Geolocation data privacy laws in the United States are a patchwork rather than a single rulebook. No federal statute comprehensively regulates how companies collect or sell the record of where you go. Instead, the Federal Trade Commission and Federal Communications Commission police misuse under older consumer-protection and telecommunications laws, the Supreme Court has ruled that police generally need a warrant to track you through your phone, and nineteen states now treat precise location as sensitive data that requires your affirmative consent before a company can collect it.
Who Polices Location Data at the Federal Level
Two federal agencies do most of the enforcement work.
The FTC is the primary cop on this beat. Section 5 of the FTC Act makes unfair or deceptive business practices unlawful and gives the commission authority to investigate and stop them.1Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful; Prevention by Commission A company that collects your location without telling you, or that promises privacy and then sells your data anyway, can face enforcement orders, mandatory deletion, and civil penalties in the millions.
In 2024 the FTC finalized an order against data broker InMarket Media that permanently banned the company from selling or sharing precise location data and required it to delete all previously collected location records and any products derived from them unless it obtained fresh consumer consent.2Federal Trade Commission. FTC Finalizes Order with InMarket Prohibiting It from Selling or Sharing Precise Location Data The takeaway is that the commission now treats precise location as inherently sensitive and expects meaningful consent before collection.
The FCC handles wireless carriers. Under Section 222 of the Communications Act, carriers must protect the confidentiality of customer network information, which includes the location data your phone generates every time it pings a cell tower.3Federal Communications Commission. Privacy/Data Security/Cybersecurity: Customer Proprietary Network Information The commission fined the four major carriers a combined $196 million for selling real-time customer location data to third-party aggregators without consent. Those aggregators were reselling your coordinates to bounty hunters, car dealerships, and others with no legitimate need for them.4Federal Communications Commission. FCC Fines Largest Wireless Carriers for Sharing Location Data
Federal Statutes That Touch Location Data
A few federal statutes reach location data, but none of them was designed for it, and the coverage is uneven.
The Electronic Communications Privacy Act is the one most often cited, and its protections are narrower than most people assume. The Wiretap Act makes it a federal crime to intentionally intercept electronic communications without authorization, punishable by up to five years in prison.5Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited But ECPA’s definitions section explicitly excludes signals from tracking devices from its definition of “electronic communication.”6Office of the Law Revision Counsel. 18 USC 2510 – Definitions GPS pings and similar location signals don’t automatically get the same protection as your emails or phone calls.
The Stored Communications Act fills part of the gap by criminalizing unauthorized access to communications stored on electronic services, with penalties up to five years for offenses committed for commercial gain.7Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications That matters because carriers and apps store your historical location records on their servers.
Two other statutes apply in narrower zones. COPPA requires website and app operators to obtain verifiable parental consent before collecting personal information, including precise geolocation, from children under thirteen.8Office of the Law Revision Counsel. 15 USC Chapter 91 – Children’s Online Privacy Protection HIPAA restricts how healthcare providers and their business associates handle protected health information, and any geographic data more specific than a state counts as an identifier. Willful neglect that goes uncorrected carries penalties that can reach $2,190,294 per violation category per year.9Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
When Police Need a Warrant to Track You
The Fourth Amendment reaches location tracking, but the rules were built case by case.
In United States v. Jones (2012), the Supreme Court held that the government conducts a Fourth Amendment search when it physically attaches a GPS tracker to your vehicle and monitors its movements. Justice Scalia’s majority opinion treated a vehicle as an “effect” protected by the Fourth Amendment, and the government’s physical occupation of it to collect data required a warrant.10Justia. United States v. Jones, 565 U.S. 400
Six years later, Carpenter v. United States extended that protection to digital tracking with no physical intrusion at all. The government had obtained 127 days of Timothy Carpenter’s historical cell-site location information from his carrier without a warrant. The Supreme Court ruled that you keep a reasonable expectation of privacy in the record of your physical movements captured through cell-site data, because that record provides “an intimate window into a person’s life” including personal, political, and religious associations.11Legal Information Institute. Carpenter v. United States
The practical rule: law enforcement generally needs a warrant supported by probable cause to obtain your historical cell-site location records from a carrier. The Court specifically held that seven days of records constitutes a search but declined to say whether shorter periods might not. Lower courts are still working out that boundary. What is clear is that bulk collection of your long-term location history without judicial approval violates the Fourth Amendment.
State Privacy Laws and What Consent Looks Like
Nineteen states have comprehensive consumer privacy laws in effect, and nearly all of them classify precise geolocation as sensitive personal data that requires your opt-in consent before collection. Most define “precise geolocation” as data that can pinpoint you within roughly 1,750 feet.
California’s Consumer Privacy Act, as amended by the CPRA, treats precise geolocation as sensitive personal information. You can direct any business to limit its use of your location data to what’s necessary to provide the service you requested, and companies must post a clear, conspicuous link on their websites and apps for you to exercise that right.12California Legislative Information. California Civil Code 1798.100 Intentional violations carry penalties of up to $7,500 per incident; unintentional violations can cost $2,500 each. Enforcement is shared between the state Attorney General and the California Privacy Protection Agency.
