The alarm bells have been sounding about location tracking, and the state legislatures have been responding. Perhaps the loudest ringing in 2020 is from the Washington Privacy Act, the Senate and House versions of which are now being reconciled, but both of which count as sensitive data and require prior consent for the collection of geolocation information accurate to less than 1750 square feet. The Network Advertising Institute (“NAI”) just beat Washington’s legislature by updating its own much more nuanced guidance defining imprecise location data for targeted advertising or ad delivery and reporting for its members, exempting them from opt-in consent requirements if their geolocation achieves such imprecision.

The NAI guidance is important – not just for members – as the only comprehensive definition of precise location data now in effect in the United States. For example, despite referring to precise location as “sensitive,” the Federal Trade Commission (“FTC”) recognizes that the agency has not produced standards governing geolocation information. The FTC has historically called on all players in the mobile ecosystem to develop standards governing the collection, use, and disclosure of information “particularly for location data,” reinforcing the NAI guidance’s significance.

1. Three Paths to a Safe Harbor

The guidance provides three safe harbors under which location data is always imprecise: (i) information that is a generic place name, (ii) sufficiently large geofences, and (iii) GPS coordinates with two or fewer decimals.

Perhaps limiting the safe harbors’ utility, the NAI opt-in consent rules apply when an organization receives location data. As such, members that collect precise location data that they subsequently render imprecise are nonetheless required to obtain users’ consent, although such rendering is undoubtedly helpful to downstream recipients and related contracting.

A. Stick to Generic or Ubiquitous Place Names

Location data is de facto imprecise if the data does not describe an actual physical location (e.g., a car dealership). Even if such information is based on precise latitude and longitude, rules governing precise location data do not apply if “general descriptors are saved instead of the latitude/longitude coordinate with seven decimals.” 

As is often critical for attribution analysis (among other uses), a place name that refers to many identifiable locations (e.g., Starbucks) is also imprecise. However, the guidelines draw a clear distinction between using imprecise data describing location at any of a chain’s stores (e.g., Home Depot) versus precise location data of a unique place name (e.g., “Mom and Pop Hardware”).

B. Expand Geofences

Recording a specific place name that is sufficiently large is also not precise location data. As such, a circular geofence having a radius larger than 500 meters (785,398 square meters) is de facto imprecise.  An organization accordingly does not use precise location data when it collects and uses a consumer’s location at a large place, expressly included examples include Disney World or Central Park.  Even if using circular geofences is not feasible, geofences of any shape are not precise location data if their size is 800,000 square meters or greater.

C. Coordinates with Two or Fewer Decimal Places

Reflecting the NAI’s belief that a user’s location data within an area larger than 785,398 square meters is not precise, a GPS coordinate location with two or fewer decimal places is also rendered imprecise.

2. Where to Go if No Safe Harbor is Available

Even in the event that no safe harbor is available, the NAI provides a four factor test to determine whether location data if imprecise. We provide a chart below summarizing those factors.

Members who use location data that the member believes to be imprecise, but that do not fall within a safe harbor, should document an analysis that the location data is not precise. The NAI will consider that the member conducted a “reasonable analysis” relying on its four factors when reviewing a members’ use of location data.