U.S. Senate Introduces Bipartisan Bill to Ban Sale of Americans’ Location Data

By Ramyar Daneshgar
Security Engineer | USC Viterbi School of Engineering

Disclaimer: This article is for educational purposes only and does not constitute legal advice.

1. Introduction

The sale of precise location data has moved from a niche advertising tool to a central focus of the United States privacy debate. Congress has introduced the Location Privacy Act of 2026 (S.2144), a bill that would significantly restrict how companies collect, transfer, and monetize device-level geolocation information. Although federal privacy proposals have circulated for more than a decade, the commercial trade of location data has now reached a scale and sensitivity that lawmakers across political lines view as a pressing national concern.

The reasons are clear. Companies can purchase location datasets that reveal attendance at medical clinics, political rallies, religious centers, support groups, immigration facilities, military bases, and shelters for individuals fleeing domestic violence. Investigative reports revealed that data brokers sold information showing where people traveled during protests and which mobile devices regularly appeared near reproductive health providers. Regulators discovered that certain commercial datasets allowed identification of specific individuals within minutes through cross-referencing device identifiers, time stamps, and movement patterns.

Against this backdrop, S.2144 represents one of the most targeted federal efforts to limit the commercial circulation of location data. Although still in early stages, the bill marks a turning point in the national conversation. It reflects a broader shift in how regulators, civil rights groups, and courts understand the relationship between geolocation data, personal autonomy, and public safety.

2. The Historical Development of Location Data Regulation

2.1 Early mobile advertising markets

As smartphones became ubiquitous in the early 2010s, software development kits inside mobile applications began collecting GPS coordinates, WiFi triangulation data, and Bluetooth proximity signals. Initially, these datasets fueled location-based advertising, foot-traffic analytics, and geofencing. Companies used them to understand consumer movement patterns and to measure whether digital advertisements resulted in physical store visits.

During this period, federal regulation was nearly absent. The United States relied on sector-specific privacy laws that did not address the commercial sale of location data. The Federal Trade Commission acted through its general authority to police deceptive or unfair practices. These tools allowed the agency to target misconduct, but they did not create comprehensive rights or clear limits on location tracking.

2.2 Rise of the data broker ecosystem

By the mid-2010s, data brokers had become central distributors in the location economy. Many operated without consumer awareness. Brokers purchased location signals from mobile apps, combined them with third-party information, and resold them to advertisers, intelligence contractors, risk-scoring firms, political groups, and other commercial clients. This market grew because brokers could generate valuable insights without ever interacting directly with the consumers whose devices they tracked.

Investigations by academics, journalists, and regulators revealed that even when datasets were presented as anonymized, re-identification was straightforward. A small set of coordinates from a smartphone on two or three different days often exposed a home address and workplace, which uniquely identifies a person.

2.3 The shift toward federal attention

Throughout the 2010s and 2020s, Congress introduced numerous privacy bills, but none passed. The commercial location industry grew unchecked. Tensions escalated when reports showed commercial brokers selling raw location data to federal law enforcement agencies, permitting investigators to track devices without warrants. After the Supreme Court’s decision in Carpenter v. United States (2018), which held that long-term cell site tracking required a warrant, civil liberties groups argued that purchasing commercial datasets allowed government agencies to bypass constitutional protections.

By the mid-2020s, several state legislatures enacted laws specifically targeting the sale of precise geolocation data. This state-level activity increased pressure on Congress to act.

3. The Structure of the Location Data Market

3.1 Primary collectors

Mobile applications are the primary collectors of location information. They capture device coordinates through GPS, WiFi networks, Bluetooth beacons, and cellular triangulation. Application developers often embed third-party SDKs that automatically transmit this information to advertising networks, measurement providers, and brokers.

3.2 Secondary aggregators

Secondary aggregators, commonly referred to as data brokers, purchase these signals in bulk. They combine them with demographic databases, cookie identifiers, IP-based information, purchase histories, and other datasets. The result is a detailed profile of device mobility that can identify habits, routines, and sensitive behaviors.

