California Location Data Privacy Law: What the New Rules Mean

Location data is one of the most sensitive types of personal information companies collect—and it’s often gathered without users fully realizing it. From mobile apps to ad networks, detailed location tracking has become a standard part of how digital businesses operate.

In response to growing concerns about how that data is used, California is stepping up its privacy enforcement. In early 2025, the California Attorney General launched a wide-ranging investigative sweep targeting mobile apps that collect and share location data without proper user consent. At the same time, a new state law proposal aims to tighten rules around how businesses handle location data, signaling a more aggressive approach to data privacy at the state level.

This blog breaks down what’s happening, why it matters, and what the proposed California location data privacy law could mean for consumers, developers, and the broader tech industry.

Overview of California Location Data Privacy Law

The California Location Data Privacy Law is a comprehensive data privacy law that sets stringent regulations on the collection, use, and retention of location information from individuals in California. Under this law, “location information” is defined as any data that identifies a person’s location within a five-mile radius. To collect, use, or share this information, businesses must obtain explicit opt-in consent from consumers. Additionally, the law introduces a necessity standard, requiring businesses to prove that the collection of location data is strictly necessary for a legitimate business purpose. This ensures that location data is only gathered when absolutely essential, providing stronger privacy protections for consumers.

What’s Happening: A Two-Part Move by California Consumer Privacy Act

In early 2025, California took two major steps to tighten control over how companies handle location data: an enforcement sweep and a legislative proposal.

1. Attorney General's Investigative Sweep

The California Attorney General launched an enforcement sweep targeting mobile apps within the location data industry that collect and share location data without meeting the requirements of the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Apps are being scrutinized for:

• Failing to clearly disclose how they collect and use location data
• Not providing users with opt-out options
• Lacking accessible, compliant privacy policies

2. Proposed State Legislation

At the same time, state lawmakers introduced a bill aimed at regulating how companies collect, use, and sell location data. The proposal would:

• Require explicit, opt-in consent before collecting precise geolocation data
• Limit how long and how often businesses can collect that data
• Increase transparency around how data is used and shared

The goal is to close existing legal gaps that allow continuous tracking without user knowledge or control. If passed, the law would set a new standard for location data privacy in the U.S.

Why Location Data Is a Privacy Concern

Location data may seem harmless, but it can reveal sensitive personal information—often without users realizing it. When apps collect precise geolocation data over time, they can map detailed patterns of daily life, including:

• Home and work addresses
• Daily routines and travel habits
• Healthcare visits
• Places of worship or political activity

This kind of data can be used to infer everything from someone’s job schedule to their medical history or religious beliefs. Because of how easily it can be linked back to individuals, location data is increasingly viewed as sensitive information—and it's why California is pushing for stricter rules to protect it.

Who Is Affected by These Changes

California Consumers

The proposed updates are designed to strengthen consumer rights for California residents, particularly when it comes to how businesses collect personal information like sensitive location data. Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), consumers already have the right to access, delete, and restrict the use of their consumer data.

The new law expands on those protections, giving individuals more transparency into business’s privacy practices and the ability to reject the collection or sale of location-based data with affirmative consent.

App Developers and Online Platforms

Any company that knowingly collects location data—especially from mobile apps or online platforms—will need to ensure compliance with California’s state data privacy laws. This includes updating how they notify users, respond to consumer requests, and manage opt out requests.

Companies that fail to do so risk enforcement actions by the California Privacy Protection Agency, potential civil penalties, and damage to their brand reputation. Businesses that exceed the revenue threshold set by the law will be especially impacted.

Marketers, Ad Tech Firms, and Data Brokers

Companies that use or share data from advertising networks, data brokers, or other businesses will need to reconsider how they handle sensitive data—particularly when it's tied to sensitive locations like healthcare facilities, religious centers, or political events. These entities must obtain parental consent or affirmative consent before processing or selling data tied to precise geolocation.

