidstream or IP versus SDK or panel among products documenting either; the eligibility restriction stated as substantive.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H4.clarifications
R2-101The product sets of two or more of the five cannot be read from public sourcesH5 needs explicit precedence. A verified precise-location seller is an existential counterexample and satisfies contradicted even if two other vendors are unreadable, which also satisfies the present unresolved rule. State: any verified continuation within the registered precision definition => contradicted; otherwise all five verified exits/no relevant sale => supported; otherwise unresolved. Record the other companies separately. Apply each order's own definitions and do not treat an audience or visit-attribution service by itself as proof that device-level precise data is sold, nor continued lawful sale as evidence of an order breach.Reviewer opened: structuralH5 precedence recorded as a dated clarification: a verified current offer within the precise definition decides contradicted; the original contradicted branch is also met.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H5.clarifications
R2-102a source documents that results or data are not released to the buyer outside the vendor's own interfaceThe data_access 0 anchor overlaps score 1, dashboards or reports only: a dashboard-only product that releases nothing outside its own interface meets both. Define 0 as no buyer access to any usable output, 1 as dashboard/report access without export, and subsequent anchors by documented export or activation routes. Resolve overlaps before the scoring implementation chooses a value.Reviewer opened: structuralData access: 0 = an opened source establishes no usable output; 1 = dashboard or report without structured export; undocumented access is n/e (R2B-06).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json data_access
R2-103a large-platform developer product described for context, not scored against specialist SDKsLeaving developer products unbanded prevents a false ranking across unlike APIs and SDKs. However, excluding Google Maps Platform by owner size while admitting other Places APIs is a market-scope choice, not a buying-task distinction. Label cohort D as the selected specialist sample and show the platform alternative alongside comparable task attributes, or apply the same task-based admission rule to it. Do not claim that one 0–5 score or quotient is comparable across cohorts with different masks, units and anchors.Reviewer opened: structuralPlaces and maps APIs listed whoever owns them; cohort D labelled a selected specialist sample; Android's Geofencing API listed for comparison.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json developer cohort; data/product-register.json
R2-104designAccept Reveal OOH measurement, Azira Measurement and Cuebiq Footfall Measurement in cohort A; Azira Audience, Cuebiq Audiences and Foursquare Proximity in B. Keep Mira Console as the Reveal service’s self-serve delivery interface, with API/managed service attributes, rather than creating interface-based duplicate products. Classify products by purchased task and document any separately purchasable SKU before splitting rows.Reviewer opened: https://revealmobile.com/ https://www.azira.com/ https://cuebiq.com/ https://foursquare.com/products/proximity/ structuralRegister: Reveal OOH Measurement (Mira Console is its interface), Azira Measurement and Azira Audience, Cuebiq Footfall Measurement and Cuebiq Audiences, Foursquare Proximity entered by purchased task.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/product-register.json
R2-105SpendView™ delivers credit and debit card transaction insightsAdvan’s five current named offers can be entered in the register, but do not score all five as interchangeable mobility-panel products. Patterns+ is explicitly a foot-traffic feed; SpendView is a transaction-panel product, with card-based coverage and optional integration into REI/REveal. Apply scope, source-type and applicability decisions per product; prohibit inheriting the vendor’s 45m-device panel into SpendView. Foursquare Spatial tools are geospatial analytics in C if the purchased task meets the brief; distinguish tool access from an underlying mobility dataset.Source check G2 (24 October 2026, primary sources opened): R2-105 accepted with one correction: Advan lists six named offers, not five, because REP is missing. The product distinctions the reviewer draws are confirmed. https://advanresearch.com/ https://advanresearch.com/products/patternsplus https://advanresearch.com/products/spendview https://advanresearch.com/ supported with qualificationEnter Advan's six current named offers (FIT, REI, REveal, SpendView, Patterns+ and REPerspectives) in the register, each with its own scope, source type and applicability decision. Patterns+ is a weekly US and Canada foot-traffic feed. SpendView is a card-transaction product (120M+ cards) and must not inherit the 45M-US-device location panel. Foursquare Spatial is analytics tooling: score it only if the purchased task meets the brief, and score any mobility dataset it carries, such as H3 Hub mobility layers, separately.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.design
R2-106designMobvista can be excluded because the bounded opened product menu did not show a location SKU. Lifesight’s opened current homepage supports MMM/incrementality positioning and no location product on that page, so move its seed row to listed/unconfirmed rather than asserting a settled market exit or retirement. A current menu’s omission does not date or establish cessation of a previously sold product.Reviewer opened: https://www.mobvista.com/en/ https://lifesight.io/ structuralMobvista excluded (no location product); Lifesight listed as unconfirmed current, not as a dated exit.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/product-register.json
R2-107GroundTruth is now part of ZeroToOne.AI.Accept T-Mobile ownership of Vistar and Blis and Rezolve ownership of the named Bluedot entities from filings. GroundTruth’s acquisition by ZeroToOne.AI was announced as completed on 25 March 2026, confirmed by the opened company and acquirer-counsel releases in R2-22; the underlying legal closing date and consideration were not established. For Foursquare retain announced deal plus current joined statement and unresolved closing evidence. Bluedot’s redirect alone does not establish current availability of the old standalone SDK/API; keep ownership and purchasability as separate fields.Source check G3 (24 October 2026, primary sources opened): design: accepted the ownership fields. The Nelson Mullins release is dated 24 Apr 2026 and does not itself confirm the 25 Mar date; only the GroundTruth release does. https://www.groundtruth.com/article/zerotooneai-acquires-groundtruth/ https://www.nelsonmullins.com/insights/news/press_releases/nelson-mullins-advises-zerotoone-ai-in-acquisition-of-groundtruth https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm https://bluedot.io/ supported with qualificationOwnership: T-Mobile owns Vistar and Blis (10-K), Rezolve owns the Bluedot entities (20-F), and ZeroToOne.AI announced on 25 March 2026 that it has acquired GroundTruth (company release; counsel Nelson Mullins confirmed its role on 24 April 2026; no legal closing date or consideration disclosed). Foursquare's acquisition by Infillion is announced and the target says it 'has joined', but no closing date was found. Ownership and current purchasability (for example, Bluedot's standalone SDK) are recorded as separate fields.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.design
R2-108Cannot fulfill buyer contract for postal areasH7 postal ruling: intended fail-closed refusal is an implementation gap, and “by design” alone is not a registered exception to “could not be carried.” But the opened code does not document an actual attempted workflow or interoperability test. Therefore do not treat this code branch as observed failed execution. Keep H7 unresolved on this evidence; explicitly state that qualifying contradiction requires an attempted workflow/test, or report the sensitivity that a broader source-documented-capability interpretation would yield contradicted. Any exemption for all intentional scope limits must be logged as a rule amendment, not passed off as the original rule. Distinguish a connector’s unsupported signal from protocol-wide impossibility.Reviewer opened: https://github.com/prebid/salesagent/blob/v2.0.0/src/adapters/gam/managers/targeting.py supported as statedNone: author ruling recorded; H7 unresolved.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H7
R2-109mobile audience dataAccept discovery of a distinct Broadsign Ads audience-targeting product in cohort B: the vendor describes venue profiling from active app SDKs and APIs and more than 190 personas for activation. It belongs separately from Broadsign footfall measurement and PerView audience measurement; do not inherit their evidence. The opened audience page does not establish US availability, US panel size/period or a current sale under the newer OutMoove brand. Add it to the register with those fields unresolved and score only if US eligibility and the required numeric-cell minimum are established. Do not award capability or validation from its claim of precise audience composition alone.Source check G2 (24 October 2026, primary sources opened): R2-109 accepted with one addition: broadsign.com/broadsign-ads/ now 301-redirects to /outmoove/. That supports a probable rename the reviewer did not find, but no page confirms the rename or US availability of the Native Touch audience data. https://broadsign.com/audiences/ https://broadsign.com/audiences/ https://broadsign.com/broadsign-ads/ supported with qualificationAdd Broadsign's audience-targeting product to cohort B as a separate register entry. Broadsign describes venue profiling from active app SDKs and APIs, supplied by Native Touch, translated into over 190 personas. The broadsign.com/broadsign-ads/ URL now redirects to the OutMoove DSP page, but no page states that the Native Touch audience data is sold under OutMoove. US availability, US panel size and period remain unresolved, so the product is not scored until US eligibility and the numeric-cell minimum are established. It inherits no evidence from Broadsign's footfall or PerView measurement, and its 'precise audience composition' claim earns no capability or validation credit.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.design
R2-110Then check as many as you can of the 16 findingsThe supplied digest has 292 findings and 12, not 16, marked exactly 'Internal verifier: contradicted': A-F22; B-F31; E-F31; F-F07/F19/F20/F24; H-F13/F16; I-F17/F23; U-F15. Reconcile the prompt with this frozen input; four are already among the 66 headlines, so the combined requested fact-check set contains 74 unique findings.Reviewer opened: supported as statedThe prompt's '16 contradicted' counted data-table and summary rows; 12 findings were contradicted. No data change.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.private review prompt only
R2-111Research cutoff (evidence freeze): 30 October 2026.This review observes sources on 24 October 2026. Treat all current-status conclusions as provisional at that date. A future 30 October freeze cannot yet be certified; refresh time-sensitive ownership, products, laws, accreditations and protocol versions at the actual freeze without rewriting registered decision rules.Reviewer opened: structuralEvery current-status conclusion is dated 24 October 2026 and re-read at the 30 October freeze (MRC lists, AdCP tags and registry, ownership, state laws, H5 product pages, Geopath).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.freeze checklist
R2-112triage comments by …Literal, case-insensitive searches of all six supplied files found neither Ether Data nor Nathan Woodman in the digest or registers. Both names occur only in the prompt's preflight note, which describes public commenters and asserts no client relationship. No additional confidential-client exclusion list was supplied; this check does not identify undisclosed relationships or certify that every public source omits the names.Reviewer opened: supported as statedNone: the two names were not in the digest; the author's pre-send note was wrong about that. No client exposure.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.private review prompt only
R2-113Passages are truncated at 450 charactersThe digest also truncates some verifier corrections with ellipses. Do not accept an incomplete proposed correction wholesale: retain the full verifier record and exact source version for ledger adjudication. This review evaluates the visible correction and reopened sources; omitted wording is unreviewed.Reviewer opened: supported as statedNone: the ledger is built from the full verifier records, not the truncated digest.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.process
R2-114Location – 6 Applicants; 1 AccreditedAdd this historical MRC record: its September 2018 ACA presentation, slide 9, reports six location applicants and one accreditation. It does not name the service or define its metric. Reconcile this with the narrower 2020 first-since-2017-guidelines announcement before making a complete history or first-ever claim; do not invent a pre-2020 visit accreditation.Source check G1 (24 October 2026, primary sources opened): R2-114: add. MRC's Sept 2018 ACA slide 9 shows 6 location applicants and 1 accredited (unnamed). Narrow any 'first-ever' framing of Foursquare 2020; the 2018 service is unidentified. https://acaweb.ca/en/wp-content/uploads/sites/2/2018/10/ACA-Executive-Forums-MRC.pdf supported with qualificationMRC's own presentation to the ACA Executive Forums (26–27 September 2018, slide 9) reports 'Location – 6 Applicants; 1 Accredited' without naming the service or the metric. Any claim that Foursquare's July 2020 grant was the first MRC location accreditation must therefore be narrowed to 'first under the 2017 guidelines' as stated by the parties, or the 2018 accreditation must be identified.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.missing
R2-115will not use geofencing technology at or near Massachusetts healthcare facilities to infer the health statusAdd Massachusetts AG's Copley Advertising settlement, announced 4 April 2017 and resolved by an Assurance of Discontinuance filed in Suffolk Superior Court. It bars specified healthcare geofencing uses in Massachusetts; do not describe it as a nationwide statutory ban. The official release was retrieved and read directly after the web opener returned 403.Source check G6 (24 October 2026, primary sources opened): R2-115 confirmed via Wayback copy (mass.gov 403): 4/04/2017, AOD in Suffolk Superior Court, purpose-limited bar on one company, no payment; predates the 2023-26 window. https://www.mass.gov/news/ag-reaches-settlement-with-advertising-company-prohibiting-geofencing-around-massachusetts-healthcare-facilities https://web.archive.org/web/20220505002332id_/https://www.mass.gov/news/ag-reaches-settlement-with-advertising-company-prohibiting-geofencing-around-massachusetts-healthcare-facilities https://web.archive.org/web/20220505002332id_/https://www.mass.gov/news/ag-reaches-settlement-with-advertising-company-prohibiting-geofencing-around-massachusetts-healthcare-facilities supported with qualificationOn 4 April 2017 the Massachusetts Attorney General settled with Copley Advertising, which had geofenced reproductive-health and methadone clinics in five other states' cities to serve anti-abortion ads. Under an Assurance of Discontinuance filed in Suffolk Superior Court, Copley agreed not to use geofencing at or near Massachusetts healthcare facilities to infer anyone's health status, condition or treatment; no money was paid, and the order binds Copley only.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.missing
R2-116August 13, 2024 | Press ReleaseAdd Texas v. General Motors/OnStar as another location-data enforcement case: the August 2024 complaint alleges deceptive vehicle-data collection and sale to insurers. Distinguish allegations and filing from any later judgment or settlement; the opened announcement alone establishes no adjudicated violation or current case outcome.Source check G6 (24 October 2026, primary sources opened): R2-116 accept with changes: date and filing confirmed; location rests on petition para. 28 (GPS lat/long), not the release; 1.5m (release) vs 1.8m Texans (petition); unresolved per GM 10-Q of 2026-10-20. https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-general-motors-unlawfully-collecting-drivers-private-data-and https://www.texasattorneygeneral.gov/sites/default/files/images/press/General%20Motors%20Original%20Petition%20Filestamped.pdf https://www.sec.gov/Archives/edgar/data/1467858/000146785826000059/gm-20260930.htm supported with qualificationOn 13 August 2024 Texas sued General Motors and OnStar under its deceptive trade practices law (Montgomery County, cause 24-08-12392). The suit alleges that GM collected and sold vehicle 'Driving Data', including GPS latitude and longitude, to companies that built driving scores for insurers, without drivers' informed consent. The claims are allegations only; GM's 20 October 2026 quarterly filing reports only FTC and California settlements and says it is defending the remaining state suits.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.missing
R2-117$391.5 million multistate settlement; remains subject to court approval; October 31, 2025 | Press ReleaseAdd Google location-enforcement context absent from this digest: the 40-state settlement announced 14 November 2022 ($391.5m); California's $93m settlement announced 14 September 2023 (then proposed); and Texas's agreement signed and finalization announced 31 October 2025 ($1.375bn). The Texas sum resolves combined geolocation, incognito and biometric claims: do not attribute the full amount to location. The California announcement does not establish the final judgment's entry date.Source check G6 (24 October 2026, primary sources opened): R2-117 accept with changes: all three amounts and dates confirmed at AG releases; add the 9 May 2025 in-principle date and the 24 Jan 2022 Victoria County filing; 'subject to court approval' belongs to California, not Minnesota; no court-entry dates established. https://ag.state.mn.us/Office/Communications/2022/11/14_Google.asp https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-93-million-settlement-regarding-google%E2%80%99s https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-finalizes-historic-settlement-google-and-secures-1375-billion-big-tech https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-historic-1375-billion-settlement-google-related-texans-data supported with qualificationState attorneys general have repeatedly penalised Google for location tracking that continued after users turned Location History off. Those actions are: a 40-state US$391.5m settlement announced 14 November 2022; California's US$93m settlement announced 14 September 2023 (a proposed stipulated judgment then awaiting court approval); and Texas's US$1.375bn settlement, agreed in principle on 9 May 2025 and signed by Google, as announced 31 October 2025. The Texas figure also resolves separate incognito-browsing and biometric claims, so it cannot be attributed to location alone.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.missing
R2-118searchable, central; Data brokers are required to register starting January 1, 2024.; Effective January 1, 2027The supplied digest checks California but contains no Texas, Oregon or Vermont registry records. Add those separate registers for entity/alias and reporting-year cross-checks, without treating registration as product accreditation or inferring unregistered status from a failed search. Texas's official index links its registry; Oregon links verification and opt-out records. Vermont's statute separates current registration rules from changes effective 1 January 2027. Individual Texas/Oregon/Vermont vendor entries were not verified in this review.Source check G5 (24 October 2026, primary sources opened): R2-118: three registers added; Texas list read in full (4 of the ordered groups present, Mobilewalla/InMarket absent); Oregon and Vermont listings sit behind search forms and were not checked. https://www.sos.texas.gov/statdoc/data-brokers.shtml https://texas-sos.appianportalsgov.com/data-broker-registry https://dfr.oregon.gov/business/licensing/data-broker-registry/Pages/index.aspx https://legislature.vermont.gov/statutes/section/09/062/02446 supported with qualificationTexas (Secretary of State, Bus. & Com. Code ch. 510), Oregon (DFR, HB 2052, registration required from 1 January 2024) and Vermont (9 V.S.A. 2446, revised from 1 January 2027 to require disclosure of precise-geolocation collection) keep their own data broker registers. The Texas register's 456 records on 24 October 2026 include Outlogic, Collective Data Solutions, Unacast, Inc. and Venntel but not Mobilewalla, InMarket or Kochava. Registration is a filing, not accreditation, and absence does not show a company is unregistered.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.missing
R2-119missingThe specific validation sources reopened in this review cover historical polling places, parks and a trail site; Azira publishes vendor accuracy assertions without a reproducible held-out method. I identified no additional independent, multi-site retail comparison of current projected visits against matched door counts or transactions in those opened sources. Record this as an unresolved evidence gap, not proof that no such validation exists, and do not recast historical demographic-bias evidence as a current retail accuracy test.Reviewer opened: https://arxiv.org/pdf/2011.07194 https://par.nsf.gov/servlets/purl/10451340 https://conservancy.umn.edu/server/api/core/bitstreams/fdf3b6a9-7824-4e64-b330-f6392f4491b4/content https://business.azira.com/azira-location-measurement-and-attribution-methodology supported as statedNone: recorded as a bounded evidence gap (no independent multi-site retail comparison found).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-B-F31
