Study guide
11.4 Privacy Risks and Impacts of Location Tracking
Certified Information Privacy Technologist CIPT
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIPT Exam Overview and Study Plan
1.1 CIPT Exam Facts, Blueprint, and Study Plan
2 Chapter 2: The Privacy Technologist's Legal and Procedural Role
2.1 Privacy Function Roles: DPO, Data Owner, Steward, Custodian, Legal, and Security 2.2 Translating Legal and Regulatory Requirements into Technical Controls 2.3 Notices, Policies, and Oversight of Privacy Operations, Audits, and Third Parties
3 Chapter 3: Technical Responsibilities: Risk Concepts and Incident Response
3.1 Risk Concepts: Threat, Vulnerability, Attack, Exploit, and Privacy Risk 3.2 Technical Support for Privacy Incident and Breach Response
4 Chapter 4: Privacy Risk Models, Frameworks, and Threat Models
4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR 4.2 Privacy Threat Models: LINDDUN and MITRE PANOPTIC
5 Chapter 5: Data Ethics and Automated Decision-Making
5.1 Legal Versus Ethical Processing and the Social Impact of Privacy-Affecting Designs 5.2 Identifying and Minimizing Bias in Automated Decision-Making
6 Chapter 6: Minimizing Privacy Risk During Data Collection
6.1 Notice, Consent Management, and Choice Architecture 6.2 Managing Privacy Risk in Automatic Collection and Telemetry 6.3 Extracting Personal Data from Publicly Available Sources 6.4 Data Retention, Destruction, and Cryptographic Erasure 6.5 Data Minimization Techniques 6.6 Implementing Data Processing Segregation
7 Chapter 7: Minimizing Privacy Risk During Data Use: Aggregation, PETs, and Secondary Use
7.1 Minimizing Privacy Risk from Aggregation and Inference 7.2 De-identification, Pseudonymization, and Tokenization 7.3 Microdata Protection: k-Anonymity, l-Diversity, and t-Closeness 7.4 Advanced PETs: Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption 7.5 Secondary Use, Function Creep, and Purpose Limitation Controls
8 Chapter 8: Minimizing Privacy Risk During Dissemination
8.1 Disclosure and Accessibility Controls: APIs, Egress, and Clean Rooms 8.2 Countering Distortion, Exposure, Breach of Confidentiality, Blackmail, and Appropriation 8.3 Defense in Depth: Identity, Access Management, and Authentication
9 Chapter 9: Intrusion, Decisional Interference, and Dark Patterns
9.1 Minimizing Intrusion and Decisional Interference: Behavioral Advertising, Profiling, Cyberbullying, and Social Engineering 9.2 Dark Patterns and Deceptive Design
10 Chapter 10: Privacy Risks Related to Software Security
10.1 Detecting and Fixing Software Privacy Vulnerabilities 10.2 Intrusion Detection and Prevention, and Privacy in Change Management 10.3 Service Providers, Third-Party SDKs, and Supply Chain Risk
11 Chapter 11: Tracking and Surveillance Technologies
11.1 Privacy Risks and Impacts of E-Commerce 11.2 Audio and Video Surveillance, Wearables, and IoT 11.3 Privacy Issues Around Biometrics: Facial, Voice, Fingerprint, and DNA Data 11.4 Privacy Risks and Impacts of Location Tracking 11.5 Internet Monitoring and Web Tracking: Cookies, Fingerprinting, and GPC
12 Chapter 12: Workplace Technologies: AI, Communications, and Monitoring
12.1 Identifying and Minimizing Privacy Risks in AI, Machine Learning, and Deep Learning 12.2 Privacy Risks of Communications Technologies: Video Calls, Messaging, Mobile Devices, Social Media, and Gaming 12.3 Workplace Monitoring and BYOD Privacy
13 Chapter 13: Monitoring and Managing Privacy Risk
13.1 Privacy Audits, IT Control Reviews, KRIs, and KPIs 13.2 Completing Privacy and Data Protection Impact Assessments
14 Chapter 14: Implementing Privacy by Design
14.1 Cavoukian's Seven Foundational Principles of Privacy by Design 14.2 Privacy Goals, Objectives, and Translating High-Level Specifications into Low-Level Specifications 14.3 Hoepman's Privacy Design Strategies: Data-Oriented Strategies 14.4 Hoepman's Privacy Design Strategies: Process-Oriented Strategies
15 Chapter 15: Evaluating Privacy Risks in User Experiences
15.1 Privacy in User Experience: UX Concepts and Usability Testing 15.2 Value Sensitive Design