3.3 Downstream purchasers

Downstream purchasers include advertising platforms, hedge funds analyzing retail foot traffic, insurance companies evaluating risk exposure, political advocacy groups, and intelligence-adjacent contractors. The demand for location data increases whenever an industry seeks real-world insights into human behavior.

3.4 Re-identification mechanics

Although brokers often claim that location data is pseudonymized, the structure of the datasets enables rapid re-identification. A single smartphone that appears each night at the same residence and each morning at the same workplace reveals the identity of its owner. Re-identification does not require names or email addresses. It requires only movement patterns and time series analysis.

This underlying dynamic explains why regulators classify precise location data as particularly sensitive.

4. Pre-existing Legal Frameworks Before S.2144

Federal privacy law in the United States is fragmented. Before S.2144, several statutes indirectly touched location data, but none directly regulated the sale of precise geolocation information.

4.1 Federal Trade Commission Act

The FTC Act prohibits unfair or deceptive trade practices. The FTC used this authority to enforce against companies that misrepresented privacy practices or exposed consumers to unreasonable risks. However, the Act does not contain explicit rights to control location data. Enforcement actions depended on case-specific theories rather than clear statutory rules.

4.2 Stored Communications Act and related laws

The Stored Communications Act and related electronic communication laws govern access to certain telecommunications data. These laws traditionally applied to telecommunications providers, not to modern data brokers. As a result, commercial location datasets largely escaped regulation under these frameworks.

4.3 State privacy statutes

Beginning in the early 2020s, states such as California, Oregon, Colorado, Connecticut, and Virginia began classifying precise geolocation as sensitive personal data. These statutes required opt-in consent and imposed limits on secondary uses. Although significant, these laws left gaps because data flows often crossed state borders.

The divergence between state and federal standards became unsustainable. Companies needed clarity on whether they could sell or analyze precise location signals without violating a patchwork of obligations.

5. Textual and Structural Analysis of the Location Privacy Act of 2026

5.1 Definition of precise geolocation data

The bill defines precise geolocation data as information that identifies or describes the location of a device with accuracy sufficient to determine an individual’s movements at a granular level. The definition focuses on information that has not been anonymized in a manner that prevents reasonable re-identification.

5.2 Definition of an at-risk individual

The bill contains a specific category for at-risk individuals. This includes persons who may be subject to harm if their location is exposed, including individuals seeking sensitive services, attending religious gatherings, participating in political activities, or seeking assistance at shelters. This category reflects heightened concern for populations whose safety is directly affected by the commercial sale of movement information.

5.3 Prohibition on sale, rental, or trade

The core of the bill prohibits the sale, rental, or trade of precise geolocation data without written, revocable consent. The structure emphasizes that consent must be affirmative, informed, and capable of being withdrawn. The prohibition extends to transfers to third parties and downstream recipients.

5.4 Retention and purpose limitations

The bill introduces retention limits tied to the purpose for which data was originally collected. Once the purpose has been satisfied, data must be deleted or anonymized. This shifts the industry from indefinite retention to mission-specific storage.

5.5 Enforcement authority

The bill grants enforcement authority to the FTC and state attorneys general. Violations may result in civil penalties, injunctive relief, and other remedies. The bill signals a federal intention to regulate the commercial market more directly than in previous attempts.

6. Enforcement Context Before the Bill

The enforcement environment explains why Congress views statutory intervention as necessary.

6.1 FTC settlements involving location data

The FTC brought several actions against data brokers that sold location datasets revealing visits to healthcare providers, places of worship, and other sensitive locations. Investigations found that consumers were often unaware that their mobile apps were transmitting such detailed information.

6.2 State investigations

State attorneys general opened investigations into data brokers for selling information derived from DMV records, telematics, and precise geolocation feeds. These investigations typically relied on state privacy laws or general consumer protection statutes.

6.3 Litigation involving geolocation tracking

Private litigants filed suits alleging that companies used session replay technologies or tracking scripts to intercept communications or reveal sensitive location behaviors. Courts differed on whether these claims constituted unlawful interception under wiretapping statutes.