R2B-01exposed-only visitation products are still scored on causal design, because the buyer's task is to learn whether the media worked.Add: 'Cohort A scores causal capability for assessing media effects. A documented exposed-only default scores 1 for causal design when it supplies no causal comparison; it is labelled descriptive, without implying a causal claim was made. Score 0 requires the separately documented false or failed causal claim in the zero anchor. Unknown control design is n/e, not 1.' For C, register raw-movement and visit-estimate task masks before scoring, or restrict the composite to a common applicable core and show visit/projection scores separately. List transaction-only and general geospatial tools unless a separately purchasable in-scope task is established. Move named places/maps products rather than excluding every product of HERE or Mapbox by company name; a separately established geofencing SKU should face the same task rule. Keep the full A diagnostic table, but do not silently change H3's p…Reviewer opened: structuralCausal design wording adopted (exposed-only default = 1, labelled descriptive; unknown = n/e); cohort C split into C1 and C2; transaction-only and general geospatial tools listed; places and maps products moved by product.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json causal_design, cohorts
R2B-02A product that documents observed-only counts, and makes no population claim, gets n/e on projectionUse: 'A documented observed-only output that makes no population inference has projection_status=not_applicable_to_output, with source and reason. A product claiming estimates, normalisation, extrapolation or population totals cannot receive that status merely because its projection method is undisclosed; that case is n/e.' The simplest common-composite fix is to remove projection from the GQ mask for every A and C row and retain it as a separately scored module for products making population claims. Alternatively create preregistered output subcohorts and compute quotients only within a common mask. Neither option requires invented observed-only numeric anchors. Do not call omission neutral or claim the remaining missing-evidence incentive has disappeared; retain deletion and missingness sensitivity for the common core. Log the changed masks/formula as a dated post-research, pre-scorin…Reviewer opened: structuralProjection removed from every A and C mask and kept as a separate module (modules.projection).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json
R2B-03A daily unique-device figure counts as a lower bound against the monthly thresholdsUse: 'A stated daily unique-device count establishes monthly uniques of at least that count only on the same defined population, geography and deduplication basis. Score the highest minimum tier it proves and label the cell lower-bound; do not restate it as measured MAU or infer an upper bound. A figure below the first threshold means only the demonstrated lower bound is below that threshold. Daily API requests may be summed over the documented month, or a documented mean over every day of that month may be multiplied by its day count. A peak, typical day or unspecified run-rate is an attribute, not an actual monthly aggregate.' Remove generic annualisation. Keep measured annual campaign counts; put partial-period annualised run-rates and historical cumulative averages in separate attributes. Apply age caps to the observation period, not merely the page's publication date. Either name t…Reviewer opened: structuralLower-bound rule for daily uniques, monthly summation for API requests, no generic annualisation, age cap on the observation period, dimension renamed.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json scale
R2B-04Accreditation provides independent confirmation of competence.Keep pending_audit as an auditor-confirmed status, not a positive assurance result; retain any current completed result, otherwise use self-attestation=1 or n/e as appropriate. One transparent ladder is: 0=published material failed criterion relevant to the assessed product/metric, still applicable to its current version; 1=self-attestation only; 2=completed commissioned partial-scope assessment; 3=completed commissioned full-metric assessment OR independent partial-scope assessment, with the incomparability disclosed; 4=completed independent assessment of all relevant product metrics in at least one sold environment, with other sold environments explicitly excluded; 5=completed independent assessment covering all relevant metrics and sold environments. Require public scope, date, result and tested version at 2–5. Voluntary withdrawal, lapse or a historical failure is a status/history f…Reviewer opened: https://www.iso.org/certification.html structuralReviewer's ladder adopted for B, C1, C2 and D; cohort A ladder rebuilt on the same principles; pending audits and withdrawals are flags.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json assurance, cell_rules
R2B-05This Order will terminate 20 years from the date of its issuancePreferred wording: 'Report current_controls_score from anchors 1–5, recent_event_flag and event type/date/scope/entity, and active_legal_obligations separately. If the author retains the three-year cap, show risk_adjusted_score=min(current_controls_score,1) beside the uncapped score, label it an author-defined risk adjustment, and report its effect on GQ; do not label it current controls. Date a legal event from final order/entered judgment and a breach from confirmed discovery, retain conduct dates separately, and do not reset the clock for a repeated press release. Define current_failure=established only where a dated primary regulator/court finding or a company/regulator incident update expressly identifies an ongoing material prohibited practice, uncontained access, or a specified overdue remedial act affecting this product during the assessed current period. Record the exact failur…Reviewer opened: https://www.ftc.gov/system/files/ftc_gov/pdf/X-ModeSocialDecisionandOrder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf structuralCurrent controls and the author's risk-adjusted value reported side by side; event dating and current-failure test adopted; n/e never imputed.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json privacy
R2B-060 means no buyer access to any usable output; 1 means dashboard or report access without export.Use: '0: an opened source explicitly establishes that the buyer receives no usable output. 1: the buyer can access a dashboard or human-readable report, including a static report file, but no structured-data export or external activation route is documented. n/e: the opened record does not establish the buyer's access. Higher tiers require the named, documented operational routes already defined.' Apply the normal availability and evidence caps; no other ladder change is required to resolve this particular overlap.Reviewer opened: structuralReviewer's wording adopted.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json data_access
R2B-07Our Data is Available to LicensePublish the original rules and a dated amendment/clarification diff, with rationale and old/new verdicts on the same frozen coding. H3 decision tree: if D<4, unresolved; otherwise R>D/2 => supported, M+E>D/2 => contradicted, else unresolved. D is codable documented defaults, N is the full eligible-product population; publish R/M/E/unknown and D/N, and retain the broad registered randomised-or-holdout category. Explicitly adjudicate whether truthful non-lift reporting is outside the lift claim or a separate diagnostic category; do not silently count it as mislabeled lift. H4: let b and s be products with a documented primary source in the two named families; if b+s<4 or b=s, unresolved, otherwise compare b and s. List other sources/blends/unknowns separately and identify this eligibility restriction as a substantive population clarification. H5: first test whether any verified current US…Reviewer opened: https://outlogic.io/ https://www.ftc.gov/system/files/ftc_gov/pdf/X-ModeSocialDecisionandOrder.pdf structuralClarifications recorded with original rules preserved, decision trees as proposed, and the H5 same-reading claim restated as precedence over an overlapping original rule.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H3, H4, H5 clarifications
R2B-08Outlogic: we may receive and sell the precise latitude and longitude coordinates of your mobile device. CDS: precision location (protected by Privacy Block™).State: under the original contradicted criterion, current publicly documented precise-data licensing offers supply a counterexample; the clarified precedence assigns contradicted despite remaining company-specific unknowns. Otherwise all five verified exits/no relevant offers yields supported; otherwise unresolved. Preserve the original wording and report its overlapping branch issue. Define verified current sale consistently with the registered documented-product-set test: verification of a current public offering to sell/license, not proof of a consummated transaction. If actual paid transactions are now required, that is a new evidentiary test and the same-verdict claim must be re-evaluated. Do not interpret continued licensing as an order breach.Reviewer opened: https://outlogic.io/ https://www.collectivedata.io/ https://www.unacast.com/privacy-policy https://www.ftc.gov/system/files/ftc_gov/pdf/X-ModeSocialDecisionandOrder.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf structuralA current public offer, not a consummated transaction, is the test; a preceding-year sale notice alone is not a current offer.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H5
R2B-09Step 3: We create a modeled control groupCode the documented product method as matched_or_synthetic. Record alternative designs as not documented in the page screened, rather than claiming none is available.Reviewer opened: https://docs.foursquare.com/campaign-products/docs/what-is-attribution supported with qualificationCode the documented product method as matched_or_synthetic. Record alternative designs as not documented in the page screened, rather than claiming none is available.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-10Build a statistical model of expected visitation based on historical patterns — a synthetic controlCode the current InMarket visit-lift offering as matched_or_synthetic, cite the dated public method explanation, and update the LCI product-name mapping explicitly. Keep Visit Stream's exposed conversion feed separate from visit-lift reporting.Reviewer opened: https://inmarket.com/blog-foot-traffic-measurement-101-connecting-ad-spend-to-store-visits/ https://inmarket.com/solutions/measurement/ https://go.inmarket.com/hubfs/sellsheets/NinthDecimal-LCI%20Powered%20by%20InMarket.pdf https://www.globenewswire.com/news-release/2019/07/11/1881759/0/en/ninthdecimal-launches-first-multi-touch-attribution-solution-for-foot-traffic-measurement.html https://lciadminconsole.inmarket.com/ supported with qualificationCode the current InMarket visit-lift offering as matched_or_synthetic, cite the dated public method explanation, and update the LCI product-name mapping explicitly. Keep Visit Stream's exposed conversion feed separate from visit-lift reporting.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-11GroundTruth uses last-touch attribution to credit visits; [Projected Visits:] panel made up of impressed devicesCount one exposed_only row in the fixed cohort-A design table. For the registered visit-lift-claim reading, report separately that these pages provide no lift claim; show the result with this row excluded rather than silently equating cohort membership with a claim of causal lift.Reviewer opened: https://help.groundtruth.com/hc/en-us/articles/360000695267-Observed-Visits https://help.groundtruth.com/hc/en-us/articles/12770162930707-Projected-Visits supported with qualificationCount one exposed_only row in the fixed cohort-A design table. For the registered visit-lift-claim reading, report separately that these pages provide no lift claim; show the result with this row excluded rather than silently equating cohort membership with a claim of causal lift.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-12Smart Holdout Groups uses machine learning technology to create statistically balanced target & control groups of zip codesUse randomised_or_holdout with the explicit attribute 'geographic holdout; randomization not documented'. Withdraw the earlier default objection for this specifically named product, while retaining it for any inference about all Blis campaigns or a different legacy product.Reviewer opened: https://blis.com/omnichannel-measurement/ supported with qualificationUse randomised_or_holdout with the explicit attribute 'geographic holdout; randomization not documented'. Withdraw the earlier default objection for this specifically named product, while retaining it for any inference about all Blis campaigns or a different legacy product.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-13A synthetic control group is constructed as a counterfactual in this quasi-experimental setup.Code matched_or_synthetic for the Net Lift OOH measurement service delivered through Mira and the other service modes. Do not require the word 'default' when the general workflow already specifies the calculation.Reviewer opened: https://revealmobile.com/solutions/measurement supported with qualificationCode matched_or_synthetic for the Net Lift OOH measurement service delivered through Mira and the other service modes. Do not require the word 'default' when the general workflow already specifies the calculation.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-14Randomized PSA-based control: This is the default approachCode randomized PSA as the documented default and synthetic control as available alternatively. Do not recode the default merely because the methodology permits another design.Reviewer opened: https://business.azira.com/azira-location-measurement-and-attribution-methodology supported as statedNone: the reviewer re-opened the source and agrees with the finding (and, where applicable, the internal verifier).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-15At the core of the new dashboard is Adsquare’s proprietary Control Condition methodologyCount matched_or_synthetic among method-disclosed rows if admitted to the US cohort. Retain a separate US-availability flag and describe the category as vendor-documented standard methodology rather than an independently verified implementation.Reviewer opened: https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://adsquare.com/resources/newsroom/adsquare-redefines-campaign-measurement-with-unified-attribution-dashboard supported with qualificationCount matched_or_synthetic among method-disclosed rows if admitted to the US cohort. Retain a separate US-availability flag and describe the category as vendor-documented standard methodology rather than an independently verified implementation.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-16Our incrementality methodology uses causal machine learning to simulate a randomized control trial, isolating true campaign lift through behaviorally matched control groups.Count matched_or_synthetic. Label product-wide vendor method evidence separately from case-study evidence; do not code randomized_or_holdout from the words simulate a randomized control trial.Reviewer opened: https://cuebiq.com/measurement/ https://cuebiq.com/blog/advanced-measurement-targeting-platform/ https://cuebiq.com/blog/ctv-ltv-attribution/ supported with qualificationCount matched_or_synthetic. Label product-wide vendor method evidence separately from case-study evidence; do not code randomized_or_holdout from the words simulate a randomized control trial.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-17Vistar supports foot traffic studies through trusted partners including FourSquare, InMarket and CuebiqKeep the fixed Vistar row as not_documented for a single default. Record provider and metric per study; avoid counting Vistar as a separate independent method implementation when the same supplier is already a row.Reviewer opened: https://www.vistarmedia.com/blog/dooh-measurement-solutions https://www.vistarmedia.com/partner-inmarket https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://cuebiq.com/blog/advanced-measurement-targeting-platform/ supported with qualificationKeep the fixed Vistar row as not_documented for a single default. Record provider and metric per study; avoid counting Vistar as a separate independent method implementation when the same supplier is already a row.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-18Synthetic control groups are modeled using a privacy-first, third-party identity graphAdmit a named Kochava DOOH outcomes-measurement service conditionally on US availability and purchased-task fit; retain not_documented for the default, with MediaLift matched_or_synthetic recorded as a selectable design. Replace any broad no-method statement with this specific method disclosure.Reviewer opened: https://www.kochava.com/ https://www.kochava.com/product/strategic-services/ooh-dooh-advertising-measurement/ supported with qualificationAdmit a named Kochava DOOH outcomes-measurement service conditionally on US availability and purchased-task fit; retain not_documented for the default, with MediaLift matched_or_synthetic recorded as a selectable design. Replace any broad no-method statement with this specific method disclosure.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-19“Compare exposed audiences to matched control groups”; “Determine incremental visit and spend from your campaigns”; “We track both groups to your destination.”Count matched_or_synthetic. Keep visit and spend measurement bases separate; the cardholder control description does not establish that every arrival count is a transaction count.Reviewer opened: https://www.arrivalist.com/media-insights supported with qualificationCount matched_or_synthetic. Keep visit and spend measurement bases separate; the cardholder control description does not establish that every arrival count is a transaction count.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-20PlaceIQ proactively holds out 10% of its users from ever receiving an ad.Preserve the fixed row with current default not_documented. Record the historical holdout separately, including unknown assignment mechanism and current availability. Do not count it as a current randomized or holdout default.Reviewer opened: https://www.precisely.com/about-us/placeiq-is-now-part-of-precisely/ https://www.precisely.com/product/precisely-audiences/ https://www.precisely.com/product/precisely-placeiq/ https://mmaglobal.com/files/a-b_control_case_study_final.pdf supported with qualificationPreserve the fixed row with current default not_documented. Record the historical holdout separately, including unknown assignment mechanism and current availability. Do not count it as a current randomized or holdout default.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-21Build better audiences, measure offline marketing attribution, and study consumer visits.Keep the requested fixed row as not_documented and mark cohort-A admission unconfirmed. Use a cohort-C data row for the presently documented offer unless a named current measurement service and reporting method are established.Reviewer opened: https://www.unacast.com/ https://www.unacast.com/industries/adtech-martech https://www.unacast.com/methodology https://www.unacast.com/post/real-time-location-data https://www.unacast.com/post/store-visit-intelligence supported with qualificationKeep the requested fixed row as not_documented and mark cohort-A admission unconfirmed. Use a cohort-C data row for the presently documented offer unless a named current measurement service and reporting method are established.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-22The control group comes from Lifesight’s lookalike algorithm.Preserve the fixed row and list current-cutoff default as not_documented; record historical matched_or_synthetic separately. If current continuity and US availability are confirmed, reclassify the default to matched_or_synthetic and show the resulting denominator sensitivity. Do not equate omission from the current menu with a dated exit.Reviewer opened: https://lifesight.io/ https://docs.lifesight.io/docs/what-is-lifesight https://support.lifesight.io/en/articles/3026093-overview https://support.lifesight.io/en/articles/3003595-measurement-report https://lifesight.io/blog/visit-lift-measurement/ supported with qualificationPreserve the fixed row and list current-cutoff default as not_documented; record historical matched_or_synthetic separately. If current continuity and US availability are confirmed, reclassify the default to matched_or_synthetic and show the resulting denominator sensitivity. Do not equate omission from the current menu with a dated exit.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-E-F28; data/hypotheses.json H3