Financial Institutions and Credit Agencies

While not the primary focus, financial institutions, credit reporting agencies, and debt collectors could also be affected if their data collection intersects with location tracking. If credit information or inaccurate personal information is used in conjunction with location data, they may face additional scrutiny under laws like the Fair Credit Reporting Act, CPRA, and even the California Constitution.

Key Requirements Under the Proposed Law

California’s proposed location privacy legislation strengthens protections under the California Consumer Privacy Act and the California Privacy Rights Act. It aligns with efforts in other states, like the Connecticut Data Privacy Act, Texas Data Privacy, and the Nebraska Data Privacy Act, and pushes toward a more comprehensive data privacy law framework.

1. Affirmative Consent is Mandatory

Businesses must obtain affirmative consent before collecting or processing sensitive location data. Consent must be informed, specific, and separate from generic terms of service.

2. Limits on Data Use and Tracking

Granular or continuous tracking will be restricted unless directly tied to the service requested. Unnecessary tracking may be considered a heightened risk under the law.

3. Transparency and Privacy Disclosures

Companies must clearly disclose the information collected, how it's used in data processing, and how users can exercise their data rights. This includes how to file opt-out requests, submit a written statement, or correct inaccurate personal information.

4. Broader Enforcement and Scope

The California Privacy Protection Agency and other state agencies will oversee enforcement. Even companies without a direct relationship with consumers may be held accountable if they exceed the annual revenue threshold or share data with third parties.

5. Penalties and Legal Risk

Noncompliance could lead to statutory damages, injunctive relief, or penalties for willful violations. This is especially true in cases involving biometric information, computerized data, or a data breach due to inadequate reasonable security procedures.

Data Breach Notification Requirements

In the unfortunate event of a data breach, businesses are mandated to notify affected California consumers within 30 days. The notification must detail the type of personal information compromised, the date of the breach, and the measures being taken to protect the affected consumers. Furthermore, businesses must inform the California Attorney General’s office about the breach. Non-compliance with these data breach notification requirements can lead to significant fines and penalties, emphasizing the importance of timely and transparent communication in safeguarding consumer trust.

Automated Decision-Making Technology

The California Location Data Privacy Law also addresses the use of automated decision-making technology (ADMT) in making significant decisions that impact consumers. This includes decisions related to financial services, employment, educational opportunities, and healthcare services. Businesses must notify consumers if ADMT is used and provide an option to opt out. Additionally, the law requires regular audits of ADMT systems to ensure they are fair and unbiased, preventing any potential discrimination or unfair treatment based on automated processes.

Consumer Rights Under the Law

California consumers are granted several rights under the California Location Data Privacy Law. These include the right to know what personal information is being collected about them, the right to access their personal information, and the right to delete their personal information. Consumers also have the right to opt out of the sale of their personal information and to limit the use of their sensitive personal information. Furthermore, they can request that businesses stop using automated decision-making technology to make decisions about them. These rights empower consumers to have greater control over their personal data and how it is used.

How This Fits into Broader U.S. Data Privacy Trends

California’s proposed location data law reflects a broader national shift toward stronger state-level privacy protections. With no federal comprehensive data privacy law in place, states like Connecticut, Texas, and Nebraska have enacted laws requiring consumer consent, transparency, and tighter controls on sensitive data.

The Federal Trade Commission and other government agencies are also stepping up enforcement using existing laws like the Fair Credit Reporting Act. Meanwhile, the California Privacy Protection Agency is setting the tone with aggressive enforcement—even for companies without a direct relationship with users.

In short, businesses must now navigate a growing patchwork of privacy laws, stay compliant with evolving rules, and prioritize how they collect, process, and protect consumers’ personal information.

What This Means Going Forward

California’s proposed location data law reflects a broader shift toward stricter, state-led privacy regulation. With new rules requiring affirmative consent, limits on data use, and stronger enforcement from the California Privacy Protection Agency, businesses will need to adjust how they collect and handle sensitive location data.

As more states adopt similar policies and government agencies like the Federal Trade Commission continue to act under existing laws, both companies and consumers should stay informed. The way consumer data—especially location data—is managed is no longer optional. It’s a compliance issue with real consequences.