Precise geolocation

The government defines “precise geolocation information” as “information that— (A) is derived from a device or technology of an individual; and (B) reveals the past or present physical location of an individual or device that identifies or is linked or reasonably linkable to 1 or more individuals, with sufficient precision to identify street level location information of an individual or device or the location of an individual or device within a range of 1,850 feet or less”.1 Source: 15 U.S.C. § 9901(a), (b)(1), (c)(6)–(7)

Chair Khan, joined by two other Commissioners, described location data as “among the most sensitive of people’s data, revealing everything from where someone spends the night and where they worship to what medical treatments they seek.” 11 Source: Statement of Chair Lina M. Khan, In the Matter of Mobilewalla, Inc., Commission File No. 2023196 (Dec. 3, 2024) Precision is what makes that possible. The Gravy Analytics complaint alleged that a signal with five decimal places of latitude and longitude locates a consumer to within approximately one meter, enough to identify not only what building a consumer is visiting but even what room the consumer is in. 12 Source: In the Matter of Gravy Analytics, Inc. and Venntel, Inc., File No. 2123035 (complaint) Repeated signals from one device also point to a home, because the location of a mobile device at night likely corresponds to the consumer’s home address. 13 Source: FTC v. Kochava Inc., Second Amended Complaint for Permanent Injunction and Other Relief The consumer is rarely in a position to protect themselves, since in the Gravy Analytics matter consumers generally had no interactions with the company and no idea it had their location data. 14 Source: In the Matter of Gravy Analytics, Inc. and Venntel, Inc., File No. 2123035 (complaint) That is why the duties below fall on the company that collects, buys, or sells the data.

A federal court has accepted that this kind of exposure can be a legal injury: in the Kochava litigation it held that an invasion of privacy may constitute an injury that gives rise to liability under Section 5(a). 15 Source: FTC v. Kochava Inc., Memorandum Decision and Order (Feb. 3, 2024) Commissioner Holyoak, concurring in Kochava, pointed to the Supreme Court’s description in Carpenter of cell phone location information as something that “provides an intimate window into a person’s life, revealing not only his particular movements, but through them his familial, political, professional, religious, and sexual associations.” 16 Source: Concurring Statement of Commissioner Melissa Holyoak, Kochava Inc., FTC Matter No. X230009 (July 15, 2024)

How far the theory reaches is contested inside the Commission. Dissenting in Mobilewalla from the count on categorizing consumers, Commissioner Holyoak wrote that there is nothing intrinsically unfair about such categorization, on its own, and that each unfairness claim needs to be assessed for both substantial injury and countervailing benefits. 17 Source: Dissenting Statement of Commissioner Melissa Holyoak, Mobilewalla, Inc., FTC Matter No. 2023196 (Dec. 3, 2024) Chair Khan’s statement in the same matter said the case “further highlights the continued shortcomings of the ‘notice and consent’ paradigm.” 18 Source: Statement of Chair Lina M. Khan, In the Matter of Mobilewalla, Inc., Commission File No. 2023196 (Dec. 3, 2024) According to that statement, the Commission’s orders in recent years have moved away from relief premised exclusively on consumer consent and toward greater reliance on presumptive bans and prohibitions. 19 Source: Statement of Chair Lina M. Khan, In the Matter of Mobilewalla, Inc., Commission File No. 2023196 (Dec. 3, 2024)

The most direct consequence is an injunction that restricts how location data may be collected, used, and sold. In the Gravy Analytics and Venntel matter, the proposed order prohibited the respondents from disclosing sensitive location data in any of their products or services. 47 Source: Statement of Commissioner Alvaro M. Bedoya, In the Matter of Gravy Analytics, Inc., FTC Docket No. 2123035 It also required a “Sensitive Data Location” program and a way for consumers to request deletion of their geolocation data. 48 Source: Concurring Statement of Commissioner Melissa Holyoak, In the Matter of Gravy Analytics, Inc. In General Motors, the final order also required deletion of covered driver data previously collected without affirmative express consent. 49 Source: Letter to Anonymous Commenter, In the Matter of General Motors LLC et al., No. 2423052 (Jan. 13, 2026) The Commission said it would monitor General Motors’ compliance for 20 years. 50 Source: Letter to Anonymous Commenter, In the Matter of General Motors LLC et al., No. 2423052 (Jan. 13, 2026)

Money exposure depends on the legal footing. The Commission said in the Turn matter that it does not have authority to obtain civil penalties for an initial violation under Section 5 of the FTC Act. 51 Source: Letter to A. Noe, In the Matter of Turn Inc., File No. 152 3099 Once an order is final, a company risks civil penalties of up to $40,654 per violation per day. 52 Source: Letter to A. Noe, In the Matter of Turn Inc., File No. 152 3099 In General Motors, the Commission told a commenter who wanted monetary relief for consumers that the Supreme Court’s decision in AMG Capital Management v. FTC precludes the possibility of obtaining monetary relief in that case. 53 Source: Letter to Andrew Gonzalez, In the Matter of General Motors LLC et al., No. 2423052 (Jan. 13, 2026) Where a specific rule applies, the footing changes. A violation of a regulation under the COPPA statute is treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act. 54 Source: 16 C.F.R. §§ 312.2, 312.5(a)(1), 312.9 A violation of the statute barring data brokers from transferring sensitive data to foreign adversaries is treated the same way. 55 Source: 15 U.S.C. § 9901(a), (b)(1), (c)(6)–(7) In a complaint under a different rule, the FTC alleged that the court may award monetary civil penalties of not more than $46,517 for each knowing violation of that rule. 56 Source: Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, Easy Healthcare Corporation, Case No. 1:23-cv-03107, Defendant Violated the Health Breach Notification Rule

The injuries the Commission pointed to explain why the remedies are broad. In the Gravy Analytics complaint, the Commission alleged that unauthorized collection, use, and sale of precise geolocation data is an unwarranted intrusion into consumers’ privacy and causes substantial injury. 57 Source: In the Matter of Gravy Analytics, Inc. and Venntel, Inc., File No. 2123035 (complaint ¶ 59) It also alleged that the practices cause or are likely to cause other injuries, including stigma, discrimination, physical violence, and emotional distress. 58 Source: In the Matter of Gravy Analytics, Inc. and Venntel, Inc., File No. 2123035 (complaint ¶ 60) The General Motors complaint alleged a loss of privacy about day-to-day movements, an increased risk of harmful disclosure of sensitive information, and financial losses. 59 Source: In the Matter of General Motors LLC, Final Complaint, Count I ¶ 54 It described consumers who learned of the reporting only after adverse action notices said their car insurance was denied or cancelled or their premiums increased. 60 Source: In the Matter of General Motors LLC, Final Complaint ¶ 46