Location Tracking: A Complete CIPT Guide to Privacy Risk Management
Introduction
Location tracking is one of the most heavily tested topics in the privacy risk management domain of the IAPP Certified Information Privacy Technologist (CIPT) exam. Location data is among the most revealing types of personal information. Technologists must understand how it is collected, why it is risky, and what controls reduce that risk.
Why Location Tracking Is Important
Location data is uniquely sensitive for several reasons:
• It reveals intimate details: A person's movements can expose religious practices (visits to places of worship), health conditions (visits to clinics, oncology centers, rehab facilities), sexual orientation, political affiliations, union activity, and relationships.
• It is very hard to anonymize: Research (notably de Montjoye et al., 2013, 'Unique in the Crowd') showed that as few as four spatio-temporal points are enough to uniquely identify about 95% of individuals in a mobile dataset. Home and work locations alone often identify a person.
• It enables physical harm: Stalking, domestic abuse, burglary (knowing when someone is away), and harassment can all follow from location exposure.
• It is collected continuously and passively: Unlike data a user types in, location is often gathered in the background without ongoing awareness.
• Regulators treat it seriously: Under the GDPR, location data is explicitly listed as an identifier in the definition of personal data (Art. 4(1)). The ePrivacy Directive regulates traffic and location data from electronic communications. CCPA/CPRA classifies precise geolocation (within a radius of 1,850 feet) as sensitive personal information. The U.S. FTC has brought enforcement actions against data brokers selling location data (e.g., Kochava, X-Mode/Outlogic, InMarket). COPPA treats geolocation sufficient to identify a street name and city as personal information.
What Location Tracking Is
Location tracking is the collection, processing, storage, or sharing of information that indicates the physical position of a device or individual, either at one point in time or over a period (a location history or trajectory). Key distinctions:
• Precise vs. coarse location: Precise means GPS-level accuracy within meters. Coarse means city or region level, often derived from IP address or cell tower.
• Real-time vs. historical: Live tracking versus stored location trails.
• Active vs. passive collection: A user checking in, versus background collection by apps, Wi-Fi probes, or sensors.
• Device-based vs. network-based vs. infrastructure-based: Determined by the phone, by the carrier, or by venue sensors and cameras.
How Location Tracking Works: Key Technologies
• GPS / GNSS: Satellite-based positioning computed on the device. It is very precise (meters) and works mainly outdoors. The satellites receive nothing from the device, so tracking happens when the device shares its computed location.
• Cell tower triangulation / cell-ID: Carriers know which towers a phone connects to. Accuracy ranges from hundreds of meters to kilometers. It is generated automatically as part of network operation, which creates call detail records.
• Wi-Fi positioning: Devices scan nearby access points (SSIDs/BSSIDs). Databases map these to locations. Phones also broadcast probe requests containing MAC addresses, which retailers can capture. This is why modern OSs use MAC address randomization.
• Bluetooth and BLE beacons: Short-range beacons (e.g., iBeacon, Eddystone) enable indoor and proximity tracking in stores, airports, and stadiums.
• RFID and NFC: Tags in badges, transit cards, toll transponders, and products can reveal presence at readers.
• IP address geolocation: Coarse location inferred from IP address ranges.
• Ultra-wideband (UWB): Centimeter-level precision, used in item trackers such as AirTags.
• Sensor fusion and inference: Accelerometers, barometers, photos (EXIF GPS metadata), social media check-ins, and even battery or Wi-Fi signals can reveal or infer location.
• Video and ANPR/ALPR: CCTV, facial recognition, and automated license plate readers track people and vehicles.
• Connected vehicles, telematics, and IoT: Cars, fitness trackers, and smart devices report location to manufacturers and insurers.
Common Uses (Legitimate and Problematic)
• Navigation, ride-hailing, delivery, and emergency services (E911/E112).
• Location-based advertising and geofencing.
• Retail analytics (footfall, dwell time).
• Fleet and employee monitoring.
• Contact tracing (e.g., Google/Apple Exposure Notification, which deliberately used Bluetooth proximity rather than GPS and a decentralized design).
• Law enforcement requests and geofence warrants.
• Data broker aggregation and resale, a major area of regulatory concern.
Privacy Risks (Map These to Frameworks)
Using Solove's Taxonomy of Privacy:
• Surveillance: Continuous monitoring of movements.
• Aggregation: Combining location points into a detailed life pattern.
• Identification: Re-identifying 'anonymous' trails.
• Secondary use: Using navigation data for advertising or insurance.
• Disclosure / exposure: Revealing visits to sensitive places.
• Insecurity: Breaches of location databases.
• Intrusion and decisional interference: Chilling effects on freedom of movement and association.
Using Calo's harm dimensions: subjective harm is the feeling of being watched; objective harm is actual misuse such as stalking or discrimination.
Using Nissenbaum's contextual integrity: sharing location with a maps app for directions fits context norms. Selling that same data to a broker violates them.
Privacy Controls and Mitigations
Privacy by Design / Data Minimization:
• Collect location only when needed for the feature (e.g., 'while using the app' rather than 'always').
