Progress and Pitfalls in State-Level Location Data Privacy Legislation
EFF Deeplinks
- State-level regulation of location tracking is gaining momentum, but current laws contain significant loopholes that require further legislative attention.
- Recent laws in Connecticut, Maryland, New Jersey, Oregon, and Virginia mark progress by banning the sale of precise geolocation data.
- None of these states currently provide consumers with a meaningful private right of action to enforce their rights directly.
The Dangers of Location Surveillance
- Unregulated data brokers harvest and monetize physical location history, posing direct threats to individuals visiting healthcare clinics, political protests, or sensitive locations.
- Advertising SDKs often track users without adequate disclosure, feeding sensitive movement data into ecosystems used by data brokers.
- Law enforcement utilizes geofence warrants to turn innocent bystanders into suspects, necessitating stronger constitutional and legislative safeguards.
Assessment of Recent State Legislation
- Common strengths: All five states have banned the sale of precise location data and adopted broad definitions that protect all locations, rather than just specific 'sensitive' zones.
- Data minimization: Maryland sets a high bar by requiring data processing to be 'strictly necessary' for a specific consumer-requested service.
- Consent requirements: Connecticut, New Jersey, and Virginia mandate consumer consent for processing location data, though these are often weakened by exceptions.
Necessary Legislative Reforms
- Private Right of Action: Laws must enable individuals to sue companies for violations, ensuring enforcement is not solely dependent on the shifting priorities of state Attorneys General.
- Prohibiting 'Pay-for-Privacy': Legislation must prevent companies from charging higher prices or downgrading services for consumers who exercise their privacy rights.
- Banning Dark Patterns: Consent requirements must be paired with strict prohibitions against manipulative UI/UX practices that subvert user choice.