US-based Gravy Analytics and Mobilewalla must also delete historic data collected on millions of Americans.