16 Chapter 16: Privacy Engineering Objectives, Architecture, and the Development Life Cycle
16.1 NIST Privacy Engineering Objectives: Predictability, Manageability, and Disassociability 16.2 Enterprise Architecture, Data Flow Mapping, Lineage, and Cross-Border Transfers 16.3 Managing Privacy Risk in the Software Development Life Cycle 16.4 Applying LINDDUN Threat Modeling in Engineering
17 Chapter 17: Managing and Monitoring Privacy Controls
17.1 Data Inventories, Records of Processing Activities, and Asset Discovery 17.2 Privacy Code Review and Runtime Behavior Monitoring
11.4 Privacy Risks and Impacts of Location Tracking
Key Takeaways Explain This Topic AI
Location can be derived from GPS, cell-tower timing, Wi-Fi probe requests, Bluetooth beacons, and IP addresses; MAC address randomization limits passive Wi-Fi tracking.
Four spatio-temporal points were enough to identify about 95 percent of people in a large mobile location dataset, so pseudonymous location traces are rarely anonymous.
In Chatrie v. United States (June 29, 2026), the Supreme Court held that obtaining two hours of a person's Google Location History is a Fourth Amendment search requiring a warrant.
The FTC's 2024 orders against X-Mode/Outlogic, InMarket, Gravy Analytics, and Mobilewalla restricted the sale of sensitive location data such as visits to clinics and places of worship.
Obfuscation options include coordinate truncation, geohash grids, trajectory k-anonymity, geo-indistinguishability using planar Laplace noise, and dummy queries.
Last updated: October 2026
11.4 Privacy Risks and Impacts of Location Tracking
Quick Summary: A record of where someone goes reveals where they live, work, worship, seek medical care, and protest. Location data is gathered from GPS, cell networks, Wi-Fi, Bluetooth beacons, and IP addresses, and it is sold through a large broker market. The BoK asks technologists to understand these risks; the engineering response is to collect location only at the precision and frequency a feature needs, keep it briefly, never sell or share sensitive visits, and apply obfuscation techniques when location must be analyzed.
Location is one of the few data types that is both highly identifying (a few points single out most people) and highly sensitive (it reveals health, religion, and associations). Many privacy laws now classify precise geolocation as sensitive data; under the CCPA, "precise geolocation" means data that locates a consumer within a circle with a radius of 1,850 feet.
Location Surveillance Mechanisms
Location data provides a granular map of an individual's life. Revealing an individual's physical coordinates over time exposes intimate details: home address, workplace, medical clinics visited, religious institutions attended, and political rallies participated in.
1. Physical Location Tracking Vectors
GPS / GNSS Trilateration: Satellites broadcast high-precision timestamps. A device measures the Time of Arrival (TOA) from at least 4 satellites to resolve latitude, longitude, elevation, and clock drift. Accuracy: 3 to 10 meters outdoors. GPS is passive (the device receives satellite radio signals without transmitting back to space), but client apps report coordinates back to servers.
Cell Tower Triangulation and Timing Advance: Mobile base transceiver stations (BTS) log device connections. Cellular carriers record Cell Global Identity (CGI) and Timing Advance (TA) —the round-trip signal propagation delay between the handset and tower. By combining signal strengths from multiple adjacent cell towers (Angle of Arrival [AoA] and Observed Time Difference of Arrival [OTDOA]), carriers calculate device coordinates within 50 to 300 meters without client GPS cooperation. Data is logged in carrier Call Detail Records (CDRs).
Wi-Fi MAC Address Probe Request Sniffing: When Wi-Fi is active, devices periodically transmit IEEE 802.11 probe request frames to discover known networks (SSIDs). Probe frames include the device's hardware 48-bit MAC address. Retail analytics companies install physical Wi-Fi sniffers throughout stores and cities to log probe requests, tracking consumer footpaths and store dwell times.
