11.4 Privacy Risks and Impacts of Location Tracking

11.4 Privacy Risks and Impacts of Location Tracking

Quick Summary: A record of where someone goes reveals where they live, work, worship, seek medical care, and protest. Location data is gathered from GPS, cell networks, Wi-Fi, Bluetooth beacons, and IP addresses, and it is sold through a large broker market. The BoK asks technologists to understand these risks; the engineering response is to collect location only at the precision and frequency a feature needs, keep it briefly, never sell or share sensitive visits, and apply obfuscation techniques when location must be analyzed.

Location is one of the few data types that is both highly identifying (a few points single out most people) and highly sensitive (it reveals health, religion, and associations). Many privacy laws now classify precise geolocation as sensitive data; under the CCPA, "precise geolocation" means data that locates a consumer within a circle with a radius of 1,850 feet.

---

Location Surveillance Mechanisms

Location data provides a granular map of an individual's life. Revealing an individual's physical coordinates over time exposes intimate details: home address, workplace, medical clinics visited, religious institutions attended, and political rallies participated in.

1. Physical Location Tracking Vectors

• GPS / GNSS Trilateration: Satellites broadcast high-precision timestamps. A device measures the Time of Arrival (TOA) from at least 4 satellites to resolve latitude, longitude, elevation, and clock drift. Accuracy: 3 to 10 meters outdoors. GPS is passive (the device receives satellite radio signals without transmitting back to space), but client apps report coordinates back to servers.
• Cell Tower Triangulation and Timing Advance: Mobile base transceiver stations (BTS) log device connections. Cellular carriers record Cell Global Identity (CGI) and Timing Advance (TA)—the round-trip signal propagation delay between the handset and tower. By combining signal strengths from multiple adjacent cell towers (Angle of Arrival [AoA] and Observed Time Difference of Arrival [OTDOA]), carriers calculate device coordinates within 50 to 300 meters without client GPS cooperation. Data is logged in carrier Call Detail Records (CDRs).
• Wi-Fi MAC Address Probe Request Sniffing: When Wi-Fi is active, devices periodically transmit IEEE 802.11 probe request frames to discover known networks (SSIDs). Probe frames include the device's hardware 48-bit MAC address. Retail analytics companies install physical Wi-Fi sniffers throughout stores and cities to log probe requests, tracking consumer footpaths and store dwell times.
  • Operating System Defenses: Modern operating systems (iOS, Android, Windows) implement MAC Address Randomization. The OS generates a randomized, rotating pseudo-MAC address with the "locally administered" bit set (b1 = 1) whenever scanning for networks, preventing static physical beacon tracking.
• Bluetooth Low Energy (BLE) Beacons: Small transmitters broadcasting identifiers (UUID, Major, Minor) via iBeacon or Eddystone protocols. When a smartphone running a partner app passes within range, the app detects proximity (ranging from <0.5m to 10m) based on Received Signal Strength Indication (RSSI), logging exact indoor positioning.

2. Geofence Warrants and Reverse Searches

A geofence warrant (or reverse location warrant) inverts traditional law enforcement investigative procedures:

Traditional Search Warrant                      Geofence (Reverse Location) Warrant
+---------------------------------------+       +---------------------------------------+
| 1. Establish probable cause on a      |       | 1. Define physical geographic boundary|
|    KNOWN SUSPECT                      |       |    and time window (e.g., crime scene)|
| 2. Request data relating to that      |       | 2. Compel database provider (e.g.,    |
|    named individual.                  |       |    Google Sensorvault) to search all  |
|                                       |       |    devices present in that geofence.  |
|                                       |       | 3. Sift through thousands of innocent |
|                                       |       |    bystanders to identify suspects.   |
+---------------------------------------+       +---------------------------------------+

Geofence warrants divided the federal appeals courts until the U.S. Supreme Court decided Chatrie v. United States on June 29, 2026. In a 6–3 opinion by Justice Kagan, the Court held that obtaining even two hours of a person's Google Location History is a Fourth Amendment search, extending Carpenter v. United States (2018): location history is not truly "shared" with a provider just because a phone generates it. The Court did not decide whether the three-step geofence warrant used in the case satisfied probable cause and particularity, and remanded that question. Engineering choices also shape what can be compelled: after Google moved Google Maps Timeline data to on-device storage (announced December 2023), it no longer holds a central Location History database that a geofence warrant could search.

