An Idaho-based data broker has been sued by the Federal Trade Commission (FTC) for selling geolocation data on hundreds of millions of mobile phone customers that could unveil sensitive personal information without their knowledge or consent.

The lawsuit, filed Monday in U.S. District Court for the District of Idaho, alleges Kochava violated the FTC Act when it purchased, collected, and sold geolocation data on mobile phone customers that could help buyers learn where a particular individual lived, worked, worshipped, and has sought medical or mental health services. The data collected was not anonymized, so buyers could track whether an individual visited sensitive locations like abortion clinics, homeless and domestic violence shelters, or substance abuse facilities, the FTC said.

The agency’s lawsuit seeks to require Kochava to halt the sale of and delete the geolocation data it has collected.