These enforcement patterns demonstrate a growing consensus that location data lacks adequate statutory protection.

7. Public Safety and Civil Rights Considerations

The movement of a person through physical space often reveals intimate information. Location data has been used to infer relationships, beliefs, medical conditions, and political activities. The exposure of such data can place individuals at risk of harm.

7.1 Domestic violence and stalking concerns

Location information can reveal the whereabouts of individuals fleeing dangerous partners, individuals residing in shelters, or individuals moving between undisclosed safe locations. Several cases demonstrated that commercial datasets could be used to track those individuals.

7.2 Reproductive health and medical privacy

Following shifts in reproductive health law, advocates raised concerns that location data could identify visits to clinics. Brokers sold datasets showing mobile devices near sensitive health facilities.

7.3 Political and religious expression

Movement patterns can expose a person's attendance at political rallies, religious gatherings, protests, and community meetings. Legislators view this as a fundamental civil liberties issue.

7.4 Government access through commercial purchases

Reports revealed that law enforcement agencies purchased location datasets instead of seeking warrants. This practice raised constitutional questions and brought significant scrutiny to the industry.

8. Constitutional and Preemption Considerations

8.1 Federal and state interplay

If enacted, the bill would sit atop a complex landscape of state privacy laws. Congress must decide whether the federal regime preempts state statutes. Preemption would create national uniformity, while non-preemption would preserve strong state protections.

8.2 Commerce Clause considerations

The location data industry spans state borders. Congress is likely acting under its Commerce Clause authority, since geolocation datasets are sold across state lines.

8.3 First Amendment commercial speech questions

Companies may argue that restrictions on data sales implicate commercial speech. However, courts have recognized that laws governing the sale of personal data regulate conduct rather than expression.

8.4 Fourth Amendment and government access

The bill intersects with debates about government access to commercially purchased data. Although the bill focuses on private companies, its implications for law enforcement practices are substantial.

9. International Comparisons

The United States is behind other jurisdictions in regulating location data. Several global frameworks classify location information as sensitive.

9.1 European Union

The General Data Protection Regulation treats precise location as personal data subject to heightened protections. EU regulators have penalized companies for tracking individuals without lawful bases.

9.2 Canada

Canadian privacy law requires meaningful consent for the collection of geolocation data. Regulators emphasize transparency and accountability for third-party transfers.

9.3 Australia and Brazil

Both jurisdictions recognize the sensitivity of location data and require clear user authorization for its collection and use.

The global regulatory movement places additional pressure on the United States to modernize federal privacy law.

10. Implications for Industry and Technology

The bill has structural implications for the technology sector.

10.1 Mobile advertising

Precise location data is central to parts of the advertising ecosystem. Restricting its sale will disrupt certain attribution models and foot-traffic measurement techniques.

10.2 Analytics platforms

Location analytics used by retailers, real estate firms, insurers, and financial analysts rely on multi-source datasets. These markets may shrink or shift to aggregated insights.

10.3 Data broker markets

The bill directly targets the business model of brokers that monetize raw location feeds. If enforced broadly, it could reshape the industry.

10.4 Technical limits on anonymization

The bill’s emphasis on non-anonymized data reflects the growing recognition that traditional anonymization techniques are insufficient. Location data has a high risk of re-identification even after basic transformation.

11. Conclusion

The Location Privacy Act of 2026 marks a significant development in United States privacy law. Although the bill remains early in its legislative lifecycle, it signals a shift toward comprehensive federal restrictions on the commercial trade of precise geolocation data. The history of unregulated data flows, the documented civil rights implications, the economic structure of the data broker ecosystem, and the increasing convergence with global privacy norms all point toward heightened federal oversight.

If enacted, the bill would narrow the permissible uses of precise location data, reinforce the principle of user autonomy over movement information, and align federal practice with modern privacy expectations. Regardless of its legislative outcome, the proposal reflects a national recognition that location data is among the most sensitive categories of information collected in the contemporary digital environment.