Virginia’s Consumer Data Protection Act follows a similar template. It defines precise geolocation as sensitive data, prohibits processing without consent, and gives you rights to access and delete your data.13Virginia Code Commission. Virginia Code Title 59.1 Chapter 53 – Consumer Data Protection Act The state attorney general enforces the law and can seek civil penalties of up to $7,500 per violation.
Colorado amended its Privacy Act in 2025 to explicitly add precise geolocation as sensitive data. Controllers must obtain affirmative consent before collecting it and are banned from selling it without that consent. Violations are enforced through the Colorado Consumer Protection Act, which authorizes penalties of up to $20,000 per violation, or up to $50,000 per violation when the conduct targets elderly consumers.14Colorado General Assembly. HB19-1289 Consumer Protection Act
One point to understand about all of these laws: in almost every state, only the attorney general can bring enforcement actions. You cannot sue a company directly for violating your geolocation privacy rights. California is a partial exception for data breaches specifically, and Washington’s health data law goes further. Everywhere else, your recourse is filing a complaint with the attorney general’s office.
Special Rules Around Healthcare Facilities
Washington’s My Health My Data Act targets a specific, particularly invasive practice: geofencing around healthcare facilities. The law makes it illegal to set up a virtual perimeter around any facility that provides in-person healthcare in order to track patients, collect their health data, or send them targeted messages.15Washington State Legislature. Washington Code 19.373 – My Health My Data Act The concern is straightforward: a company could use geofencing to identify people visiting reproductive health clinics, addiction treatment centers, or mental health facilities and then sell that information or use it for targeted advertising.
Washington treats any violation of the geofencing ban as an automatic unfair or deceptive practice under the state Consumer Protection Act, which means you can bring a private lawsuit without waiting for the attorney general to act.15Washington State Legislature. Washington Code 19.373 – My Health My Data Act
Data Brokers and Deletion Rights
Data brokers buy, aggregate, and resell location data collected from apps on your phone, usually without your knowledge that they exist. California has gone furthest in regulating them.
Under California’s Delete Act, data brokers must register with the California Privacy Protection Agency by January 31 each year and disclose whether they collect precise geolocation. Brokers that fail to register face administrative fines of $200 per day on top of registration fees.16California Privacy Protection Agency. CalPrivacy Issues Enforcement Advisory Highlighting Data Broker Registration
The bigger feature is a centralized deletion mechanism called the Delete Request and Opt-Out Platform, or DROP. As of January 1, 2026, California residents can submit a single request through DROP that directs every registered data broker to delete their personal information. Starting August 1, 2026, brokers must process those requests within 90 days and continue deleting any newly acquired data at least every 45 days going forward. Brokers that fail to comply face civil penalties of $200 per request for each day of noncompliance.17California Privacy Protection Agency. Delete Request and Opt-Out Platform (DROP) Texas and Vermont also require data broker registration, though neither matches California’s centralized deletion system.
GPS Tracking by Employers
Employers increasingly use GPS tracking on company vehicles for route optimization, safety, and time verification. No federal law directly governs the practice. Tracking a company-owned vehicle is legal in every state. Tracking an employee’s personal vehicle without explicit written consent creates serious liability under both federal wiretapping laws and state statutes.
Several states have specific notice or consent requirements for employer GPS monitoring:
- New York requires written notice at the time of hire that GPS or electronic monitoring is in use, with written acknowledgment from the employee.
- Connecticut requires written notice describing the types of monitoring before any electronic tracking begins.
- Delaware requires electronic notice at least one day before monitoring starts.
- California makes it a misdemeanor to use an electronic tracking device to determine someone’s location without consent. Company-owned vehicles are generally exempt, but CCPA data privacy requirements still apply to the location data collected.
- Texas, Minnesota, Virginia, and Illinois each prohibit installing a tracking device without consent, with exceptions for employer-owned vehicles.
A common gap is after-hours tracking. If you drive a company vehicle home, the GPS system typically keeps recording. California and Connecticut require that off-hours monitoring be tied to a legitimate business purpose, but most states don’t draw that line. If it concerns you, ask for a written policy that spells out when tracking is active, how long data is retained, and who can access it. A 90-day retention period is standard industry practice, but nothing in federal law requires companies to delete the data after any particular period.
What Happens If You Do Nothing
The default setting for most apps and services is to collect your location data unless you actively opt out. Under the laws of the nineteen states with comprehensive privacy statutes, companies processing precise geolocation must get your consent first. But enforcement depends on complaints reaching an attorney general’s office with limited resources, and many apps bury location permissions in setup flows designed to get you clicking “Allow” without reading.
If you take no action, your location history accumulates with data brokers, advertising networks, and app developers. That data can be sold, subpoenaed in litigation, or exposed in a breach. California’s DROP platform is the first attempt at giving consumers a single switch to shut off the pipeline, and it only applies to registered brokers operating in California. Outside that system, managing your location privacy means auditing app permissions on your phone, revoking access from apps that don’t need your location, and filing opt-out requests with individual data brokers one at a time.