R2B-23H3-recountPublish the fixed-set capability count and a separate registered lift-claim count. GroundTruth’s two named metrics do not claim lift in their opened definitions, so the stricter lift-claim reading excludes that row: six matched/synthetic versus two holdouts among eight documented defaults (75%), still contradicted. If the current InMarket family cannot be mapped to the exact legacy LCI row, mark that row unknown: fixed-set six of eight nonholdout, and strict lift-claim five of seven matched, both still contradicted. Lifesight’s historical lookalike method is available evidence but not a current-cutoff vote without continuity/admission evidence. The change from the prior unresolved reading follows better sources and corrected method coding, not the four-product/tie clarification. Keep the five unknown current defaults visible rather than coding them as matched. Adsquare’s US admission is…Reviewer opened: https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://inmarket.com/blog-foot-traffic-measurement-101-connecting-ad-spend-to-store-visits/ https://inmarket.com/solutions/measurement/ https://go.inmarket.com/hubfs/sellsheets/NinthDecimal-LCI%20Powered%20by%20InMarket.pdf https://www.globenewswire.com/news-release/2019/07/11/1881759/0/en/ninthdecimal-launches-first-multi-touch-attribution-solution-for-foot-traffic-measurement.html https://help.groundtruth.com/hc/en-us/articles/360000695267-Observed-Visits https://help.groundtruth.com/hc/en-us/articles/12770162930707-Projected-Visits https://blis.com/omnichannel-measurement/ https://revealmobile.com/solutions/measurement https://business.azira.com/azira-location-measurement-and-attribution-methodology https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://adsquare.com/… contradictedH3 reads contradicted on the recount (7 of 9; strict 6 of 8), confirmed product by product in G7.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/hypotheses.json H3; LOC-E-F28
R2B-24Gravy Analytics was informed about the incident on January 4, 2025. ... misappropriated access key ... obtained some filesReplace inaccessible document ID 25485205 with working mirror ID 25485945. Attribute discovery, suspected vector and limited file acquisition to the company. Keep occurrence date, duration, contents and submission date unknown. Record intruder assertions and researcher observations separately with independent sources.Reviewer opened: https://www.documentcloud.org/documents/25485945-datatilsynet-unacast-security-incident-notification-redacted/ https://s3.documentcloud.org/documents/25485945/datatilsynet-unacast-security-incident-notification-redacted.pdf?t=1736802348944 supported with qualificationThe internal verifier's wording of LOC-H-F08 stands: Gravy learned of the incident from the intruder on 4 January 2025, suspected a misappropriated AWS key, the intruder obtained some files, and processing was restored by 9 January; the notice is undated and the intruder's volume claims are unverified. The reviewer was wrong that document 25485205 is inaccessible: both DocumentCloud ids open with the same file; 25485205 (NRK's upload) stays the primary citation and 25485945 is recorded as a mirror.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-H-F08
R2B-25Crowley, October 20, 2026: Almost exactly a month ago, Foursquare was acquired. Webb, September 24, 2026: Foursquare sold. To an AdTech company called Infillion.Register Infillion ownership as completed according to dated participant statements by October 20, 2026; record exact closing date unverified. Keep September 18 as announcement date only. The September 24 shareholder account can be a supplementary earlier completion report, not an invented statutory closing date. If the register permits only a closing release/filing as settlement evidence, retain completion reported by participants as a qualified status instead of asserting pending.Reviewer opened: https://teendrama.substack.com/p/some-final-words-on-foursquare https://buttondown.com/rickwebb/archive/good-morning-hello-how-are-you-1820/ https://infillion.com/blog/infillion-to-acquire-foursquare-closing-the-loop-between-advertising-and-real-world-results/ supported with qualificationCompletion reported by participants by 20 October 2026; legal closing date unverified (see LOC-U-F02 final wording). The board seat Crowley mentions was his pre-sale seat, not one kept after the deal.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-U-F02; data/product-register.json
R2B-26Details are available to the owner or operator.Replace the blanket access blocker with: “The public registry list was opened and contains 34 registered agents on 24 October 2026. Geo/DOOH test results, per-agent spec versions and badge verification modes remain independently unverified from the public sources successfully opened.” Retain unresolved for those detailed claims. To settle them, preserve dated raw per-agent compliance responses or an accessible public conformance export; do not infer zeros from restricted detail views.Reviewer opened: https://agenticadvertising.org/api/registry/agents?limit=500 https://agenticadvertising.org/registry/?tab=agents https://agenticadvertising.org/registry/?tab=agents#agent/sales/gotom-sandbox supported with qualificationThe list API returns 34 agents. The reviewer was wrong that per-agent compliance detail is owner-only: the public compliance endpoint reproduces LOC-J-F07 (11 badges, all spec mode; no DOOH specialism; geo storyboards untested on two agents; three agents on 3.2.6). Live data: re-read at the 30 October freeze.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-J-F07
R2B-27minimum duration of 30 days and 1 million impressions per monthKeep the exact LCI minimum-sample and significance claims unresolved pending an accessible dated method document or a reproducible public glossary copy. Record the Choozle integration minimum only under its own product/metric scope. Do not promote search snippets of the glossary into opened evidence, or treat these numerical rules as universal across InMarket outputs.Reviewer opened: https://lciadminconsole.inmarket.com/ https://inmarket.com/solutions/measurement/ https://inmarket.com/blog-foot-traffic-measurement-101-connecting-ad-spend-to-store-visits/ https://go.inmarket.com/hubfs/sellsheets/NinthDecimal-LCI%20Powered%20by%20InMarket.pdf https://go.inmarket.com/lcihij23 https://go.inmarket.com/insights https://help.choozle.com/offline-attribution https://choozle.com/wp-content/uploads/Choozle_offline-attribution.pdf supported with qualificationInMarket's minimum-sample and significance thresholds sit in a glossary behind a sign-in and are marked unverified from public sources; Choozle documents a different minimum (30 days and 1 million impressions a month) for its InMarket Visit Stream integration only (see LOC-C-F24 final wording).Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-C-F24
R2B-28February Digital GroundTruth Revoke accreditationMRC placed GroundTruth's Location, Place and Visit dataset on a six-month hiatus in September 2023. In its July 26, 2024 communication, MRC reported revocation following withdrawal from accreditation. The row is labelled February despite appearing in the April–June report; the effective month remains unconfirmed. Do not substitute July as the action date or assert a corrected month without another MRC record.Reviewer opened: https://mediaratingcouncil.org/sites/default/files/News/Accreditation-Matters/101623_MRC_Accreditation_Status_Communication.pdf https://mediaratingcouncil.org/sites/default/files/News/MRC%20Accreditation%20Status%20Quarterly%20Update_Q2%2024%207.26.pdf supported with qualificationMRC placed GroundTruth's Location, Place and Visit dataset on a six-month hiatus in September 2023. In its July 26, 2024 communication, MRC reported revocation following withdrawal from accreditation. The row is labelled February despite appearing in the April–June report; the effective month remains unconfirmed. Do not substitute July as the action date or assert a corrected month without another MRC record.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.R2-04
R2B-29a statement about POIs rather than individualsKeep the historical SafeGraph POI-coverage finding. Do not present its turnout-estimation RMSE as a vendor-reported projection error, an individual-level demographic result, or a current-product failure. Separate that correction from the hypothesis adjudication.Reviewer opened: https://arxiv.org/pdf/2011.07194 supported with qualificationKeep the historical SafeGraph POI-coverage finding. Do not present its turnout-estimation RMSE as a vendor-reported projection error, an individual-level demographic result, or a current-product failure. Separate that correction from the hypothesis adjudication.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.R2-12
R2B-30R2-17Remove the default-status objection for Smart Holdout Groups and code geographic holdout under the registered inclusive category. Keep the cross-stream source-scope reconciliation and randomization qualification.Reviewer opened: https://blis.com/omnichannel-measurement/ supported with qualificationRemove the default-status objection for Smart Holdout Groups and code geographic holdout under the registered inclusive category. Keep the cross-stream source-scope reconciliation and randomization qualification.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.R2-17
R2B-31R2-30Downgrade the prior blanket contradiction to a qualification resolved through the product table. Preserve the distinction between two holdouts and two randomized methods, the prohibition on changing the registered category, and the separate GroundTruth lift-claim-scope issue. Use the completed B recount for the final denominator.Reviewer opened: https://blis.com/omnichannel-measurement/ https://inmarket.com/blog-foot-traffic-measurement-101-connecting-ad-spend-to-store-visits/ https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://revealmobile.com/solutions/measurement supported with qualificationDowngrade the prior blanket contradiction to a qualification resolved through the product table. Preserve the distinction between two holdouts and two randomized methods, the prohibition on changing the registered category, and the separate GroundTruth lift-claim-scope issue. Use the completed B recount for the final denominator.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.R2-30
R2B-32R2-47Use supported_with_qualification and C1’s working source and wording; forensic scope remains unknown.Reviewer opened: https://s3.documentcloud.org/documents/25485945/datatilsynet-unacast-security-incident-notification-redacted.pdf?t=1736802348944 supported with qualificationThe internal verifier's wording of LOC-H-F08 stands: Gravy learned of the incident from the intruder on 4 January 2025, suspected a misappropriated AWS key, the intruder obtained some files, and processing was restored by 9 January; the notice is undated and the intruder's volume claims are unverified. The reviewer was wrong that document 25485205 is inaccessible: both DocumentCloud ids open with the same file; 25485205 (NRK's upload) stays the primary citation and 25485945 is recorded as a mirror.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-H-F08
R2B-33"count":34Upgrade only the 34-agent list count from unresolved to verified. Leave the compliance/test/badge components unresolved and leave H7 unresolved. No downgrade or withdrawal is warranted for my other I/J findings on the newly opened registry record; the postal-area distinction remains a design clarification rather than evidence of an observed failed workflow.Reviewer opened: https://agenticadvertising.org/api/registry/agents?limit=500 supported with qualificationThe list API returns 34 agents. The reviewer was wrong that per-agent compliance detail is owner-only: the public compliance endpoint reproduces LOC-J-F07 (11 badges, all spec mode; no DOOH specialism; geo storyboards untested on two agents; three agents on 3.2.6). Live data: re-read at the 30 October freeze.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-J-F07
R2B-34R2-63Replace the undifferentiated unresolved completion status with completion reported by dated participants by October 20, 2026, exact legal closing date unverified. Keep the level and provenance of evidence explicit.Reviewer opened: https://teendrama.substack.com/p/some-final-words-on-foursquare https://buttondown.com/rickwebb/archive/good-morning-hello-how-are-you-1820/ supported with qualificationCompletion reported by participants by 20 October 2026; legal closing date unverified (see LOC-U-F02 final wording). The board seat Crowley mentions was his pre-sale seat, not one kept after the deal.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.LOC-U-F02; data/product-register.json
R2B-35R2-78Report historical SafeGraph polling-place coverage as adverse evidence. Make its formal H2 contradiction conditional on those checks. Current retail-visit agreement stays unresolved where matched validation is absent; do not assign a single verdict across products and vintages.Reviewer opened: https://arxiv.org/pdf/2011.07194 supported with qualificationReport historical SafeGraph polling-place coverage as adverse evidence. Make its formal H2 contradiction conditional on those checks. Current retail-visit agreement stays unresolved where matched validation is absent; do not assign a single verdict across products and vintages.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.R2-78
R2B-36R2-79Replace the previous default-evidence objection with the adjudicated B method table and count. Retain uncertainty only for genuinely uncodable product methods or scope mismatches, not because a general workflow lacks a default label. The completed fixed-set recount is six matched/synthetic, two holdouts, one exposed-only and five unknown; the stricter lift-claim count is six of eight matched, hence contradicted.Reviewer opened: https://docs.foursquare.com/campaign-products/docs/what-is-attribution https://revealmobile.com/solutions/measurement https://blis.com/omnichannel-measurement/ https://inmarket.com/blog-foot-traffic-measurement-101-connecting-ad-spend-to-store-visits/ https://adsquare.com/resources/the-lab/inside-adsquares-attribution-dashboard https://cuebiq.com/blog/advanced-measurement-targeting-platform/ https://www.arrivalist.com/media-insights supported with qualificationReplace the previous default-evidence objection with the adjudicated B method table and count. Retain uncertainty only for genuinely uncodable product methods or scope mismatches, not because a general workflow lacks a default label. The completed fixed-set recount is six matched/synthetic, two holdouts, one exposed-only and five unknown; the stricter lift-claim count is six of eight matched, hence contradicted.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.R2-79
R2B-37and A includes visitation reporting alongside lift.Narrow R2-89 to the retained C task-mask mismatch and any genuinely inapplicable output dimensions. Accept A's common causal-capability dimension under the A1 wording above, with honest descriptive output distinct from a false causal claim and unknown design distinct from no control. Preserve the separate H3 population/default-coding qualification; do not infer that every A product makes a visit-lift claim.Reviewer opened: supported as statedNone beyond R2B-01.Shared rules: every external finding is checked against its primary source before it changes anything; bound absence claims; evidence class follows funding and design.data/scoring-rules.json
R3-01Chapter 11 capability matrix; data/capability-matrix.json, row kochava-dooh-advertising-measurement, privacyThe privacy risk cap is applied without establishing that the event involved this measurement product's location data. The cell expressly substitutes the defendant's identity for the product-data link required by the frozen rule.The privacy definition in data/scoring-rules.json requires an event 'involving the product’s location data'; the Kochava cell says 'the cap rests on the operating entity being a defendant' and that 'this product’s location source is undisclosed'. Its scale cell separately refuses to inherit the former data-broker business's volume because that business is now Collective Data Solutions. The recorded privacy value is 1 versus recorded current controls 3; keeping 3 and removing this cap alone would change Kochava's recomputed GQ from 33.5611 to 37.3611 and Least to Partly documented, although the current-controls score also needs its product scope checked. contradictedKochava DOOH measurement: risk cap removed (no established link between the order and this product's data); the order kept as an event flag; current controls re-anchored to 2 (company-level).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 11 capability matrix; data/capability-matrix.json, row kochava-dooh-advertising-measurement, privacy
R3-02Chapter 11 capability matrix; data/capability-matrix.json and source/data/scores.json, GroundTruth visit measurement, coverageCoverage 3 is awarded on an assumed US share of a combined US–Canada place count. No cited figure establishes the required 100,000 US places, so the numeric threshold is not supported by the recorded evidence.The measurement coverage anchor 3 requires '100,000 or more US places with polygons or geofences documented'. The cell cites 4.8 million Blueprinted locations across the United States and Canada, acknowledges 'The US share is not stated', then reasons that 100,000 US polygons follows from 'any US share of at least about 2%'. The cell supplies no evidence for that minimum share. contradictedGroundTruth visit measurement coverage 3 -> n/e: no US-only place count is documented.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 11 capability matrix; data/capability-matrix.json and source/data/scores.json, GroundTruth visit measurement, coverage
R3-03Chapter 11 matrix privacy cells: azira-measurement and foursquare; InMarket measurement uncapped controls; data/capability-matrix.json and source/data/scores.jsonSeveral current-controls scores of 3 are supported only by company-level policies although anchor 3 requires at least one product-specific consent route or suppression control. The rationales themselves say the product-specific condition is unmet, so the scores exceed their frozen anchor.The Azira measurement cell assigns 3 but says 'neither the consent route nor the suppression is specific to Azira Measurement'; Foursquare Attribution assigns 3 but says neither is documented specifically for Attribution. InMarket measurement records uncapped current controls 3 while saying 'None of these is documented specifically for the measurement product'. Privacy anchor 2 is the company-policy tier and anchor 3 requires a product-specific control. These are applications of the final rule, not challenges to the closed R2/R2B policy decision. contradictedPrivacy current controls 3 -> 2 for Foursquare Attribution, Azira Measurement and InMarket visit-lift measurement (company-level controls are anchor 2); InMarket keeps its capped value of 1. A scan of every privacy cell found no other such case.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 11 matrix privacy cells: azira-measurement and foursquare; InMarket measurement uncapped controls; data/capability-matrix.json and source/data/scores.json
R3-04Chapter 11 matrix; Placer.ai documented production volume; data/capability-matrix.json and source/data/scores.jsonPlacer's volume score 3 bypasses the rule for a figure without a definition or stated observation period. The rationale admits that the only monthly figure has an undefined active-device basis, yet awards the 20-million tier before the marketing cap.The cell uses a vendor claim relayed by the February 2026 city fact sheet, 'over 20 million monthly active users', expressly says 'active' is undefined, and concludes that no definition or period is stated. LOC-PLACER-S25 also records period 'not stated'. The volume definition requires a stated observation period, and anchor 1 covers a figure with no period or definition; grade D's cap of 3 cannot raise the anchor. Changing this cell 3→1 alone recomputes Placer's GQ from 59.5786 to 57.7214 (60→58); it remains Most documented. contradictedPlacer.ai documented production volume 3 -> 1: the only monthly figure has no definition or period.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 11 matrix; Placer.ai documented production volume; data/capability-matrix.json and source/data/scores.json
R3-05Chapter 11 matrix; method_disclosure for placer, quadrant and veraset-movement; data/capability-matrix.jsonThe disclosure element count credits update cadence as an entire element even where uncertainty reporting is expressly absent. That changes three-element records into four-element records and raises them from anchor 2 to anchor 3.The frozen method-disclosure definition makes element (7) 'update cadence and uncertainty reporting'. Placer's rationale counts four elements, the fourth being cadence, and states there is no per-estimate uncertainty; Quadrant also counts four including cadence and history while stating there is no uncertainty reporting. Veraset likewise counts four, with its final element only daily delivery/history. Excluding the incomplete element leaves three elements in each case, for which anchor 2 applies. contradictedMethod disclosure 3 -> 2 for Placer.ai, Quadrant and Veraset Movement: element 7 needs uncertainty reporting as well as cadence.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 11 matrix; method_disclosure for placer, quadrant and veraset-movement; data/capability-matrix.json
