You never told it your faith. It guessed.
Where your phone sleeps on Sunday morning, what you buy before a holiday, which hours you go quiet. None of it says "religion." Together, it can. This exhibit lets you watch a feed rearrange itself as a system grows confident about what you believe, then shows which states make it ask you first.
Wisconsin Catholics a political group said it identified from phones seen at Mass at least three times in 90 days, ahead of 2020.
States with comprehensive consumer privacy laws by January 2026; each law we read directly lists religious belief as sensitive data.
Colorado's rules say inferred religion needs consent, unless the inference is obvious to you, used only as disclosed, never shared, and deleted within a day.
At a glance
- The question
- Can ordinary data reveal a person's faith without their saying so, and which states require consent before a company uses that guess?
- Strongest evidence
- A political group reported identifying about 200,000 Wisconsin Catholics from phones seen at Mass REPORTED; the FTC alleged a broker sold lists of people who visited places of worship. REPORTED Colorado's rules require consent for inferred religion. FACTrule text
- Main uncertainty
- Room A's inference weights are our model, not any platform's code, and major platforms say they do not target ads by religion. Whether most state laws reach an inference, outside Colorado's rule, is untested.
- Where Infera stands
- This is an argued position, made as fairly as we can. We weigh consent, truthful representation, limited collection and meaningful endings heavily. We frame questions for congregations and families to decide; we do not settle them for any tradition.
- A · The feed that learnsOrdinary signals, combined, can produce a confident guess about faith, and a feed can re-sort around it. INFERENCEeditorial model The state map shows who must ask first. FACT REPORTED
- B · The parking lotOne simple rule, three visits in 90 days, labels phones by faith and can be matched to a voter file. Four dated cases show versions of it have happened. REPORTED
- Both sidesSome inference is ordinary and useful, like a grocery app noticing kosher orders; faith is also the category history has punished people for.
How to read our labels. FACT means we read it at the primary source. It tells you what that source says: a company's own documentation, a study's finding in its own sample, a statute's text. It does not certify that the claim holds everywhere or that a product works as promised. REPORTED is a secondary account. INFERENCE is Infera's reading or model. WATCH is unconfirmed or open. Where a label needs more precision we add a note, such as company documentation, study finding, editorial model or search result.
Turn on the signals a platform could see. Watch the portrait turn toward you, and the feed re-sort.
Each signal is ordinary on its own. The system adds them up into a guess. The portrait scrubs forward and sharpens as its confidence rises, and the feed promotes whatever matches the guess.
Weights are an Infera model of how such systems combine signals, not any company's code. INFERENCE
Where do you live? Tap a state
FACT Virginia defines sensitive data as personal data "revealing" religious beliefs and requires a consumer's clear, affirmative consent to process it. Colorado's rules expressly require consent for "Sensitive Data Inferences," with a narrow exception for consumers over 13 when the inference is obvious, used only as disclosed, not shared and deleted within 24 hours. REPORTED California gives a right to limit sensitive information used to infer characteristics; Utah and Iowa require notice and a chance to opt out; Maryland allows sensitive data only when strictly necessary for a requested service and bans its sale. Other states' approaches come from a January 2026 law-firm comparison chart. INFERENCE Whether "revealing" covers a guess drawn from Sunday locations is our reading; we found no court ruling. In most consent states, a targeted ad based on inferred faith would need your yes. Nothing here is legal advice.
It has already happened at church. Draw a fence around a sanctuary and count the phones that keep coming back.
One political group's reported rule was simple: a phone seen at Mass three times in 90 days counts as a Catholic. Slide the weeks forward and watch the rule pick people out of a crowd.
Mass-goers, by phone
CatholicVote said it geofenced churches and found nearly 200,000 Wisconsin Catholics who attended Mass three times in 90 days; about half were not registered to vote. Its president: "We don't need permission to reach millions of voters."
A prayer app's location data
Motherboard found Muslim Pro, with over 96 million downloads, sold location data to the broker X-Mode, which had sold location data to military contractors. Apple and Google later banned X-Mode.
