You’re being tracked — around the web, sure, but also in real life: the apps on your smartphone are constantly feeding data into the digital advertising market, where it’s bought and sold by hedge funds, financial institutions, and marketers. A new report in The New York Times underscores the horrifying implications of the system, featuring location data mined from the rioters who sacked the US Capitol on January 6th, leaked by an anonymous source in the industry.

“This new data included a remarkable piece of information: a unique ID for each user that is tied to a smartphone,” they write. “This made it even easier to find people, since the supposedly anonymous ID could be matched with other databases containing the same ID, allowing us to add real names, addresses, phone numbers, email addresses and other information about smartphone owners in seconds.” Those IDs, the authors explain, are called mobile advertising identifiers, and they allow corporations to track people across the web. “They are supposed to be anonymous, and smartphone owners can reset them or disable them entirely. Our findings show the promise of anonymity is a farce,” they write.

Furthermore, usage of that data doesn’t seem regulated at all. As the Times story notes, there aren’t any laws that force companies to disclose what they’re using the data for or how long they’re using it. Even if you know your records were sold, you can’t actually request that it be deleted in most states. That means, once collected, the data can be bought and sold in perpetuity.

That location data is also somewhat imprecise, which isn’t necessarily a good thing. The Times story takes on one man’s case, in particular: he was at the Capitol riot, and his data possibly places him inside the Capitol as it was being stormed. He denies entering the Capitol. But in the hands of law enforcement, for example, that data might be used as evidence in a criminal case.

The Times report is terrifying for a number of reasons, but the worst is how little control we ordinary citizens have over how our data is used. It’s up to the people in power to do something about it.