R3-06Chapter 7 standfirst, inshort and 'Four states now ban the sale'; chapter 0 inshort; figure-state-laws / data/figure-data.json states; data/rules.json; plain/index.html paragraph beginning 'Four states now ban'The national total of four states with precise-geolocation sale bans omits New Jersey's enacted and immediately effective 30 June 2026 ban. The paper itself records GroundTruth switching off New Jersey features, but never resolves the underlying statute.Chapter 7 names only Maryland, Oregon, Virginia and Connecticut, and figure-data.states.sale_ban_states is 4. Opened primary enacted text https://pub.njleg.state.nj.us/Bills/2026/PL26/25_.HTM : P.L.2026 c.25 §1 amends C.56:8-166.12(a)(6) to prohibit sensitive-data sales regardless of consumer-count threshold; §§2–3 include 1,750-foot precise geolocation and prohibit data brokers/collectors selling or licensing sensitive data, subject to listed exemptions; §8 makes the act effective immediately apart from the registry provision; approved 30 June 2026. contradictedNew Jersey P.L.2026, c.25 (approved and effective 30 June 2026) added: a ban on sale of sensitive data including precise geolocation (1,750 ft) regardless of consumer count, and on sale or licensing by data brokers and collectors. State sale bans: four -> five in the abstract, chapters 7 and 12, the rules table, the figure and the plain edition. New claim LOC-R3-F01, source LOC-NFA-S02.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 7 standfirst, inshort and 'Four states now ban the sale'; chapter 0 inshort; figure-state-laws / data/figure-data.json states; data/rules.json; plain/index.html paragraph beginning 'Four states now ban'
R3-07data/profiles.json InMarket differentiation[2], capabilities.causal_design and capabilities.method_disclosure; source/evidence/swot/inmarket.json strengths[1]; data/source-register.json LOC-C-S02 (alias LOC-INMARKET-S11); rendered InMarket profile and SWOTThe accepted public-access qualification for the LCI glossary has not reached the deep profile and SWOT: they still credit publicly published 10/25-million-impression minimums, standard error and a confidence rule. The source register still labels the glossary full-access, directly conflicting with the paper's current unverified, sign-in-gated treatment.The InMarket differentiation says LCI is 'one of two that publish numeric minimum samples and a confidence rule (10 MM / 25 MM impressions; >95%)'; its method_disclosure counts projection and uncertainty as disclosed from S11, and the SWOT calls the glossary a strength. Chapter 5/claim LOC-C-F24 and closed correction R2B-27 explicitly mark the InMarket thresholds unverified from public sources behind sign-in. LOC-C-S02 retains access_limits/access_note='full' and aliases S11. supported with qualificationInMarket profile, SWOT and the source record LOC-C-S02: the LCI glossary thresholds are described as read once and not verifiable from a public route (sign-in); access set to partial.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/profiles.json InMarket differentiation[2], capabilities.causal_design and capabilities.method_disclosure; source/evidence/swot/inmarket.json strengths[1]; data/source-register.json LOC-C-S02 (alias LOC-INMARKET-S11); rendered InMarket profile and SWOT
R3-08data/profiles.json Placer.ai headline; source/data/profile-overlay.json placer.headline; source/evidence/swot/placer.json weaknesses[0]; rendered Placer profile/SWOTThe Placer headline and SWOT say every visit figure it shows is a projection, although the same profile and SWOT explicitly document raw panel visits displayed alongside projected totals. This turns a documented metric distinction into an absolute product claim.Placer headline: 'every visit it shows is a projection'; SWOT weakness: 'Every visit figure is a projection'. The profile's differentiation[0] says 'Exposes raw panel visits beside projected visits in its API and dashboard', and SWOT strengths[1] repeats the same fact with LOC-PLACER-S01/S08. supported with qualificationPlacer.ai headline and SWOT: population visit estimates are projections from raw panel visits it also shows.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/profiles.json Placer.ai headline; source/data/profile-overlay.json placer.headline; source/evidence/swot/placer.json weaknesses[0]; rendered Placer profile/SWOT
R3-09data/profiles.json GroundTruth headline; source/data/profile-overlay.json groundtruth.headline; source/evidence/swot/groundtruth.json weaknesses[1]; rendered GroundTruth profile/SWOTGroundTruth's headline expands the no-control/no-lift finding for Observed Visits and Projected Visits into a claim about all its visit measurement. The profile itself records a separate DOOH assertion that more than half of 42,000 visits were incremental, whose control design is unknown rather than established absent.Headline: 'Visit counts with no control and no lift claim'; SWOT: 'Visit measurement is exposed-only with no control'. The same profile's performance entry for Place Exchange says 'over 42,000 in-store visits from exposed consumers', 'more than half' incremental, with design='not_documented'; chapter 9 also reports the unsupported incremental assertion. R2B-11 limits the no-lift qualification to the two visit-count help pages. supported with qualificationGroundTruth headline and SWOT name Observed and Projected Visits; the separate DOOH incrementality assertion is described as documenting no control design.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/profiles.json GroundTruth headline; source/data/profile-overlay.json groundtruth.headline; source/evidence/swot/groundtruth.json weaknesses[1]; rendered GroundTruth profile/SWOT
R3-10Chapter 6 'Sensitive places' InMarket-order paragraph; data/profiles.json Vistar risks[1]/timeline 2024-05-01; source/evidence/swot/vistar.json threats[2]; rendered editionsSeveral surfaces say InMarket is categorically barred from sharing any precise location data, while chapter 7 correctly states the narrower sale-or-licensing ban. The order's broader use/transfer/share prohibition attaches to products categorising or targeting consumers by sensitive locations, so the summary overstates legal scope.Chapter 6 says the order 'prohibits it from selling, sharing or licensing any precise location data'; Vistar's risk/SWOT repeats a blanket sharing ban. Opened order https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf , p.5 provisions II–III: II prohibits sale or licensing of Location Data for valuable consideration; III separately prohibits use/sale/license/transfer/share of sensitive-location categorisation/targeting products. Chapter 7's table uses this narrower distinction. supported with qualificationChapter 6 and the Vistar profile and SWOT now match the InMarket order: II bans sale or licensing of location data; III separately bans sensitive-location categorisation or targeting products.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 6 'Sensitive places' InMarket-order paragraph; data/profiles.json Vistar risks[1]/timeline 2024-05-01; source/evidence/swot/vistar.json threats[2]; rendered editions
R3-11Chapter 13, evidence-class rule; Chapters 3–5; Chapter 4 fig-ground-truth and study-evidence table; Appendix/claim-ledger LOC-B-F12/F13/F17/F24/F25 and LOC-PLACER-F09/F10; related source-register and study-evidence recordsThe published independence classifications do not follow the paper's own rule: studies whose source records explicitly say funding is unknown remain independent in the ledger, study table and ground-truth figure, while the Facebook and Yahoo research retains independent-measurement labels despite disclosed platform employment. This concerns whether independence was established, not whether those studies' results are wrong or whether unknown funding proves a conflict.Chapter 13 says unknown-funded studies are not treated as independent and platform-employed coauthors are labelled as such. Representative package conflicts: LOC-B-S06 (Minnesota) funding unknown, yet LOC-B-F12 and LOC-PLACER-F09/F10 are independent_measurement and the Placer/StreetLight figure cells count as independent; LOC-B-S07 (Advan preprint) funding unknown, yet LOC-B-F13 and its study/figure row are independent; LOC-B-S24 funding unknown and LOC-B-F17 review_note expressly says independence is unknown, yet its class and Chapter 3 table/paragraph say independent. Newly opened primary https://arxiv.org/pdf/2201.07055, PDF p.44 Funding and Competing Interests, confirms Gordon and Zettelmeyer were part-time Facebook employees for data access and Moakler was a Meta employee and stockholder, while LOC-B-F24 remains independent_measurement. LOC-B-S25 records Yahoo employment during the supported with qualificationEvidence class recoded from independent measurement to synthesis, with the reason, for claims resting on studies with unknown funding (LOC-B-F09, F12, F13, F14, F17, LOC-PLACER-F09, F10) and on platform-coauthored studies (LOC-B-F23 to F26); chapter 4 and 11 wording, the study table tags and the ground-truth figure updated.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 13, evidence-class rule; Chapters 3–5; Chapter 4 fig-ground-truth and study-evidence table; Appendix/claim-ledger LOC-B-F12/F13/F17/F24/F25 and LOC-PLACER-F09/F10; related source-register and study-evidence records
R3-12source/paper.config.json hero_summary and site.llms_txt; location-intelligence-2026.html hero; location-intelligence-2026.md opening italic subtitle; source/plain.md §What location data is final paragraph and §1 final sentence; plain/index.html #what and #guessesThe prominent claim that visit counts are mostly projections is stronger than the coded evidence: an undisclosed basis is being treated as if it were probably projected. The data establish that all four products which disclose a visit basis offer projections, not that projections are a majority of sold visit counts.The hero says "visit counts are mostly projections"; plain says "Most visit counts you see are the second kind" and "A chart that says visits is most often a scaled-up guess." data/figure-data.json number_kinds records visit_products=13, visit_basis_disclosed=4, all four projected, and nine not_disclosed products; fig-number-kinds expressly warns "A number coded not disclosed may be projected; the vendor does not say." No volume-weighted or representative market denominator is supplied. supported with qualificationHero, llms.txt and plain edition: visit counts are projected or carry no stated basis; every firm that states the basis sells a projection.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/paper.config.json hero_summary and site.llms_txt; location-intelligence-2026.html hero; location-intelligence-2026.md opening italic subtitle; source/plain.md §What location data is final paragraph and §1 final sentence; plain/index.html #what and #guesses
R3-13fig-pipeline Verified box, bottom SVG note and caption; location-intelligence-2026.html and location-intelligence-2026.md; source/paper.config.json site.research_papers.summaryThe verification figure mixes the 493 independently checked research claims with outcome totals for all 501 ledger entries, then asserts that every ledger claim was checked. Its caption also describes a residual unresolved sample even though the final ledger has none.The Verified box shows "493 claims re-checked", followed by "321 as stated", "166 with qualification", "14 contradicted" (sum 501) and "0 not re-checked"; its note says "Every claim in the ledger was checked by a verifier or a review." In data/claim-ledger.json, checked_independently=true for 493 entries, whose outcomes are 313 supported_as_stated, 166 supported_with_qualification and 14 contradicted; the seven LOC-HYP-H* syntheses and LOC-GQ-F01 have checked_independently=false and account for the other eight supported entries. Chapter 13 correctly distinguishes them. The figure caption says "the rest are labelled unresolved" while data/stats.json claims_unresolved=0. The site-index summary also calls all 501 entries verified claims rather than distinguishing the 493 checked research claims. supported with qualificationPipeline figure and listing summary distinguish 493 checked research claims (313 / 166 / 14) from 8 author syntheses; the unresolved-residual caption removed.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.fig-pipeline Verified box, bottom SVG note and caption; location-intelligence-2026.html and location-intelligence-2026.md; source/paper.config.json site.research_papers.summary
R3-14source/plain.md §3 No one has checked the counts against real store traffic, second paragraph; plain/index.html #checkThe plain edition turns the Placer trail comparison’s difference into a measured overcount by calling its count "30.5% too high". The full paper explicitly says the comparison is not like for like, so the percentage cannot be presented as an error against an equivalent ground-truth population.Plain: "One trail check found a firm's count was 30.5% too high." Chapter 4 Parks, trails and one Placer.ai check says Placer estimated 13,233 against 10,138 counter visits but "the comparison is not like for like: polygons differ, counters cover only the cross-country trails, and events are handled differently"; it also reports no statistically significant difference. This is a failure to carry the accepted R2-10 qualification into the plain edition, not a challenge to that disposition. supported with qualificationPlain edition: 30.5% above the trail counters, with the different areas and activities stated.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/plain.md §3 No one has checked the counts against real store traffic, second paragraph; plain/index.html #check
R3-15source/plain.md §2 heading and first paragraph; plain/index.html #panelsThe plain edition broadens a missing comparable historical US panel series into the claim that nobody discloses panel size and that no firm reports it on the same basis twice. Those are much wider absence claims than the full paper’s finding.Plain heading: "No one shows how big the phone panels are"; paragraph: "no firm shows the size of its phone group the same way twice." Chapter 2 and LOC-D-F41.final_wording bound the result to sources opened and to one-definition US panel figures spanning pre-2021 and post-2023. fig-dooh-sources and data/figure-data.json dooh.rows[0] explicitly record Geopath's 7–10 million qualified devices weekly from over 100 million US devices monthly (documentation-dated 2023). Accepted R2-24 requires the comparable-series and screened-source limits. supported with qualificationPlain edition: no comparable history of US panel size before 2021 and after 2023 in the sources checked.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/plain.md §2 heading and first paragraph; plain/index.html #panels
R3-16source/plain.md §9 heading; plain/index.html #agents; source/chapters/00-abstract.md What it found item 10 and corresponding web/Markdown headlineThe headline "can't yet buy by it" presents nonexistence of working geographic buying as established, although H7 is unresolved and the figure distinguishes unverified production claims from the absence of a public test. An implemented connector and unverified claims do not establish that buying cannot occur.Plain heading: "AI buyers can describe a place but can't yet buy by it"; full abstract: "Agents can describe a place, not yet buy one." fig-protocol-states instead says "No location signal has a public interoperability test" and "H7 is unresolved"; data/figure-data.json protocols rows administrative geo and venue identifiers contain production-use code "vc" (vendor claim), while administrative geo has connector="conn". Chapter 10 explains that the campaign releases omit the protocol version and carried field, so the supported production branch is not established. supported with qualificationAbstract, chapter 12 and plain edition: production buying by place is not established in the sources screened; H7 stays unresolved.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/plain.md §9 heading; plain/index.html #agents; source/chapters/00-abstract.md What it found item 10 and corresponding web/Markdown headline
R3-17data/source-register.json and source/data/sources-extra.json, LOC-SCD-S11/LOC-SCD-S12; matrix privacy cells for gimbal and bluedotThe source-access records contradict the scored privacy evidence: both policies remain recorded as unreadable while the matrix quotes detailed policy text and calls the scores verifier-qualified. At least Rezolve's current policy supports the described score, making this a stale provenance record rather than proof of a false capability claim.LOC-SCD-S11 says its policy text could not be retrieved and LOC-SCD-S12 says 'No content read', both with access_limits 'access error'; the two matrix cells describe detailed policies and say 'verifier-scored from n/e'. On opening https://rezolve.com/privacy-policy/ for this review, sections 1.2 and 2.2 contain the cited device-location, consent and purpose content and the controller list includes Bluedot. Opening https://infillion.com/privacy-policy/ returned a shell, so the package does not currently supply a reproducible route for that detailed read. supported with qualificationSource records LOC-SCD-S11 and S12 updated: both policies read in full in a rendered browser on 24 October 2026. The reviewer was wrong that Infillion's policy cannot be read; the cell keeps its score.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/source-register.json and source/data/sources-extra.json, LOC-SCD-S11/LOC-SCD-S12; matrix privacy cells for gimbal and bluedot
R3-18data/claim-ledger.json and source/data/claim-ledger.json LOC-J-F12 final_wording/review_note; data/agentic-map.json and CSV/rendered agentic registerThe final claim ledger still says no Placer MCP server was found and represents Radar only by its documentation-search endpoint, despite the corrected chapter and deep profiles documenting both data interfaces. The agentic map likewise retains only the Radar documentation row and has no Radar data-pilot or Placer MCP row.LOC-J-F12.final_wording names Placer.ai among vendors with no MCP server and describes Radar's endpoint as documentation search only; its review_note says 'no server has been released' for Placer. Chapter 10 'Vendors' agent interfaces sit outside buying' documents Radar's authenticated enterprise pilot announced 14 October 2026 (LOC-RADAR-F16) and Pi for Placer MCP documented by 22 October (LOC-PLACER-F19); source-register LOC-RADAR-S27 and LOC-PLACER-S14 identify the data-server documentation. supported with qualificationLOC-J-F12 final wording and the agentic register now include Radar's authenticated enterprise MCP pilot and Placer.ai's enterprise MCP server, both outside buying.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/claim-ledger.json and source/data/claim-ledger.json LOC-J-F12 final_wording/review_note; data/agentic-map.json and CSV/rendered agentic register
R3-19Chapter 0 'What it found' item 2 and inshort; chapter 10 standfirst, 'One connector', 'No public test passes', 'The baseline is further along', and H7 summaryProminent summaries drop the searched-evidence boundary and turn non-discovery into market-wide absence or superiority: no vendor discloses supply, no location signal has a public interoperability test, and the baseline is further along than any agentic protocol. The supporting claims establish results only for screened sources/protocols and a 34-agent registry that is not all deployments.Chapter 0 item 2 says 'No vendor discloses a US panel series'; its inshort says 'no location signal has a public interoperability test'. Chapter 10 says 'The highest state any location signal reaches in open-protocol agent-driven buying is an implemented connector' and 'Non-agentic buying is further along than any agentic protocol'. LOC-J-S13 explicitly says the registry lists registered agents, not all AdCP deployments; LOC-J-F13 is an inference across screened evidence, and LOC-G-F20 logs unscreened vendor blogs/private vendors. R2-60 and R2-61 already prescribe a bounded comparison; these are remaining propagation failures. supported with qualificationAbstract and chapter 10 summaries bounded to the sources, protocols and registry screened on 24 October 2026; the baseline comparison bounded to the opened Google documentation.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 0 'What it found' item 2 and inshort; chapter 10 standfirst, 'One connector', 'No public test passes', 'The baseline is further along', and H7 summary
R3-20data/profiles.json Foursquare differentiation[0] and timeline merger entry; rendered Foursquare profile; data/deep-profile-records.csv corresponding rowsTwo Foursquare profile dates use announcement/publication dates where the package's settled event dates differ: GroundTruth's accreditation is dated August rather than July 2021, and the Factual merger announcement is dated 7 rather than 6 April 2020.Foursquare differentiation[0] says GroundTruth was accredited 'in August 2021', while GroundTruth's own timeline and LOC-A-S17 record the MRC grant in July (vendor announcement 3 August). Foursquare timeline dates the Factual merger announcement 2020-04-07, while chapter 2 uses 6 April and source-register LOC-D-S14 explicitly distinguishes pub_date=2020-04-07 from event_date=2020-04-06. supported with qualificationFoursquare profile: GroundTruth accreditation granted July 2021 (announced August); Factual merger announced 6 April 2020 (release dated 7 April).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/profiles.json Foursquare differentiation[0] and timeline merger entry; rendered Foursquare profile; data/deep-profile-records.csv corresponding rows