A platform pulls the label
Meta removed detailed ad targeting for "religious practices and groups," such as "Catholic Church" and "Jewish holidays," calling them topics people may perceive as sensitive.
The FTC steps in
The FTC alleged Gravy Analytics sold lists of people who visited places of worship and linked people to religious viewpoints inferred from location; its order bars selling sensitive location data.
Should a system be allowed to guess your faith?
Some inference is ordinary, and sometimes useful
- A grocery app that notices kosher or halal orders and shows more of them is serving a customer, not surveilling a believer.
- Churches, mosques and synagogues use the same tools to reach people who are searching; outreach is a form of free exercise too.
- Consent banners for every guess would bury people in prompts; Colorado's 24-hour exception exists because some inferences are obvious and harmless.
- Platforms have already pulled religious targeting labels voluntarily, and the FTC has acted against the worst brokers without new law.
Faith is the wrong thing to guess without asking
- Religion is the category history punishes people for. A list of who prays where is dangerous in the wrong hands, and lists change hands.
- You cannot correct a guess you never see. A wrong inference can follow you into prices, politics and feeds.
- Thirty states have no comprehensive privacy law at all, so the same guess is regulated in Richmond and unregulated across the river in other places.
- "Revealing" religious belief was written for what people disclose. Whether it reaches what machines infer is mostly untested.
The inference weights in Room A are our model; we did not test any platform's systems, and major platforms say they do not target ads by religion. Signals are chosen to be ordinary practices, not stereotypes, and any one of them can belong to someone of another faith or none.
We read Virginia's statute and Colorado's rule directly. California, Utah, Iowa, Connecticut and Maryland come from law-firm summaries; the remaining states' consent rules come from one January 2026 comparison chart whose grid we could not fully verify. Florida's law reaches only very large companies; we mark it but did not analyze it.
Whether state laws treat an inference as "revealing" religious belief, outside Colorado's explicit rule, is untested as far as we found. Nothing here is legal advice.
Five questions to ask of any app on your phone
- Does it collect your precise location on weekend mornings, and who does it share that with?
- If it guessed your faith, would it have to tell you, and could you see the guess?
- Does your state require your consent before it uses that guess, and did you ever click yes?
- Does your house of worship's own app or website share data with ad networks?
- Would you answer differently if the guess were wrong?
The fourth Faith Layer exhibit. Personhood, Inc. showed posted images sorting you into a class; here the class is a creed. The Composite State showed a person rebuilt on demand from scattered records; here the record is a Sunday pattern. The Quiet Guest followed cameras to the church door; this follows phones into the pews.
- Code of Virginia § 59.1-575, definitions of "sensitive data" and "consent" (read at primary)
- Colorado Privacy Act Rules, 4 CCR 904-3, Rule 6.10, Duty regarding sensitive data, including sensitive data inferences (read at primary, via Justia)
- Benesch, "Different sensitive personal information rights emerge in new US state data protection laws" (CA, CO, CT, VA, UT)
- Byte Back, "How do the CPRA, CPA and VCDPA treat sensitive personal information?" Feb 2022
- Akin, "Iowa Data Protection Act: What Businesses Need to Know" (notice and opt-out for sensitive data)
- Willkie, "Maryland enacts one of the strictest privacy laws in the nation," May 2024
- Foley, "U.S. State Comprehensive Consumer Privacy Law Comparison Chart," V16, Jan 2026 (state list, effective dates)
- National Catholic Reporter, "Pro-Trump group targets Catholic voters using cell phone technology," 2 Jan 2020
- Vice / Motherboard, on Muslim apps, location data and X-Mode, Jan 2021
- The Record, "FTC takes action against location data brokers Gravy, Venntel, Mobilewalla," 3 Dec 2024
- Search Engine Land, "Meta will remove targeting options for sensitive topics on January 19," 2022
- Tom's Guide, on Meta using AI chats for ads from 16 Dec 2025, excluding religion
- Imagery: Infera image archive, made with Midjourney; halftone portraits, not real people. Feed, map, geofence and meters are drawn in code from the data.