---

Location Obfuscation Engineering

Privacy technologists implement mathematical techniques to protect location privacy while preserving application functionality.

1. Spatial Cloaking and Precision Truncation

Spatial cloaking reduces coordinate granularity before data leaves the device:

• Coordinate Truncation: Truncating latitude and longitude decimal places:
  • 6 decimal places $\approx 0.11\text{ meters}$ (identifies an individual chair).
  • 4 decimal places $\approx 11\text{ meters}$ (identifies a house or store).
  • 2 decimal places $\approx 1.1\text{ kilometers}$ (identifies a neighborhood or city district).
• Geohashing and Grid Aggregation: Mapping coordinates into coarse geographic bounding boxes (e.g., Geohash precision 5, covering $\approx 4.9\text{ km} \times 4.9\text{ km}$). Applications such as weather forecasts require only coarse city-level resolution and should never capture high-precision decimal coordinates.

2. Trajectory k-Anonymity

An individual's sequence of spatio-temporal coordinates (a trajectory) forms a unique fingerprint. Studies show that just 4 spatio-temporal points are sufficient to uniquely identify 95% of individuals in a mobile location dataset.

Trajectory $k$-Anonymity ensures that for every reported path, there exist at least $k-1$ other individuals whose spatio-temporal trajectories are indistinguishable within the same spatial-temporal corridor. Systems achieve this by suppressing rare trajectory points, swapping trajectory segments, or clustering overlapping routes.

3. Geo-Indistinguishability and Planar Differential Privacy

To provide formal mathematical privacy guarantees, researchers developed Geo-Indistinguishability—the adaptation of $\epsilon$-differential privacy to geographic coordinates. Geo-indistinguishability ensures that an adversary observing an obfuscated location cannot determine the user's actual location within a privacy radius $r$ with high confidence.

Systems implement geo-indistinguishability by adding planar Laplace noise to coordinates in polar form:

$PDF(r, \theta) = \frac{\epsilon^2}{2\pi} r e^{-\epsilon r}$

• The angle $\theta$ is chosen uniformly at random from $[0, 2\pi)$: $\theta \sim \text{Uniform}(0, 2\pi)$
• The noise radius $r$ is drawn from a Gamma distribution $\Gamma(2, \epsilon)$: $r = -\frac{1}{\epsilon} \left( W_{-1} \left( \frac{p - 1}{e} \right) + 1 \right)$ (where $W_{-1}$ is the Lambert $W$ function and $p \sim \text{Uniform}(0, 1)$)

The perturbed coordinate $z = (x_{\text{actual}} + r\cos\theta, y_{\text{actual}} + r\sin\theta)$ is transmitted to the location-based service provider. The privacy parameter $\epsilon$ controls the privacy-utility tradeoff: smaller $\epsilon$ values inject larger noise radii, providing stronger privacy guarantees at the cost of spatial accuracy.

4. Dummy Query Generation

When querying a location-based service (e.g., searching for nearby restaurants), the client generates $m - 1$ synthetic, realistic "dummy" locations alongside the true user coordinate, transmitting all $m$ queries simultaneously. The server returns results for all $m$ locations, and the client discards the dummy responses locally. An external eavesdropper or untrusted server cannot determine which of the $m$ queries represents the user's authentic location, reducing identification probability to $\frac{1}{m}$.

---

The Location Data Broker Problem

Much location data reaches third parties through software development kits (SDKs) embedded in ordinary apps (weather, games, prayer, and coupon apps) and through real-time ad bidding. Brokers aggregate it into datasets that can be searched by place: who visited a clinic, a shelter, a place of worship, or a protest.

The U.S. Federal Trade Commission has treated the sale of sensitive location data as an unfair practice:

• X-Mode Social / Outlogic (January 2024): the first FTC order banning a data broker from selling or sharing sensitive location data, such as visits to medical facilities, places of worship, and domestic-violence shelters.
• InMarket Media (January 2024): banned from selling or licensing precise location data.
• Gravy Analytics and Mobilewalla (December 2024): orders restricting the collection and sale of sensitive location data, including data harvested from real-time ad auctions.
• Kochava: an FTC lawsuit filed in 2022 alleging that selling precise location data exposed visits to sensitive places.

Controls for Teams That Collect Location

These controls follow the same minimization logic as the rest of the CIPT: the safest location record is one that was never collected at full precision or was deleted soon after use.