Location Data and AI Tracking

Phones and connected devices can record location through GPS, Wi-Fi, Bluetooth, and cellular systems. Apps may also store check-ins, search locations, or travel patterns. A repeated trace can reveal where a device spends nights, works, worships, seeks health care, or attends public events. The 2013 “Unique in the Crowd” study analyzed a specific dataset of 1.5 million mobile subscribers and found four spatiotemporal points uniquely identified 95% of traces at hourly and antenna-level resolution. That result shows risk in that dataset, not every modern source. Anonymizing names does not necessarily remove linkability if an outside party knows a few locations or times. Machine learning can combine traces with other data to infer routines or sensitive interests. Those inferences are probabilistic and can be inaccurate, but their use may still create privacy or safety risks. A broker may sell, share, or use location data for targeted ads, analytics, fraud detection, or risk scoring. Location can also be collected by the app developer directly, through advertising SDKs, or via a data broker. Legal protections vary by jurisdiction and source. California’s CCPA treats precise geolocation as sensitive personal information. The EU GDPR may apply when location identifies or relates to a person and imposes requirements for lawful processing. The FTC’s public case page still labels Kochava “Pending,” while linking a judge-signed Stipulated Order for Injunction dated June 25, 2026 and filed June 26. It imposes case-specific limits on the named defendants’ sale or disclosure of defined sensitive-location data, with a narrow direct-service and express-consent exception. The order is not a general statute governing all brokers. Users can review operating-system location permissions, disable precise location where supported, limit background access, and inspect app disclosures. These steps reduce some collection but do not guarantee anonymity or stop all network-level location use. Organizations should minimize precision and retention, restrict sharing, and evaluate re-identification and sensitive-location risks before using or selling traces.