R3-21data/agentic-map.json first AdCP 3.2.6 administrative-geography row, note; source/data/agentic-map.json; CSV export and rendered agentic registerThe agentic map assigns 'AdCP 2.5.0' to PubMatic's December 2025 campaign while the chapter and campaign claim explicitly say no protocol version was recorded. An inferred contemporaneous version must not appear as the campaign's documented version.The first map row note reads 'PubMatic (December 2025, AdCP 2.5.0) ... describe geo- and venue-targeted agentic campaigns without naming a field, version or delivery metric'. Chapter 10 and LOC-J-F08 say the vendor release records neither the signal nor the protocol version. supported with qualificationAgentic register: PubMatic campaign marked as recording no protocol version (the inferred 2.5.0 removed).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/agentic-map.json first AdCP 3.2.6 administrative-geography row, note; source/data/agentic-map.json; CSV export and rendered agentic register
R3-22Chapter 4, "Third-party and production uses" paragraph; Appendix/claim-ledger LOC-PLACER-F26 (claim and study_design); source-register LOC-PLACER-S40 periodThe six-chain Placer comparison is described as extending over 12 quarters, but its denominator is 12 retailer-quarter comparisons, with several retailers measured in the same quarter. This overstates the elapsed coverage of this low-confidence vendor analysis.The package LOC-PLACER-F26 says "over 12 quarters" and dates the coverage from Q1 2025 to Target Q2 FY26. Newly opened author's primary analysis https://www.growthfactor.ai/resources/blog/retail-foot-traffic-data, table under the SEC-filings comparison: 12 rows comprise Target (2), Walmart (1), Home Depot (3), Lowe's (3), Chipotle (2), and Dollar General (1); repeated FY25 Q1/Q2/Q3 rows are separate chain observations. This confirms the denominator and unit; it does not independently verify the underlying SEC/Placer figures or elevate the blog to independent validation. supported with qualificationPlacer.ai SEC comparison: 12 retailer-quarter comparisons, not 12 quarters (chapter 4, LOC-PLACER-F26).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 4, "Third-party and production uses" paragraph; Appendix/claim-ledger LOC-PLACER-F26 (claim and study_design); source-register LOC-PLACER-S40 period
R3-23Appendix/claim-ledger LOC-B-F25 claim and final_wording (coefficient-of-variation clause)The claim attaches the coefficient of variation of about 10 to per-capita advertising cost, giving the statistic the wrong denominator. The coefficient is the standard deviation of individual sales divided by mean individual sales.LOC-B-F25 final_wording says individual sales showed a coefficient of variation of about 10 "relative to per-capita ad cost"; its own review_note says that cost comparison qualifies volatility, not the CV. Opened primary paper https://gwern.net/doc/economics/advertising/2015-lewis.pdf, printed p.1942/PDF p.2, explains that the standard deviation of individual sales is typically ten times their mean; printed p.1955/PDF p.15 identifies the ratio as standard deviation to mean and reports a retail median of 9.9. Confidence is high because the denominator is explicit in the paper. contradictedLOC-B-F25: individual sales have a standard deviation about ten times their mean (the coefficient of variation is not relative to ad cost).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Appendix/claim-ledger LOC-B-F25 claim and final_wording (coefficient-of-variation clause)
R3-24Abstract, 'What it found', item 5 (source/chapters/00-abstract.md:29); chapter 12, 'What the evidence says', first bullet (source/chapters/12-next.md:15); data/claim-ledger.json, LOC-HYP-H3.claim and final_wording; chapter 1 In short; fig-control-design takeaway/title in web and MarkdownThe summary calls all nine coded products products that document a lift method, although one is GroundTruth's exposed-only visit reporting, explicitly documented as making no lift claim. The final H3 clarification and chapter 5 correctly distinguish the nine-product visitation diagnostic from the eight-product lift-claim count, but these summary passages collapse them again.Abstract item 5: 'Seven of the nine cohort A products that document a lift method'; chapter 12: 'nine document a general lift method'. Chapter 5's table codes GroundTruth 'Exposed-only, no lift claim' and its next paragraph states: 'In the strict lift-claim count, which drops GroundTruth because it makes no lift claim, six of eight are matched or synthetic'. data/hypotheses.json H3.clarifications[0] explicitly requires a separate strict lift-claim count for a product whose documented metric makes no lift claim. This finding concerns the final summaries' wording, not the already-adjudicated nine-product coding or H3 verdict. The control figure title also calls the nine records default lift methods while its GroundTruth row explicitly says no lift claim. supported with qualificationLift summaries use six of eight products with documented lift methods; seven of nine is kept only for documented visit-measurement methods, with the exposed-only product named. H3 stays contradicted.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Abstract, 'What it found', item 5 (source/chapters/00-abstract.md:29); chapter 12, 'What the evidence says', first bullet (source/chapters/12-next.md:15); data/claim-ledger.json, LOC-HYP-H3.claim and final_wording; chapter 1 In short; fig-control-design takeaway/title in web and Markdown
R3-25Chapter 4, 'What study would settle it', opening sentence (source/chapters/04-validation.md:83)The sentence 'H2 needs one design, run by a party with no stake in the panel' adds a necessary independence condition absent from the registered rule. H2 also accepts a vendor-run comparison with a held-out design and published method, as the chapter correctly explains earlier.data/hypotheses.json H2.rule_supported accepts 'a comparison with a published method by a party without a financial interest, or a vendor comparison with a held-out design and published method'. Chapter 4's opening H2 explanation repeats both routes, while the 'What study would settle it' paragraph says a party with no stake is required and narrows the example to projected retail visits across hundreds of places. supported with qualificationChapter 4: the settling study is framed as one sufficient design; the registered vendor-held-out route is stated.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 4, 'What study would settle it', opening sentence (source/chapters/04-validation.md:83)
R3-26Chapter 6, 'Where the location comes from: H4', Broadsign row (source/chapters/06-audiences.md:41); data/claim-ledger.json LOC-F-F17.claim/final_wording/limitations; source/evidence/research/F.json h4_source_coding_cohort_b row for BroadsignThe final H4 table still says Broadsign Ads is not in the register, although the applied register now contains a distinct cohort-B Broadsign Ads audiences record. Its exclusion can still rest on unconfirmed US availability, but the published explanation and discovery claim describe an obsolete register state.Chapter 6 labels it 'Broadsign Ads (found in discovery, not in the register)' and codes it 'SDK via a named partner; outside the count'. data/product-register.json contains product 'Broadsign Ads audiences', cohort 'targeting', with inclusion_reason 'Discovery (stream F, round 2 R2-109)' and us_available 'unconfirmed (no opened page establishes US availability, check G2)'. The corrections ledger R2-109 records the accepted addition to the register. No change to the H4 verdict is implied. supported with qualificationChapter 6: Broadsign Ads is registered, outside the H4 count because its US availability is unconfirmed.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 6, 'Where the location comes from: H4', Broadsign row (source/chapters/06-audiences.md:41); data/claim-ledger.json LOC-F-F17.claim/final_wording/limitations; source/evidence/research/F.json h4_source_coding_cohort_b row for Broadsign
R3-27source/chapters/00-abstract.md What it found item 1; source/chapters/01-defining.md In short; source/chapters/05-measurement.md In short; source/plain.md §1; corresponding web and Markdown paragraphsThe summaries still report eight products with undisclosed visit bases, while the corrected figure and data count nine. Arrivalist arrivals remain an additional undisclosed visit number after its card-based spend was separated.Abstract: "eight state no basis at all"; chapter 1: "For eight of the fourteen ... the basis ... is not disclosed"; chapter 5: "for eight products the basis is not disclosed"; plain: "Eight do not say what kind of count it is." data/figure-data.json number_kinds.names.not_disclosed lists Blis, Reveal Mobile, Adsquare, Cuebiq, Vistar, Kochava, Arrivalist, Lifesight, Precisely PlaceIQ (nine). LOC-E-F29.final_wording separately says Arrivalist arrival basis is not stated, then lists the other eight; fig-number-kinds correctly reports four disclosed of 13 visit sellers. supported with qualificationNine undisclosed visit bases (Arrivalist's arrival counts included), not eight, in the abstract, chapters 1 and 5 and the plain edition.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/chapters/00-abstract.md What it found item 1; source/chapters/01-defining.md In short; source/chapters/05-measurement.md In short; source/plain.md §1; corresponding web and Markdown paragraphs
R3-28fig-quotient caption caveat in location-intelligence-2026.html and location-intelligence-2026.md; fig-pipeline SVG Scored box and explanatory noteThe figures retain a six-row blind second scoring pass, although the final method and published second-pass data contain sixteen rows.fig-quotient caveat: "six rows nearest a band line re-scored blind"; fig-pipeline: "blind 2nd pass on 6 rows" and "a second AI scorer on six rows". source/chapters/13-method.md How the products were scored says "sixteen rows and 166 cells"; data/figure-data.json second_pass.rows=16, cells=166, exact_pct=81.9, within_one_pct=96.9; data/second-pass.json contains 16 row IDs. contradictedFigures now say sixteen rows for the blind second pass.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.fig-quotient caption caveat in location-intelligence-2026.html and location-intelligence-2026.md; fig-pipeline SVG Scored box and explanatory note
R3-29fig-pipeline SVG Scored box in location-intelligence-2026.html (and figures/fig-pipeline.svg referenced by Markdown)The pipeline calls the scoring population 48 vendors, but the unit is a named product and several companies appear in multiple cohorts.The figure prints "48 vendors". data/capability-matrix.json has 48 product rows but 32 distinct vendor labels; chapter 13 says "The scoring unit is a named product" and plain #scores correctly says "48 products". contradictedPipeline figure: 48 products, not vendors.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.fig-pipeline SVG Scored box in location-intelligence-2026.html (and figures/fig-pipeline.svg referenced by Markdown)
R3-30source/plain.md How the firms scored; plain/index.html #scoresThe score explanation omits the author’s privacy risk adjustment, a material qualification to the claim that a higher score simply means a firm shows more of its work. That adjustment changes two published bands and is explained prominently in the full scoring chapter.Plain says "Each got 0 to 5, based only on what the firm shows in public" and "A high score means a firm shows more of its work." Chapter 11 says privacy is capped at 1 for qualifying events in the three years before the cutoff, separate from published current-control scores. LOC-GQ-F01.final_wording records eight capped products, 3–5 GQ points of impact, and two band changes without the cap (InMarket measurement and Kochava measurement). supported with qualificationPlain edition explains the privacy risk adjustment and that both scores are shown.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/plain.md How the firms scored; plain/index.html #scores
R3-31location-intelligence-2026.md chapter 1 table Rule / Where precise ends / Evidence; more generally prose claim references throughout the Markdown editionThe Markdown edition drops the claim references that connect the web prose and tables to evidence; the chapter 1 table has an entirely empty Evidence column. Although a claim ledger and reference list remain later in the file, the reader loses the direct mapping for the actual paragraph or table row.source/chapters/01-defining.md has claim markers in every Evidence cell, for example Maryland/Oregon/Washington/Connecticut/Virginia cites LOC-H-F24 and LOC-H-F10/F11/F12/F13. The generated location-intelligence-2026.md table prints an empty final cell for all nine rows, while the web edition retains claim chips. The same stripping removes the LOC-* claim markers attached to ordinary prose. supported with qualificationMarkdown edition: claim markers rendered as claim ids instead of being dropped.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.location-intelligence-2026.md chapter 1 table Rule / Where precise ends / Evidence; more generally prose claim references throughout the Markdown edition
R3-32fig-mrc-history caption caveat in location-intelligence-2026.html and location-intelligence-2026.mdThe caption incorrectly says the 2018 MRC presentation has no source record even though that record was added and the figure itself cites it.Caveat: "the 2018 presentation, which has no source record in the evidence files (corrections ledger R2-114)." data/source-register.json contains LOC-NFA-S01, title "MRC presentation to the ACA Executive Forums (26-27 September 2018)", full access, slide 9 passage "Location – 6 Applicants; 1 Accredited", origin data/sources-extra.json; data/figure-data.json mrc.rows[0].src is ["LOC-NFA-S01"], and the figure source list begins with that record. contradictedMRC history caption: the 2018 presentation now has a source record (LOC-NFA-S01); the clause saying it has none removed.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.fig-mrc-history caption caveat in location-intelligence-2026.html and location-intelligence-2026.md
R3-33source/chapters/13-method.md In short, first two sentences; corresponding chapter 13 web and Markdown summaryThe method summary counts the enforcement stream twice by adding it to a workstream total which already includes it.The summary reports "11 research workstreams, 1 vendor-universe sweep ... plus one stream of enforcement records added after the second outside review." data/stats.json has streams=12, workstreams=11 and universe_sweeps=1, and source/evidence/research has exactly A–J, U and X: ten original thematic streams, universe U, and enforcement X. Thus eleven workstreams plus U already includes X; the current wording implies thirteen source streams. supported with qualificationMethod summary: eleven workstreams = ten from the brief plus the enforcement stream; no double count.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.source/chapters/13-method.md In short, first two sentences; corresponding chapter 13 web and Markdown summary
R3-34Chapter 1, The definitions, cohort bullet; source/chapters/01-defining.md; corresponding web/Markdown proseThe opening definitions still describe four cohorts and treat C as one broad data/intelligence group, while the final scoring rules and matrix use five cohorts with separate C1 and C2 tasks. The developer definition also retains the broader location-API wording after places/maps APIs were moved to the listed table.Chapter 1 says 'A is visit measurement ... C is location data and intelligence platforms. D is location APIs and SDKs'. data/scoring-rules.json/cohorts and chapter 13 instead define A, B, C1 foot-traffic/visit analytics, C2 raw movement data, and D geofencing/visit-detection SDKs/APIs. contradictedChapter 1 cohort definitions now list the five final cohorts and the narrowed developer task.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 1, The definitions, cohort bullet; source/chapters/01-defining.md; corresponding web/Markdown prose
R3-35Chapter 13, Interests, Verve contribution sentence; source/chapters/13-method.mdThe disclosure attributes the 2017 playbook credit to 'Verve Group', whereas the historical source credits 'Verve'. Naming the contributor as printed avoids implying that the current group name was the credited entity in 2017.Chapter 13 says 'Verve Group is a listed contributor to IAB’s 2017 location-marketing playbook'. The primary PDF opened for this review, https://www.iab.com/wp-content/uploads/2017/04/IAB_Location-Playbook-for-Retail-Marketers_FINAL.pdf , PDF page 2, lists 'Verve' among the contributing member companies. supported with qualificationChapter 13: Verve (as printed) is credited as a contributor to the 2017 IAB playbook.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Chapter 13, Interests, Verve contribution sentence; source/chapters/13-method.md
R3-36Abstract How it was done; chapter 13 How the evidence was gathered; hero source-count label; data/source-register.json access-status fieldsThe headline count is a count of registered source URLs, not a count of sources whose contents were all opened. The method also calls all 69 non-full records partly readable, although that set explicitly includes failed reads and a search snippet from an unopened page.data/source-register.json has 789 unique URL records: 720 marked full, 50 partial extract, 12 abstract only, four access error with text/metadata via another route, and three access error. LOC-V-VISTAR-S05 expressly says 'search-result summary only (page not opened)'. The abstract says 789 sources 'were opened and logged', and chapter 13 says 69 were 'only partly readable'. This finding does not assert that a claim was supported solely by the unused snippet record. supported with qualificationAbstract, method chapter and hero label: source records registered, with the access-limited records described as such.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.Abstract How it was done; chapter 13 How the evidence was gathered; hero source-count label; data/source-register.json access-status fields
R3-37data/product-register.json and its matrix register copies / universe exports, us_available fieldsProduct-specific US evidence reached during scoring has not been propagated back to several register records. Some register notes remain unconfirmed even where the matrix says the new evidence closes that status; other rows need a narrower update rather than a blanket available label.The Azira Measurement register says “unconfirmed product-level”, but its US-availability cell awards 4 and says the US case and records “settle it”. Mobilewalla’s register remains “unconfirmed”, while its cell says the opened records “close that”. Adsquare measurement’s old note says no opened page shows US attribution; its matrix now documents a named Visit Vermont US campaign but explicitly keeps general US availability unstated. The latter supports recording US production evidence, not a general-availability conclusion. supported with qualificationRegister US-availability fields updated for Azira Measurement and Mobilewalla audiences; Adsquare records named US production use without general availability.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything.data/product-register.json and its matrix register copies / universe exports, us_available fields
FINAL-01Live web edition: inline claim diamonds and numbered citation buttons; screen CSS .claim and .citeThe inline evidence controls have no vertical click area. Visible claim diamonds and superscript citations paint on screen, but pointer clicks do not activate their evidence panels. This undermines the paper's primary traceability interaction, even though matrix-cell panels work.Direct browser inspection on 24 October found all 1,538 button.claim elements had getBoundingClientRect().height = 0; sampled visible numbered citation buttons also had zero height. The published rules set line-height:0, border:0 and zero vertical padding on both .claim and .cite. A normal semantic click on a visible claim control timed out; clicking the painted diamond left #evpanel data-open='false', and elementFromPoint returned the surrounding paragraph. A normal click on the Placer ground-truth matrix cell opened the evidence panel successfully, separating the hit-area defect from the panel logic. Reproduced in the desktop browser at 1363 by 936; touch hardware was not tested. contradictedInline claim and citation buttons now have a real hit area (inline-block, line-height 1, padding), raised by offset so the line box is unchanged; verified by pointer click in the built page.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Live web edition: inline claim diamonds and numbered citation buttons; screen CSS .claim and .cite
FINAL-02Live web edition: DOM citation controls with data-src aliases; source lookup initialization and showSource()A separate source-lookup defect silently breaks 155 citation actions. The canonical source objects contain valid aliases, but the browser lookup indexes only canonical IDs. Controls carrying an alias therefore return without opening a source. The sources themselves are present.Independent parsing of the captured live HTML found 2,287 data-src reference tokens. Of these, 155 tokens, representing 100 distinct IDs, are absent from the canonical-ID lookup; every one maps to a declared alias of an existing source. Example: the figure's [3] button carries data-src='LOC-C-S04', while canonical source LOC-B-S33 has aliases LOC-C-S04 and LOC-PLACER-S01 and number 3. The script initializes SRC[s.id]=s only, then showSource(id) returns immediately when SRC[id] is absent. Matrix scores and claim-ledger source_ids are canonical and have no unresolved references; this defect is confined to the affected DOM citation controls. It will persist after the click-target CSS is fixed. contradictedCitation ids are canonicalised at render (figures and instruments) and the page lookup also indexes source aliases; a new build check fails if any data-src id is not a canonical source id (155 unresolved tokens before, 0 after).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Live web edition: DOM citation controls with data-src aliases; source lookup initialization and showSource()
