Location Data Under Scrutiny and How California’s Latest Investigation Affects Your Business

Location Data Under Scrutiny and How California’s Latest Investigation Affects Your Business

On March 10, 2025, California Attorney General Rob Bonta launched a sweeping investigation into the location data industry, targeting businesses that may be violating the California Consumer Privacy Act (“CCPA”). The focus of the investigation is on mobile apps, advertising networks, and data brokers that gather and share consumers’ sensitive geolocation data without fully informing them or offering clear options to opt-out. This enforcement action comes at a critical time, as the widespread use of location data raises privacy concerns, especially with recent federal actions targeting vulnerable communities and sensitive issues like reproductive and gender-affirming healthcare.

The CCPA, California’s robust privacy law, gives residents the right to understand how their personal data is being collected, used, and shared. It includes a specific provision on geolocation data, which is categorized as sensitive personal information. This means businesses that collect location data from consumers, often through mobile apps, must comply with stringent rules about transparency, consumer rights, and data protection. Businesses that fall under the CCPA’s regulations need to make sure they are handling location data responsibly and in compliance with the law.

Attorney General Bonta’s announcement highlights a growing concern over how location data is being used. Many mobile apps track users’ movements and share that information with third-party advertisers and data brokers. This data can reveal sensitive details, such as visits to healthcare clinics or personal habits, potentially putting individuals at risk. The investigation is focused on ensuring that businesses respect consumers’ rights to limit or stop the sale and sharing of their location data. It’s clear that California is taking this issue seriously, especially given the potential misuse of location data for harmful purposes.

If your business collects location data or sensitive personal information, it’s critical to review your compliance with the CCPA. Consumers have the right to request that their personal data, including location information, be used only for the purposes necessary to provide the requested service. They can also exercise the right to opt-out, meaning they can ask businesses to stop selling or sharing their data, with a few exceptions. The CCPA also requires businesses to clearly notify consumers about their data collection practices and ensure they can easily opt-out through their mobile device settings or through links provided in your apps.

For businesses that use third-party software development kits (“SDKs”) or other tools to gather and share location data, this sweep underscores the importance of ensuring these tools comply with the law. Even if your business doesn’t consider itself part of the “location data industry,” if you collect or share geolocation data, you are subject to these rules. The Attorney General’s office is particularly focused on how mobile apps interact with these third-party tools, which often collect data in ways that may not be fully understood by the companies using them.

Compliance Recommendation.

If your business is involved in the collection, sharing, or selling of location data, now is the time to carefully review your practices. Make sure your consumers are fully informed about what data you’re collecting, why you’re collecting it, and how they can opt-out or limit the use of their data. Ensure your mobile apps and third-party tools, like SDKs, comply with CCPA regulations. If you’ve received a notice from the Attorney General’s office, it’s important to work with legal counsel immediately to address any concerns and mitigate potential risks. Being proactive about compliance can help you avoid costly fines and enhance consumer trust in your brand.

(Image Credit: iStock Photo)

This article is for information purposes only. It is not intended to be and should not be relied on as legal advice for any particular matter.