Operating System Defenses: Modern operating systems (iOS, Android, Windows) implement MAC Address Randomization . The OS generates a randomized, rotating pseudo-MAC address with the "locally administered" bit set ( b1 = 1 ) whenever scanning for networks, preventing static physical beacon tracking.
Bluetooth Low Energy (BLE) Beacons: Small transmitters broadcasting identifiers (UUID, Major, Minor) via iBeacon or Eddystone protocols. When a smartphone running a partner app passes within range, the app detects proximity (ranging from <0.5m to 10m) based on Received Signal Strength Indication (RSSI), logging exact indoor positioning.
2. Geofence Warrants and Reverse Searches
A geofence warrant (or reverse location warrant) inverts traditional law enforcement investigative procedures: Traditional Search Warrant Geofence (Reverse Location) Warrant
- +---------------------------------------+ +---------------------------------------+
- | 1. Establish probable cause on a | | 1. Define physical geographic boundary|
- | KNOWN SUSPECT | | and time window (e.g., crime scene)|
- | 2. Request data relating to that | | 2. Compel database provider (e.g., |
- | named individual. | | Google Sensorvault) to search all |
- | | | devices present in that geofence. |
- | | | 3. Sift through thousands of innocent |
- | | | bystanders to identify suspects. |
- +---------------------------------------+ +---------------------------------------+
Geofence warrants divided the federal appeals courts until the U.S. Supreme Court decided Chatrie v. United States on June 29, 2026. In a 6–3 opinion by Justice Kagan, the Court held that obtaining even two hours of a person's Google Location History is a Fourth Amendment search , extending Carpenter v. United States (2018): location history is not truly "shared" with a provider just because a phone generates it. The Court did not decide whether the three-step geofence warrant used in the case satisfied probable cause and particularity, and remanded that question. Engineering choices also shape what can be compelled: after Google moved Google Maps Timeline data to on-device storage (announced December 2023), it no longer holds a central Location History database that a geofence warrant could search.
Location Obfuscation Engineering
Privacy technologists implement mathematical techniques to protect location privacy while preserving application functionality.
1. Spatial Cloaking and Precision Truncation
Spatial cloaking reduces coordinate granularity before data leaves the device:
Coordinate Truncation: Truncating latitude and longitude decimal places:
6 decimal places ≈ 0.11 meters \approx 0.11\text{ meters} ≈ 0.11 meters (identifies an individual chair).
4 decimal places ≈ 11 meters \approx 11\text{ meters} ≈ 11 meters (identifies a house or store).
2 decimal places ≈ 1.1 kilometers \approx 1.1\text{ kilometers} ≈ 1.1 kilometers (identifies a neighborhood or city district).
Geohashing and Grid Aggregation: Mapping coordinates into coarse geographic bounding boxes (e.g., Geohash precision 5, covering ≈ 4.9 km × 4.9 km \approx 4.9\text{ km} \times 4.9\text{ km} ≈ 4.9 km × 4.9 km ). Applications such as weather forecasts require only coarse city-level resolution and should never capture high-precision decimal coordinates.
2. Trajectory k-Anonymity
An individual's sequence of spatio-temporal coordinates (a trajectory) forms a unique fingerprint. Studies show that just 4 spatio-temporal points are sufficient to uniquely identify 95% of individuals in a mobile location dataset.
Trajectory k k k -Anonymity ensures that for every reported path, there exist at least k − 1 k-1 k − 1 other individuals whose spatio-temporal trajectories are indistinguishable within the same spatial-temporal corridor. Systems achieve this by suppressing rare trajectory points, swapping trajectory segments, or clustering overlapping routes.
3. Geo-Indistinguishability and Planar Differential Privacy
To provide formal mathematical privacy guarantees, researchers developed Geo-Indistinguishability —the adaptation of ϵ \epsilon ϵ -differential privacy to geographic coordinates. Geo-indistinguishability ensures that an adversary observing an obfuscated location cannot determine the user's actual location within a privacy radius r r r with high confidence.