FINAL-03Chapter 11 matrix, Placer.ai / Ground-truth validation; data-backed Most documented claims in the abstract, chapter 11 and plain editionThe accepted funding correction has not reached Placer.ai's validation score. The score remains 4 because the Minnesota case is called independent, although the live study, source and claim records explicitly say its funding is unknown and independence is not established. That leaves the paper's only Most documented classification unsupported by its frozen rule.Live matrix row placer, ground_truth: v=4, grade B, 'one independent comparison ... University of Minnesota Extension ... Grade rests on S24 alone'; the same rationale says the test is not held out. Live studies.json, Choi 2024 sponsor: 'no funder or data arrangement stated ... independence not established, round 3 R3-11'; source LOC-B-S06 (alias LOC-PLACER-S24) funding='unknown'; LOC-B-F12 / LOC-PLACER-F09 have already been recoded from independent measurement. The dimension says unknown funding is not independent, and anchor 4 requires an independent comparison or a vendor held-out design. Independent recomputation: replacing validation 4 with 3 as an illustrative conservative bound changes Placer GQ 56.2357 to 54.0071 and the C1 field 43.075 to 42.775; Most begins at 54.775, so Placer becomes Well documented. Removing the unsupported validation cell also gives Well documented (53.6615 contradictedPlacer.ai ground-truth validation 4 -> 3: the Minnesota deck states no funder, sponsor or data arrangement, so it is a third-party comparison with a published method and no held-out design (anchor 3). With every final-sweep correction applied together, the C1 field mean falls (four other C1 rows lost points) and Placer.ai stays Most documented, by 0.23 points of offset; it is Well documented under three of the four reweightings, which the abstract and chapter 11 now say.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 matrix, Placer.ai / Ground-truth validation; data-backed Most documented claims in the abstract, chapter 11 and plain edition
FINAL-04Chapter 11 matrix, method_disclosure cells for Mobilewalla audiences, Foursquare Visits feeds and Zartico; same fixed compound-element rule as accepted R3-05Half-published compound elements are still being counted as full elements outside the three rows corrected in round 3. The frozen seven-element count requires panel size AND consent route, and cadence AND uncertainty. At least three further recorded scores exceed the count stated by their own rationales.Mobilewalla v=2 counts (1) sources plus only 'part of (3) panel size (2.2 billion global devices, no consent route)' and says all other elements absent: one complete element is anchor 1, not 2. Foursquare Visits v=3 counts (1) sources, (2) visit definition, (4) normalisation, plus (3) company consent 'but no panel size with a period' and (7) cadence with 'no uncertainty': only the first three are complete, giving anchor 2. Zartico v=2 counts (3) a global device figure 'no consent route' and (7) cadence, with normalisation only asserted: neither compound element is complete, so this remains a marketing-only anchor 1. These are the same AND conditions already applied to Placer, Quadrant and Veraset. Mobilewalla's 2-to-1 correction alone changes its independently recomputed GQ 37.0532 to 35.5865 and Partly to Least documented; Foursquare Visits 3-to-2 alone gives 50.5917 (still Well). This contradictedComplete-element rule applied to all 48 method-disclosure cells: Foursquare Attribution 3 -> 2, Foursquare Visits feeds 3 -> 2, Mobilewalla audiences 2 -> 1, Zartico 2 -> 1, and two further cells found by the same audit, Huq Industries 2 -> 1 and Precisely Visits 2 -> 1. Nine other rationales (Azira Measurement, Cuebiq Audiences, Advan, Mapbox, Outlogic, InMarket, Placer, Quadrant, Veraset) rewritten to the correct count with unchanged scores. Mobilewalla moves from Partly to Least documented.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 matrix, method_disclosure cells for Mobilewalla audiences, Foursquare Visits feeds and Zartico; same fixed compound-element rule as accepted R3-05
FINAL-05Chapter 11 matrix, Broadsign Ads audiences row; product register admission condition; corrections ledger R2-109Broadsign's Native Touch audience candidate is scored and banded even though its explicit US admission condition remains unmet. The live register, matrix note and already-accepted corrections-ledger ruling all say this product must not be scored before US eligibility is established.The row note says 'US availability is not established, so the register’s admission condition is unmet'; register.inclusion_reason says 'Admitted only if US availability is established before scoring'. Its US-availability cell is n/e. The final wording of accepted R2-109 says 'US availability, US panel size and period remain unresolved, so the product is not scored until US eligibility and the numeric-cell minimum are established.' Despite this, the row contributes six scores, GQ 39.8244, a Partly documented band and a place in the 48-product count. Its sources are https://broadsign.com/audiences/ and https://broadsign.com/outmoove/ ; no new US eligibility evidence is recorded. Removing this row alone changes the cohort-B field from 44.0611 to 44.5655; no other band changes in that one-row calculation. contradictedBroadsign Ads audiences moved to the listed table: its admission condition (US availability established before scoring) is unmet. 47 products are scored; cohort B has 14 rows; chapter 13 records the removal.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 matrix, Broadsign Ads audiences row; product register admission condition; corrections ledger R2-109
FINAL-06Chapter 12 standfirst; chapter 12 decision tool, first row / embedded decision[0].test; PDF pp. 115–116The buyer-facing conclusion still turns an unknown visit basis into a majority projection claim. The revised abstract and hero correctly distinguish disclosed projections from an undisclosed basis, but chapter 12 says "Visit counts are mostly projections" and tells buyers a dashboard "visits" number is "usually showing a projection". Neither frequency claim follows from the coded sample. The same standfirst says "nobody independently checks either", broadening the bounded absence of multi-site projected-retail validation to all independent checks of counts or lift.Live chapter 12 standfirst: "Visit counts are mostly projections". decision[0].test: "A dashboard that labels a number "visits" is usually showing a projection." Chapter 1 fig-number-kinds and LOC-E-F29 instead establish that four of thirteen products selling a visit number document a projected number, three also report observed numbers, and nine visit numbers state no basis. The figure expressly warns that a number coded not disclosed may be projected but the vendor does not say. The corrected live abstract already uses "projections or unlabelled". This is remaining propagation of R3-12, not new evidence about product performance. Chapter 12 immediately qualifies its own "unchecked" bullet to no independent multi-site projected-retail comparison found; chapter 4 retains historical SafeGraph park and polling-place comparisons. Thus the absolute standfirst also outruns its qualified suppo contradictedChapter 12 standfirst: visit counts are documented projections or have no stated basis, and no independent multi-site validation of projected retail visits was found in the sources screened. Decision-tool row 1: a dashboard label alone does not establish whether visits are observed or projected.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 12 standfirst; chapter 12 decision tool, first row / embedded decision[0].test; PDF pp. 115–116
FINAL-07Chapter 1 In short; Chapter 11 Placer.ai profile Limits; live claim ledger LOC-PLACER-F01 final wordingThe correction distinguishing projected Placer population totals from raw panel counts is still absent from these passages. They say every Placer visit figure is projected, even though the same live paper explicitly documents raw, unextrapolated panelVisits and panelVisitors.Chapter 1: “Placer.ai describes every visit count it sells as an extrapolation from a device panel.” Placer Limits: “Every Placer visit, visitor and retail-visit figure is a projection ... not an observed count.” LOC-PLACER-F01 repeats that absolute in its final wording. In the same current ledger, LOC-PLACER-F06 says the API separates raw panel counts from projections and defines panelVisits/panelVisitors as raw, unextrapolated data; Chapter 1 body and the corrected profile headline also preserve that distinction. This is a remaining implementation miss of accepted R3-08, not a new challenge to how population estimates are coded. Published source route: https://docs.placer.ai/reference/glossary.md (not independently accessible in this sweep); the contradiction is directly present within the live paper. contradictedChapter 1, chapter 11, the Placer.ai profile limits, the plain edition and LOC-PLACER-F01 now say that Placer's population estimates are projections and that it also exposes raw panel counts.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 1 In short; Chapter 11 Placer.ai profile Limits; live claim ledger LOC-PLACER-F01 final wording
FINAL-08Chapter 11 matrix, Arrivalist MediaInsights / Documented production volume (scale)Arrivalist's production-volume rationale does not reconcile its undated 'Annual Campaigns' claim with the rule requiring a stated 12-month observation period. 'Annual' establishes a duration, but the page supplies no dated observation interval; the current score needs an explicit interpretation of that requirement.The live cell assigns scale=3: 'Anchor 4 met in substance, capped at 3 by grade D ... Annual Campaigns 1000+ ... The 12-month period is not dated.' The published volume definition requires a stated observation period and geography, and cohort A may use measured campaigns 'in a stated 12-month period'; anchor 1 explicitly covers a figure with no period or definition. The primary vendor page https://www.arrivalist.com/partners was reopened in this sweep: its metrics read Annual Impressions 12B+, Annual Campaigns 1000+, Media Partners 20+, without a measurement year or dated 12-month interval. A current copyright or access date does not date those observations. Changing scale 3 to 1 alone recomputes Arrivalist GQ 42.0794 to 40.2341 (still Partly), and also moves Adsquare's relative band to Well because the measurement field mean falls. contradictedArrivalist documented production volume 3 -> 1: "Annual Campaigns 1000+" carries no year, dated period or geography (page re-opened), scored as Placer.ai's undated figure was under R3-04.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 matrix, Arrivalist MediaInsights / Documented production volume (scale)
FINAL-09Chapter 11 matrix privacy dimension and Foursquare Attribution / Movement SDK rationales; published scoring-rules downloadThe privacy window still uses the former 30 October cutoff even though the live paper states a 24 October 2026 research cutoff. The Foursquare rationales also use the stale window to call the 26 October 2023 dismissal outside it.The live privacy definition says 'within the three years before the cutoff (30 October 2023 to 30 October 2026)'. Foursquare Attribution says no event falls inside '2023-10-30 to 2026-10-30', and Movement SDK says the 26 October 2023 dismissal precedes the 30 October opening. Three years before 24 October 2026 begins on 24 October 2023, making 26 October 2023 inside that window. The dismissal remains non-qualifying because it is neither an order, judgment nor finding; none of the seven listed cap events is near the boundary, so no current cap necessarily changes. supported with qualificationPrivacy window moved with the cutoff to 24 October 2023 - 24 October 2026 in the scoring rules and every rationale; the 26 October 2023 Proskin dismissal now falls inside the window and is explained as non-qualifying by event type. No cap changes; chapter 13 discloses the window.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 matrix privacy dimension and Foursquare Attribution / Movement SDK rationales; published scoring-rules download
FINAL-10Chapter 11 matrix rationale text after round-3 patches: Placer, Quadrant and Veraset method_disclosure; InMarket measurement privacySeveral corrected cells append the new ruling while retaining the old, contradictory explanation, leaving a clicked score with two incompatible counts or current-control values.Placer disclosure now starts 'Anchor 2 ... leaving three of seven' but later still says 'Anchor 3 ... Four of seven'; Quadrant and Veraset likewise start with three complete elements at anchor 2 and then retain 'Anchor 3: four ...'. InMarket privacy opens with current_controls 2, later says 'Current controls 3', and finally says it was re-anchored to 2. The scored values themselves match the accepted corrections; this is a reader-facing traceability defect. supported with qualificationPlacer, Quadrant and Veraset disclosure rationales and InMarket's privacy rationale rewritten as one final explanation each; superseded reasoning stays in this ledger.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 matrix rationale text after round-3 patches: Placer, Quadrant and Veraset method_disclosure; InMarket measurement privacy
FINAL-11Chapter 13 blind second-pass explanation and published data/second-pass.json / second-pass.csv tablesThe blind-pass files retain the pre-correction first-score snapshot but do not identify that version, so their 'first' scores and quotients no longer match the published matrix. The reliability percentages still reproduce for that original snapshot; they should be labeled as historical rather than silently read as agreement with the current corrected scores.In second-pass.json Kochava privacy.first = 1 while the matrix is now 2, and Veraset method_disclosure.first = 3 while the matrix is now 2. The bands table has Kochava first 34/Least versus current 35/Partly, and Veraset first 42 versus current 40. The original 166-cell comparison independently reproduces 81.9277% exact, 96.8504% within one among 127 jointly numeric cells, and quadratic kappa 0.89947. Substituting raw second scores into the current matrix still moves only Simpli.fi's band, but updated cohort means yield second quotients 43 for Arrivalist and 42 for Arity versus 42/41 in the retained table. These are distinct versions of the experiment, not evidence that the original agreement statistic was arithmetically wrong. supported with qualificationChapter 13 and data/second-pass.json label the blind pass's first scores as the d5e1dc2e snapshot, before round 3 and the final sweep; the historical blind data are not overwritten. Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: The † now shows the historical experiment only (Simpli.fi), read from data/second-pass.json, instead of substituting old second scores into the corrected matrix (which had flagged four rows); chapter 13 says the published scores carry later corrections.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 13 blind second-pass explanation and published data/second-pass.json / second-pass.csv tables
FINAL-12Abstract, How it was done; chapter 13 In short / How it was checked; fig-pipeline bottom SVG note; embedded claims entry LOC-R3-F01; PDF p.120The claim-checking disclosure no longer describes its own ledger. The ninth unchecked entry is the factual New Jersey statute finding, not a hypothesis or privacy-cap synthesis. The pipeline also retains the absolute statement that every ledger claim was checked despite showing nine author syntheses.The live embedded claims array has 502 entries: checked_independently=true for 493 (310 supported_as_stated, 169 supported_with_qualification, 14 contradicted) and false for nine. The false set is LOC-HYP-H1 through LOC-HYP-H7, LOC-GQ-F01 and LOC-R3-F01. LOC-R3-F01 states the New Jersey precise-geolocation sale ban and its effective date; its classification is synthesis, but it is a new external legal fact rather than a reading or cap-effect calculation. Abstract and method say the unchecked remainder consists of syntheses "that state the hypothesis readings and the privacy-cap effect" and that every research claim was checked. The bottom fig-pipeline SVG note still says "Every claim in the ledger was checked by a verifier or a review", contradicting the corrected 493 research claims / nine author syntheses boxes. The bottom-note absolute also appears on PDF p.120. supported with qualificationAbstract and chapter 13 describe the nine unchecked ledger entries as eight author syntheses plus the review-added New Jersey legal finding, read in the statute by a separate check; the pipeline note now limits "checked" to research claims marked as checked. Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: The pipeline box now reads "8 syntheses + 1 legal finding" and its caption matches the abstract and method.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Abstract, How it was done; chapter 13 In short / How it was checked; fig-pipeline bottom SVG note; embedded claims entry LOC-R3-F01; PDF p.120
FINAL-13Chapter 13 In short; References introduction in web and Markdown; PDF pp.118,132Two remaining process summaries still call all 790 registered sources opened, although the corrected method explicitly retains at least one unopened search-result lead and other access-limited records.Chapter 13 In short says "The research opened and logged 790 sources". References says "The full register of 790 sources opened during the research". The same live method correctly says 68 records are access-limited, including "not opened at all (one is a search-result lead kept for the trail)". The embedded source register contains 722 full, 51 partial extract, 12 abstract only, four access error/text or metadata through another route, and one access error record. The hero already labels 790 "source records registered". This is the remaining wording from R3-36, with the corrected count of limited records otherwise consistent. The same wording appears on PDF pp.118 (method summary) and132 (references introduction). supported with qualificationChapter 13 and the references introduction say "source records", not "sources opened".Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 13 In short; References introduction in web and Markdown; PDF pp.118,132
FINAL-14Plain-language edition, How the firms scored, privacy-rule sentenceThe plain edition now discloses the risk cap, but states it at company level and for any FTC or court order. The frozen rule is product-specific: the event must involve that product's location data. The distinction matters because the main paper removed the Kochava measurement cap when that link was not established.Plain says "a firm with an FTC order, court order or breach in the last three years gets at most 1 point on privacy". The current main matrix and rule require an order/finding/breach involving the product's own location data; the round-3 R3-01 correction records the Kochava measurement product's product-data link as unestablished and removes its cap while keeping the entity flag. The plain wording would reapply that removed cap, and would also cover unrelated orders. supported with qualificationPlain edition: the cap applies when an order, finding or breach is about that product's own location data.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Plain-language edition, How the firms scored, privacy-rule sentence
FINAL-15Plain-language edition, What location data is, fourth number-kind definitionThe plain definition substitutes "web address" for IP address, which can be read as a website URL. The geolocation source in the paper is the device's internet/network address, not the page URL.Plain defines the inferred kind as "Guessed from the ad: the place came from the ad call or the web address." Chapter1 defines it as location from a bid request, an IP address or a user-declared field. A website URL does not mean the same thing as the user's IP address. supported with qualificationPlain edition: "the phone's internet (IP) address" replaces "web address".Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Plain-language edition, What location data is, fourth number-kind definition
FINAL-16Chapter 4 H2 coded and ground-truth figure caption; LOC-B-F31 final wording; Chapter 11 Placer.ai headline/SWOT/Limits/ground-truth capability; Chapter 4 and Foursquare performance record LOC-FOURSQUARE-F26; Veraset/Cabrera source LOC-B-S08 and study metadataThe funding-based independence correction has reached the study tags and several claim classes but remains contradicted by the surrounding text and one Foursquare classification. Placer’s Minnesota comparison is repeatedly still called independent; Foursquare’s 2013 check-in study is also called independent while its funding is recorded unknown. Conversely, the Veraset matrix scorer records a full-text read with ESRC funding and no declared conflicts, but the general source/study record still says abstract-only and funding unknown. Those metadata should be updated from the full primary paper.The live method says unknown-funded studies are not independent. LOC-B-S06 (alias LOC-PLACER-S24) records funding unknown, and the Choi study row now explicitly states independence not established. Nevertheless H2 coded says “one independent trail-site check”; the Placer headline says “one independent check found”, SWOT “has one independent check on record”, and ground-truth capability begins “Independent: one single-site ...”. LOC-B-F31 final wording likewise includes the Placer check under independent evidence. The figure caption says the newest independent comparison data end January 2023, but its January 2023 Advan study has been recoded unknown-funding; separate third-party from independent there. LOC-FOURSQUARE-S52 records funding unknown, while the Foursquare performance row and LOC-FOURSQUARE-F26 remain independent_measurement and Chapter 4 calls it independent. Primary Foursquar supported with qualificationMinnesota and the 2013 HotNets study (no funding or acknowledgement section, re-opened) described as third-party with funding not stated in chapter 4, the ground-truth caption, LOC-B-F31, the Placer.ai profile, SWOT and headline; LOC-FOURSQUARE-F26 recoded to synthesis. Cabrera et al. (Veraset): full text read, ESRC ES/Y010787/1 funding and no conflict declared, so its source, study row and LOC-B-F14 are independent again; no Veraset score changes. Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: Placer SWOT weakness, the Placer Minnesota and Foursquare 2013 profile performance rows (now synthesis) and the LOC-FOURSQUARE-F26 confidence reason no longer call the unknown-funded studies independent.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 4 H2 coded and ground-truth figure caption; LOC-B-F31 final wording; Chapter 11 Placer.ai headline/SWOT/Limits/ground-truth capability; Chapter 4 and Foursquare performance record LOC-FOURSQUARE-F26; Veraset/Cabrera source LOC-B-S08 and study metadata
