California Attorney General Targets Location Data Industry

On March 10, 2025, California Attorney General Rob Bonta announced an investigative sweep targeting the location data industry for potential non-compliance with the California Consumer Privacy Act (the “CCPA”). The focus is on advertising networks, mobile app providers, and data brokers that collect and disseminate consumers' geolocation information without proper consent or opt-out mechanisms. As part of the investigation, the attorney general's office has sent inquiry letters to businesses that may be violating CCPA provisions related to the sale and sharing of personal information, specifically geolocation data.

Part of a Growing Trend in Regulatory Scrutiny

Attorney General Bonta's investigative sweep aligns with a broader movement among federal and state agencies to scrutinize the collection and use of individuals' location data. Recent actions include the Federal Trade Commission's (the “FTC”) settlement with data brokers for unlawfully selling sensitive location information without consent and lawsuits filed by the Texas attorney general against companies for improperly collecting, using and selling driving data.

Recommendation

This enforcement action underscores the importance for businesses that collect, use and distribute location data to review and update their contracts, internal policies and data collection and sharing practices. Non-compliance with federal and state requirements could lead to legal repercussions and damage to consumer trust. Recommendation actions include:

• Assess Data Practices: Conduct thorough audits of data collection, sharing, and storage practices to ensure compliance with CCPA standards.
• Enhance Transparency: Clearly inform consumers about data collection methods and provide straightforward mechanisms to opt out of data sale or sharing.
• Review Vendor and Customer Contracts: Review vendor and customer contracts to ensure appropriate contractual requirements are included.
• Monitor Regulatory Updates: Stay informed about changes in privacy laws and adjust business practices accordingly to maintain compliance.