Systems implement geo-indistinguishability by adding planar Laplace noise to coordinates in polar form:
P D F ( r , θ ) = ϵ 2 2 π r e − ϵ r PDF(r, \theta) = \frac{\epsilon^2}{2\pi} r e^{-\epsilon r} P D F ( r , θ ) = 2 π ϵ 2 r e − ϵr
The angle θ \theta θ is chosen uniformly at random from [ 0 , 2 π ) [0, 2\pi) [ 0 , 2 π ) : θ ∼ Uniform ( 0 , 2 π ) \theta \sim \text{Uniform}(0, 2\pi) θ ∼ Uniform ( 0 , 2 π )
The noise radius r r r is drawn from a Gamma distribution Γ ( 2 , ϵ ) \Gamma(2, \epsilon) Γ ( 2 , ϵ ) : r = − 1 ϵ ( W − 1 ( p − 1 e ) + 1 ) r = -\frac{1}{\epsilon} \left( W_{-1} \left( \frac{p - 1}{e} \right) + 1 \right) r = − ϵ 1 ( W − 1 ( e p − 1 ) + 1 ) (where W − 1 W_{-1} W − 1 is the Lambert W W W function and p ∼ Uniform ( 0 , 1 ) p \sim \text{Uniform}(0, 1) p ∼ Uniform ( 0 , 1 ) )
The perturbed coordinate z = ( x actual + r cos θ , y actual + r sin θ ) z = (x_{\text{actual}} + r\cos\theta, y_{\text{actual}} + r\sin\theta) z = ( x actual + r cos θ , y actual + r sin θ ) is transmitted to the location-based service provider. The privacy parameter ϵ \epsilon ϵ controls the privacy-utility tradeoff: smaller ϵ \epsilon ϵ values inject larger noise radii, providing stronger privacy guarantees at the cost of spatial accuracy.
4. Dummy Query Generation
When querying a location-based service (e.g., searching for nearby restaurants), the client generates m − 1 m - 1 m − 1 synthetic, realistic "dummy" locations alongside the true user coordinate, transmitting all m m m queries simultaneously. The server returns results for all m m m locations, and the client discards the dummy responses locally. An external eavesdropper or untrusted server cannot determine which of the m m m queries represents the user's authentic location, reducing identification probability to 1 m \frac{1}{m} m 1 .
The Location Data Broker Problem
Much location data reaches third parties through software development kits (SDKs) embedded in ordinary apps (weather, games, prayer, and coupon apps) and through real-time ad bidding. Brokers aggregate it into datasets that can be searched by place: who visited a clinic, a shelter, a place of worship, or a protest.
The U.S. Federal Trade Commission has treated the sale of sensitive location data as an unfair practice:
X-Mode Social / Outlogic (January 2024): the first FTC order banning a data broker from selling or sharing sensitive location data, such as visits to medical facilities, places of worship, and domestic-violence shelters.
InMarket Media (January 2024): banned from selling or licensing precise location data.
Gravy Analytics and Mobilewalla (December 2024): orders restricting the collection and sale of sensitive location data, including data harvested from real-time ad auctions.
Kochava: an FTC lawsuit filed in 2022 alleging that selling precise location data exposed visits to sensitive places.
Controls for Teams That Collect Location
Control Example
Ask only when needed Request "while using the app" permission at the moment a location feature is used, not at install
Prefer approximate location iOS 14 and Android 12 let users grant approximate location; design features to work with it
- Reduce frequency Sample only when the user acts, not continuously in the background
- Process on device Compute "near a store" on the phone and send only the result
- Short retention Keep raw traces for hours or days, then aggregate or delete
Sensitive-place filtering Drop points near clinics, shelters, and places of worship before any analysis or sharing
No sale, careful sharing Do not sell location data; contractually ban SDK partners from reselling it, and test what SDKs transmit
Law-enforcement request process After Chatrie (2026), require a warrant for location history and minimize what is stored so less can be compelled
These controls follow the same minimization logic as the rest of the CIPT: the safest location record is one that was never collected at full precision or was deleted soon after use.