• Use the least precise location adequate for the purpose. iOS and Android both offer approximate location options.
• Process location on-device (edge processing) rather than sending it to servers.
• Set short retention periods and auto-delete location history.
De-identification techniques for location:
• Spatial cloaking / generalization: Reduce precision (truncate coordinates, snap to grid or ZIP code).
• Temporal cloaking: Coarsen timestamps.
• K-anonymity for location: Ensure each reported area contains at least k users.
• Perturbation / noise addition / geo-indistinguishability: A form of differential privacy applied to location.
• Aggregation: Report heat maps or counts rather than individual trajectories.
• Removing sensitive points: Strip home and work endpoints and sensitive locations from trips.
• Rotating identifiers and MAC randomization: Prevent long-term linkage.
• Metadata stripping: Remove EXIF GPS data from photos before publishing.
Remember that pseudonymization alone is NOT sufficient for location trails. Trajectories are themselves quasi-identifiers.
Transparency and choice:
• Just-in-time notices and OS permission prompts explaining why location is needed.
• Opt-in consent for precise or background location. Consent is required under the ePrivacy Directive for non-traffic location data, and recommended or required for sensitive data under many US state laws.
• Visual indicators when location is in use.
• Easy controls to pause, delete, or export location history.
Security and governance:
• Encrypt location data in transit and at rest.
• Apply strict access controls and logging.
• Conduct a DPIA/PIA. Large-scale systematic monitoring and location tracking typically trigger a DPIA under GDPR Art. 35.
• Use vendor and SDK due diligence. Third-party SDKs in apps are a common source of undisclosed location sharing.
• Require contractual limits on onward sale and use.
• Maintain policies for law-enforcement requests.
Employee tracking considerations:
• Apply proportionality, notice, and a legitimate business purpose.
• Avoid tracking outside working hours (e.g., disable fleet tracking off-shift).
• Consult works councils where required.
Exam Tips: Answering Questions on Location Tracking
1. Assume location data is personal and often sensitive. If an answer option claims location data is 'anonymous' because names were removed, it is almost always wrong. Recall that four points can identify 95% of people.
2. Prefer minimization answers. When asked for the BEST privacy-enhancing approach, the strongest answer usually reduces precision, frequency, or retention, or keeps processing on-device. 'Collect everything but encrypt it' is weaker than 'don't collect what you don't need.'
3. Match the technology to its characteristics. Know that GPS is precise and device-computed. Cell-ID is network-generated and carrier-held. Wi-Fi and BLE suit indoor tracking. IP gives only coarse location. MAC randomization counters Wi-Fi probe tracking. EXIF metadata leaks photo location.
4. Recognize the risk category. Scenario questions often ask which privacy harm is at play. Continuous monitoring is surveillance. Combining datasets is aggregation. Selling data for advertising is secondary use. Re-identifying trails is identification.
5. Watch for consent and permission nuances. 'Always allow' background location requires stronger justification than 'while in use.' Precise location deserves opt-in. Under CPRA, precise geolocation is sensitive PI, and consumers can limit its use.
6. Know when a DPIA is needed. Systematic monitoring, large-scale tracking, employee tracking, and novel technologies (e.g., beacons in stores, smart city sensors) are classic DPIA triggers.
7. Third-party SDKs are a trap. If a scenario describes an app unexpectedly sharing location, the likely root cause or control is SDK vetting and data-flow mapping.
8. Contact tracing is a design case study. Expect questions on why Bluetooth proximity with rotating identifiers and decentralized matching is more privacy-protective than centralized GPS collection.
9. Read for qualifiers. Words like BEST, FIRST, and MOST effective matter. The FIRST step is often a data inventory or PIA. The MOST effective technical control is often aggregation or differential privacy rather than simple pseudonymization.
10. Apply contextual integrity. If the data flow matches user expectations for the original purpose, it is more acceptable. Repurposing location for unrelated uses (insurance pricing, ad targeting, sale to brokers) signals a privacy violation.
11. Eliminate absolute answers. Options claiming a technique 'completely eliminates' re-identification risk are usually incorrect.
Sample Question Walkthrough
A fitness app wants to publish a public heat map of popular running routes. Which approach BEST reduces privacy risk?
A) Remove usernames from the routes.
B) Aggregate routes, suppress areas with few users, and trim start/end points near homes.
C) Encrypt the route database.
D) Publish only routes from the last year.
Answer: B. Removing names (A) leaves trajectories that can be re-identified. The Strava heat map incident exposed military bases this way. Encryption (C) protects storage, not publication. Limiting time (D) does not prevent identification. B combines aggregation, k-anonymity-style suppression, and endpoint removal.
Key Takeaways
• Location data is highly identifying, revealing, and regulated.
• Know the collection technologies and their precision and indoor/outdoor characteristics.
• Map risks to Solove's taxonomy and contextual integrity.
• Favor minimization, reduced precision, on-device processing, aggregation, and differential privacy.
• Use transparent, granular, opt-in permissions, and conduct DPIAs.
• Be skeptical of 'anonymized' location claims on the exam.
