Smartphones, smartphone apps, websites, and other connected devices (e.g., “wearables”) increasingly request that consumers provide their geo-location information. Geo-location information can refer to general information about a consumer’s location, such as his or her city, state, zip code, or precise information that pinpoints the consumer’s location to within a few feet, such as his or her GPS coordinates.

Organizations request geo-location information for a variety of reasons. For example, many apps – such as transportation or delivery services – require geo-location in order to provide services that are requested by the consumer. Other apps – such as mapping programs, coupon programs, or weather programs – require geo-location information in order to provide consumers with useful information. Because such information has become intertwined, in many cases, with products and services, some organizations require the user to “Accept” or ‘“Agree”’ to the collection of geo-location information as a condition to using a device, application, or website.

Although there is currently no federal statute that expressly regulates the use, collection, or sharing of geo-location data, the FTC has taken the position that precise geo-location information is a form of “sensitive” personal information and has suggested that a failure to reasonably secure such information, or a failure to adequately disclose the collection or sharing of such information, may violate the FTCA’s general prohibition against unfair or deceptive practices.¹ In addition, Congress and state legislatures have considered several proposals that would expressly regulate geo-location information.

What to consider if your organization collects geo-location information:

1. What is the purpose for which geo-location information is being collected?
2. Are you collecting the least granular (i.e., most general) location information possible in order to effectively provide a product or a service to the consumer?
3. How often do you need to collect geo-location information?
4. Is the user aware that geo-location information is being collected?
5. Does the user have the ability to disable the collection of geo-location information?
6. Does the user have the ability to control how long that information is maintained, how it is used, when it is shared, and whether it is associated with their name?
7. Will the geo-location information be shared with third parties such as advertisers? If yes, how much and how often will you share the information?
8. Is the geo-location information encrypted in transmission from the consumer and/or at rest within your organization?

1. See, Jessica Rich, Prepared Statement of the Federal Trade Commission on S. 2171 The Location Privacy Protection Act of 2014 Before The United States Senate Committee on the Judiciary Subcommittee for Privacy, Technology, and the Law, (June 4, 2014), https://www.ftc.gov/system/files/documents/public_statements/313671/140604locationprivacyact.pdf.

2. Almuhimedi et. al., Your Location has been Shared 5,398 Times! A Field Study on Mobile App Privacy Nudging, http://www.normsadeh.com/file_download/179.

3. Mary Madden, Privacy and Cybersecurity: Key findings from Pew Research, Pew Research Center, (January 16, 2015), http://www.pewresearch.org/key-data-points/privacy/.

4. Elizabeth Dwoskin, Where were you 3 Minutes Ago? Your Apps Know, Wall Street Journal (May 23, 2015), http://blogs.wsj.com/digits/2015/03/23/where-were-you-3-minutes-ago-your-apps-know/.

5. IAPP Resource Center, Geolocation (May 5, 2016), https://iapp.org/resources/topics/geolocation/?mkt_tok=eyJpIjoiT0RVNU5ERmpNakl6TWpVMCIsInQiOiJWNStcL2JsVmRweE9WbW13Z1NUVFBBeHBwN.

6. Elizabeth Dwoskin, Where were you 3 Minutes Ago? Your Apps Know, Wall Street Journal (May 23, 2015), http://blogs.wsj.com/digits/2015/03/23/where-were-you-3-minutes-ago-your-apps-know/.