FINAL-17Chapter 1 Visitation is not lift; Chapter 8 What they leave out; LOC-E-F28 final wording; control-design figure explanatory caption; plain-language edition section 4The corrected six-of-eight lift count coexists with remaining descriptions of all nine records as documenting a general visit-lift method. The ninth record is GroundTruth’s exposed-only visit count, expressly coded as making no lift claim.Chapter 1 says “nine document a general visit-lift method”; Chapter 8 says “Of the nine ... that document a general visit-lift method, seven use no holdout”; LOC-E-F28 final wording begins with the same nine-lift-method description before explaining that GroundTruth has no lift claim. The control figure caption calls the 14-row coding the general method for visit lift. By contrast the current abstract, Chapter 1 inshort, Chapter 12 and LOC-HYP-H3 correctly distinguish eight lift methods (six matched/synthetic) from nine visit-measurement methods (seven nonholdout). This is residual propagation of R3-24; the codes, sensitivity checks and H3 contradicted verdict need no change. Plain section 4 also explains lift as “Nine firms say how they do it. Seven use a look-alike group or no group at all. Two use a holdout,” without separating the no-lift ninth record. supported with qualification"Lift method" kept for the eight products that claim lift; nine visit-measurement methods in chapter 1, chapter 8, LOC-E-F28, the control-design caption and the plain edition.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 1 Visitation is not lift; Chapter 8 What they leave out; LOC-E-F28 final wording; control-design figure explanatory caption; plain-language edition section 4
FINAL-18Chapter 11 Placer.ai profile ground-truth validation capability; LOC-PLACER-F26 study_design metadataThe retailer-quarter correction is complete in Chapter 4 and the final claim wording, but the Placer profile still describes directional agreement over twelve quarters, and current study-design metadata repeats twelve quarters.Live Placer ground-truth capability: “Interested party: chain-level directional agreement 9 of 12 quarters vs SEC-reported figures (S40).” LOC-PLACER-F26 study_design ends “12 quarters; author-selected chains”. Its corrected final wording and Chapter 4 say twelve retailer-quarter comparisons, and the R3-22 correction record confirms the repeated quarter periods for six chains. Original author source: https://www.growthfactor.ai/resources/blog/retail-foot-traffic-data . This is a propagation miss of the accepted unit correction, not a new assessment of the interested blog’s accuracy. supported with qualificationPlacer.ai profile and LOC-PLACER-F26 study design: 12 retailer-quarter comparisons.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 11 Placer.ai profile ground-truth validation capability; LOC-PLACER-F26 study_design metadata
FINAL-19Chapter 5 comparator table, InMarket row; claim LOC-E-F07; InMarket deep profile capabilities.causal_design and method_disclosure; cohort-A matrix inmarket causal_design and method_disclosureThe accepted public-access qualification for the legacy LCI console is still missing from several evidence-bearing surfaces. Source metadata now says the glossary was read once but cannot be reproduced through a public route, while the comparator and claim ledger repeat its thresholds without that qualification and the profile/matrix call its details public method evidence. This is a reproducibility and verification-status inconsistency; a later sign-in wall alone does not prove that a previously captured passage is false or unusable.Live chapter 5 table lists InMarket minimums '10m / 25m impressions; >95%+' without the caveat supplied later in the same chapter. LOC-E-F07 final_wording says 'LCI documents minimum samples and uncertainty' and review_outcome remains supported_as_stated. InMarket profile method_disclosure starts 'Seven-element count from public sources' and credits projection formula and standard error/confidence from S11. The matrix method_disclosure score 3 likewise counts those legacy-console details; its causal_design rationale repeats the legacy thresholds. Canonical source LOC-C-S02 (alias LOC-INMARKET-S11), https://lciadminconsole.inmarket.com , now explicitly records later sign-in redirects and says claims resting on it are unverified from public sources. The current dated synthetic-control summary at https://inmarket.com/blog-foot-traffic-measurement-101-connecting-ad-spend-to-store-visits/ sup supported with qualificationInMarket LCI console details qualified as read once, undated and now behind a sign-in in the chapter 5 table, LOC-E-F07, the profile and the matrix rationales; the public synthetic-control description is distinguished; the disclosure score stays 3 and the rationale states it would be 2 without the console.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 5 comparator table, InMarket row; claim LOC-E-F07; InMarket deep profile capabilities.causal_design and method_disclosure; cohort-A matrix inmarket causal_design and method_disclosure
FINAL-20Radar deep profile performance entry for “Accuracy down to 5 meters”, limits; associated exported deep-profile recordsThe profile treats a configurable requested-accuracy default as contradicting a best-case achieved-accuracy claim. That inference is unsupported: a hundred-metre requested OS accuracy is neither a measured error nor a lower bound on the accuracy delivered, and Radar also documents a high-accuracy preset.The Radar performance entry quotes 'Accuracy down to 5 meters' and says it 'conflicts with the SDK’s default requested accuracy class (hundred metres) in S13'. The reopened primary documentation https://docs.radar.com/sdk/tracking (iOS options and presets) describes desiredAccuracy as the requested accuracy, maps medium to kCLLocationAccuracyHundredMeters, allows custom parameters, and sets Continuous to high/kCLLocationAccuracyBest. The current product page https://radar.com/product/geofencing makes the best-case claim. Apple's official Energy Efficiency Guide, https://developer.apple.com/library/archive/documentation/Performance/Conceptual/EnergyGuide-iOS/LocationBestPractices.html , section 'Reduce Accuracy of Standard Location Updates Whenever Possible', explicitly explains that Core Location often provides more accurate data than requested. LOC-RADAR-F06's own limitations already di supported with qualificationRadar profile: the five-metre best case and the SDK's requested accuracy classes are stated separately; "conflicts" removed (docs re-opened: Efficient and Responsive request .medium, Continuous .high).Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Radar deep profile performance entry for “Accuracy down to 5 meters”, limits; associated exported deep-profile records
FINAL-21Cohort-B matrix azira-audience register.us_available and us_availability rationale; corresponding product-register exportThe register-to-matrix reconciliation was applied to Azira Measurement but still leaves Azira Audience marked US-unconfirmed, despite the same row documenting a named US production case and US observations. The register and scored rationale therefore continue to publish incompatible states.The embedded azira-audience register says us_available="unconfirmed (LOC-U-S35)". Its verified US-availability cell says "Anchor 5 met on substance, capped at 3 by grade D" and cites a Visit Fort Worth campaign in Chicago, built from train-station geofences and first-party data, with 8,445 attributed Fort Worth visits (LOC-SCB1-S02). The rationale itself acknowledges the stale register status. Primary case URL: https://www.azira.com/case-studies/how-azira-and-visit-fort-worth-increased-destination-awareness-and-drove-8k-visits-during-a-competitive-travel-window . This is the same propagation problem addressed for Azira Measurement, Mobilewalla and Adsquare under R3-37; those three original rows have been updated. supported with qualificationAzira Audience register records the named US production case (vendor claim) and keeps general availability separate. Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: The stale final sentence of the Azira Audience US-availability rationale replaced with the register's current status.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Cohort-B matrix azira-audience register.us_available and us_availability rationale; corresponding product-register export
FINAL-22Chapter 7, 'The instruments read' governance table; main five-state-law table citations; figure fig-state-laws caption / figures.jsonThe five-state correction is present in the headline and main table, but the underlying legal register and some pointers remain at older law states. The final governance table still describes Connecticut only by its consent-to-sell rule and Virginia only by its definition; the main sale-ban rows then link to those older sources rather than their operative bans. The state figure's explanation still enumerates only four states.In the live Markdown, the final governance table lists Connecticut PA25-113 as 'Controller shall not sell ... without ... consent' and Virginia §59.1-575 as a definition with 'consent duty in 59.1-578 not opened'. The main table correctly names Connecticut PA26-64 effective 1 October 2026 but cites [155], the older PA25-113; its Virginia sale-ban row cites [162], §59.1-575, instead of [157], §59.1-578. The paper already registers PA26-64 as [159]. The live figure title says five states, while its caption lists Virginia and Connecticut 'joining Maryland ... and Oregon' with no New Jersey sentence. Newly opened operative Virginia text https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/ A.6 prohibits selling or offering for sale precise geolocation (web ref turn144view1); newly opened New Jersey enacted text https://pub.njleg.state.nj.us/Bills/2026/PL26/25_.HTM confirms supported with qualificationGovernance table adds Virginia 59.1-578(A)(6) and Connecticut PA 26-64 secs. 14-15 (both re-opened) and marks the PA 25-113 consent row superseded for sale from 1 October 2026; LOC-H-F16 and LOC-H-F13 now cite the operative texts; the state-law caption adds New Jersey. The Virginia 1 July 2026 date rests on the existing record (the bill page did not load in this sweep). Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: The new Virginia and Connecticut register rows lost their sources because verifier-registered ids (-V) failed the source-id pattern; the pattern now accepts them, and the rows cite LOC-H-V01 and LOC-H-V03.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 7, 'The instruments read' governance table; main five-state-law table citations; figure fig-state-laws caption / figures.json
FINAL-23Chapter 3, 'The bounded finding', sentence beginning 'The search has limits'; LOC-G-F20 and related final-wording surfaces if they repeat the sentenceThe categorical statement that the five named vendors 'file nothing on EDGAR' conflicts with the paper's own Placer evidence. Lack of a periodic reporting obligation is different from having no SEC filings.The live chapter says 'Foursquare, Placer.ai, InMarket, GroundTruth and Blis file nothing on EDGAR'. Its own numbered sources [720]–[723] are Placer Labs' EDGAR submissions record and three Form Ds, and LOC-PLACER-S30 states that the index lists nine D/D-A filings from 2019 to 2024, with no periodic reports. The current Placer profile uses those filings for its financing disclosures. Primary URLs already registered include https://data.sec.gov/submissions/CIK0001786302.json and https://www.sec.gov/Archives/edgar/data/1786302/000178630224000003/primary_doc.xml . Both direct primary opens failed in this sweep, so the finding is the demonstrable contradiction between the published chapter and its own cited SEC records, not an asserted new financing fact. contradictedChapter 3 and LOC-G-F20: the named private vendors file no 10-K or 10-Q reports; Placer Labs has filed Form D notices.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 3, 'The bounded finding', sentence beginning 'The search has limits'; LOC-G-F20 and related final-wording surfaces if they repeat the sentence
FINAL-24LOC-U-F02 source_ids/support in the live claim ledger; numbered sources/source register; Foursquare source LOC-FOURSQUARE-S14 reliability noteThe qualified Foursquare completion wording is now correct, but the two primary participant accounts that support it have not been registered or linked to the final claim. The profile's secondary-source record still says Crowley's original could not be located even though the published corrections ledger says both originals were reopened.LOC-U-F02.final_wording attributes completion accounts to Crowley on 20 October and a shareholder on 24 September; source_ids remains LOC-U-S07, LOC-U-S06 and LOC-U-S08, whose support passages are the September announcement and homepage banners. No record in the live 790-source register has either participant URL. Corrections R2B-25 and R2B-34 say both posts were opened on 24 October. LOC-FOURSQUARE-S14 still says Crowley's original was not located. Freshly reopened primary https://teendrama.substack.com/p/some-final-words-on-foursquare (20 October, turn155view0) describes acquisition about a month earlier; https://buttondown.com/rickwebb/archive/good-morning-hello-how-are-you-1820/ (24 September, turn155view1) describes the sale and receipt of counsel's sale paperwork. Neither supplies a verified legal closing date. supported with qualificationCrowley (20 Oct 2026) and Webb (24 Sep 2026) posts registered as LOC-NFA-S04 and S05 and cited on LOC-U-F02 (both re-opened; neither gives a closing date); the S14 note no longer says the original was not located.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.LOC-U-F02 source_ids/support in the live claim ledger; numbered sources/source register; Foursquare source LOC-FOURSQUARE-S14 reliability note
FINAL-25Vistar profile risks[1], capabilities.privacy, timeline 2024-05-01, SWOT threats[2]The earlier blanket-sharing error is fixed, but the replacement still omits 'precise' when describing InMarket's sale/licensing ban. Read on its own, the profile now implies that the order also bans coarse location sales.The live Vistar SWOT says 'Partner InMarket has been barred since May 2024 from selling or licensing location data'; the risk, privacy note and timeline use the same unqualified scope. The freshly reopened FTC order https://www.ftc.gov/system/files/ftc_gov/pdf/InMarketMedia-DecisionandOrder.pdf (turn137view1), definition F on printed p4, defines Location Data as precise location and excludes coarse data and data used solely to generate coarse location then deleted within 48 hours. Provision II bans sale/licensing for valuable consideration of that defined Location Data. Chapter 7 already expresses the precise/coarse distinction correctly. supported with qualificationVistar profile, SWOT, chapters 6 and 7: InMarket's ban is on selling or licensing precise location data as the order defines it.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Vistar profile risks[1], capabilities.privacy, timeline 2024-05-01, SWOT threats[2]
FINAL-26Chapter 9, "Which sellers name their sources", paragraph after the six-product source table (live.md line 852); LOC-I-F23/register contextThe earlier Broadsign register correction has not reached chapter 9. It still calls Broadsign Ads audience targeting "found in discovery and not in the register", although the live register includes it and chapter 6 now correctly says its US availability is unconfirmed. This is a remaining propagation failure from R3-26, not a change to H4.The live paragraph reads "Broadsign Ads' audience targeting, found in discovery and not in the register, names Native Touch data...". The chapter 6 H4 row instead reads "Broadsign Ads (registered; US availability unconfirmed)". The published product register contains Broadsign Ads audiences as a listed cohort-B product with US availability unconfirmed. Those two settled facts can coexist; "not in the register" cannot. supported with qualificationChapter 9: Broadsign Ads audiences registered but outside the US count because US availability is unconfirmed.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 9, "Which sellers name their sources", paragraph after the six-product source table (live.md line 852); LOC-I-F23/register context
FINAL-27Chapter 8, "What they leave out" and September 2018 MRC presentation references; chapter 10, "What vendors claim" (proprietary VIOOH/Displayce paragraph); LOC-A-F07.source_ids and numbered-reference wiringSeveral substantive corrections are present in the prose but their primary or actual supporting sources have not been wired into the citations. Readers following the numbers reach sources that cannot establish the corrected statement.The chapter 8 statement about the September 2022 Outcomes and Data Quality Standards cites only [445], which is the March 2017 Location-Based Advertising Measurement Guidelines. The actual 2022 source is registered as LOC-A-V01 but has no reference number, and LOC-A-F07.source_ids still contains only LOC-A-S02. The 2022 primary PDF independently opened for this sweep confirms physical-visitation coverage in section 2.1.6 (printed p12) and incrementality/RCT discussion later: https://mediaratingcouncil.org/sites/default/files/Standards/MRC%20Outcomes%20and%20Data%20Quality%20Standards%20(Final).pdf . Likewise chapter 8's September 2018 presentation sentence cites [166,167,520,568] although the actual presentation is [164]/LOC-NFA-S01 (already correctly in the figure citation). In chapter 10 the proprietary VIOOH/Displayce statement cites [198,200,201,205], which are Prebid code, the AAO r supported with qualificationLOC-A-F07 now cites the September 2022 MRC Outcomes and Data Quality Standards (re-opened: s. 2.1.6 p. 12, s. 2.1.9 p. 16); LOC-A-F11 cites the September 2018 presentation (LOC-NFA-S01); LOC-J-F13 cites the VIOOH and Displayce records. Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: LOC-A-F07 limitations no longer say the 2022 MRC standard was unopened.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 8, "What they leave out" and September 2018 MRC presentation references; chapter 10, "What vendors claim" (proprietary VIOOH/Displayce paragraph); LOC-A-F07.source_ids and numbered-reference wiring
FINAL-28Chapter 9, "Footfall attribution without a holdout", sentence "The channel's public guidance names matched designs, not holdouts"; chapter 8 "IAB guidance" and LOC-I-F11 access limitationThe full July 2025 IAB DOOH Measurement Guide is now publicly retrievable, and it includes geographic holdouts. The paper's broad claim that the channel's public guidance names no holdouts is therefore too strong. The product-default H3 verdict is unaffected.A normal public web search found and this sweep opened the 31-page IAB-branded July 2025 PDF at https://assets.contentstack.io/v3/assets/bltbeaed4aed52c223a/blt494e044b82a9dcb0/68cb0a53da7537f88855f47c/iab-dooh-measurement-guide.pdf . Chapter 7, printed p24 (PDF index23), recommends synthetic-control and matched-market/store methods and says combining synthetic models with geographic holdouts can reduce exposure contamination. The public IAB landing page at https://www.iab.com/guidelines/dooh-measurement-guide/ still displays an account gate, so the earlier research access limitation was plausible, but the public PDF closes it. This is methodological guidance, not evidence that any of the six screened products uses a holdout by default. contradictedIAB's July 2025 DOOH Measurement Guide read from its public PDF (registered as LOC-NFA-S03): it recommends synthetic-control and matched-market or matched-store tests and describes geo holdouts as reducing contamination (pp. 23-24). Chapter 9, LOC-I-F11 and LOC-A-F23 updated; the product-default H3 coding is unchanged. Closure check of release 9633c5fb (24 October 2026) found a residue, fixed in the next release: Chapter 13 limits no longer list the IAB guide as unread; it records the later full read of the public PDF.Shared rules: every outside finding is checked against its primary source or the paper's own data before it changes anything; scores follow the frozen anchors.Chapter 9, "Footfall attribution without a holdout", sentence "The channel's public guidance names matched designs, not holdouts"; chapter 8 "IAB guidance" and LOC-I-F11 access limitation
Machine-readable copy: data/corrections-ledger.csv.

Appendix

Appendix: hypotheses, universe and downloads

The registered hypotheses and how they read

Each hypothesis was registered on 24 October 2026, before any research agent ran, with its rules for supported, contradicted and unresolved. Four were clarified after extraction; each clarification is dated and published next to the original rule in data/hypotheses.json.

HypothesisReadingBasisChapter
H1SDK supply contracted after the 2019–2021 permission changes and vendors substituted other sourcesUnresolvedNo comparable US panel series; no filing attributes a quantified supply change to a platform change 2, 3
H2Visit estimates agree with independent ground truth within the vendor's stated errorUnresolved overall; adverse for SafeGraph's 2018-vintage panelNo independent multi-site retail comparison found 4
H3Visit lift rests on randomised or holdout controls by defaultContradictedSeven of nine documented methods are matched, synthetic or exposed-only 5
H4Location audiences rest mainly on bidstream or IP locationUnresolvedFewer than four products document a primary source 6
H5FTC-ordered companies no longer sell precise or sensitive location dataContradictedOutlogic and Collective Data Solutions market precise-location offers; Gravy dba Unacast offers device-level data 7
H6A US visit metric holds current MRC accreditationContradicted (24 October 2026)No visit or location metric on any of MRC's eleven lists 8
H7Location signals reach production use in agent-driven buyingUnresolvedHighest state: one implemented connector 10

The four coded questions are answered in the chapters: Q1, what kind of number each product sells, in chapter 1; Q2, which mobility data sits under US DOOH audiences, in chapter 9; Q3, how the market consolidated, in chapter 2; Q4, what Apple and Google changed and what effects are documented, in chapter 3.

The vendor universe

Every company and product the research met, with owner, cohort, status and, for scored products, the matrix row. Listed and historical products are described, not scored.

Downloads

Every dataset behind the paper, in CSV and JSON.

Downloads

The two other editions, then the data as CSV and JSON, UTF-8. The data files are the canonical files every chart, matrix and count in the paper was built from.

  • 1location-intelligence-2026.pdf — the print edition: A4, with page numbers and chapter bookmarks
  • 2location-intelligence-2026.md — the reading edition in Markdown, with numbered references
  • 3data/source-register.csv — every source with publication, event and access dates, type, geography, funding, access limits and reliability notes
  • 4data/claim-ledger.csv — every material claim with sources, passage locator, scope, evidence class, review outcome, confidence and final wording
  • 5data/capability-matrix-wide.csv — vendors × dimensions, scores only (0–5, n/e, n/a)
  • 6data/capability-matrix-long.csv — one row per cell with availability, evidence grade, date, rationale and sources
  • 7data/capability-dimensions.csv — the dimension definitions and anchors
  • 8data/gq.csv — Ground Quotient per vendor: group means, coverage, band, the reweightings and every dimension score
  • 9data/gq-method.csv — GQ groups, weights, shrinkage, field mean, band thresholds, and the reweighting, shrinkage and missing-evidence tests
  • 10data/gq-missing-evidence.csv — every scored cell turned into n/e one at a time, with the GQ before and after
  • 11data/swot.csv — every SWOT line for the profiled vendors with its basis (record, vendor documentation, vendor claim, inference) and sources
  • 12data/deep-profiles.csv — the deep-profile summaries: what is sold, buyers, earnings, dependencies, fit, limits
  • 13data/deep-profile-records.csv — every profiled capability, performance claim, financial figure and timeline event with sources
  • 14data/study-evidence.csv — studies with design, sample, sponsor and limits
  • 15data/corrections-ledger.csv — every change made after verification and challenge passes, with implementation and verification
  • 16data/vendor-universe.csv — the reasoned vendor sample with scope group, owner, formats, routes and status
  • 17data/agentic-map.csv — AI and agentic capabilities with status labels and observability
  • 18data/rules.csv — rules and governance instruments by jurisdiction
  • 19data/decision-tool.csv — the decision tool rows
  • 20data/product-register.csv — the product register: every scored or listed product with its purchased service, operating entity, owner, cohort, inclusion reason, aliases and US availability
  • 21data/hypotheses.csv — the hypotheses registered before extraction, with the rules for supported, contradicted and unresolved
  • 22data/figure-data.json — the canonical dataset behind every data figure
  • 23data/derived-checks.json — every derived number with its formula and inputs
  • 24data/stats.json — every count the prose and figures quote about the research itself, computed from the ledgers
  • 25data/second-pass.csv — the blind second scoring pass: one row per re-scored cell with both passes’ scores, grades and reasons, and the adjudication of each material disagreement
  • 26data/second-pass.json — the same cells with both passes’ sources, each re-scored row’s band under both passes, and the agreement statistics’ inputs
  • 27data/scoring-rules.json — dimension definitions, anchors, cell rules and the GQ definition, fixed before scoring

References

Numbered sources

The 734 sources cited in this paper, numbered in order of first citation. The full register of 793 source records, with access dates, access limits and reliability notes, is in data/source-register.csv. Click any number in the text to open the same record.

734 numbered sources