Geolocation Data
What is Geolocation Data?
Data indicating the real-world geographic location of a device or individual, classified as personal data under most privacy regulations.
Terms that appear alongside geolocation data
Each of these is named in at least one of the same controls as geolocation data. The number is how many controls name both.
- biometric data 11 shared controls
- consent 10 shared controls
- opt in consent 6 shared controls
- ferpa 5 shared controls
- ccpa 4 shared controls
- data protection 3 shared controls
- hipaa 3 shared controls
- genetic data 3 shared controls
Frameworks that govern geolocation data
What the standards actually require on geolocation data
Requirements naming geolocation data across 6 standards, quoted from the control text.
Access to geolocation data is limited to authorised staff of the departments concerned, the employer, and authorised staff of a client or principal where a service is justified to them.
cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::GEO-4 · GEO-4 Restrict geolocation data to authorised staff and do not give clients the driver's name →Controllers may not sell or offer to sell precise geolocation data about a consumer, whatever consent is obtained. Status: added by 2026 c. 820 (SB 338), in force 1 July 2026, replacing reliance on opt-in consent for such sales.
virginia-cdpa::59.1-578 A 6 · Ban on selling precise geolocation data →Per Iowa Code 715D.5-7 ICDPA imposes heightened obligations for sensitive data + children + de-identification. Unique among US state privacy laws Iowa CDPA requires NOTICE + OPT-OUT for sensitive data processing rather than OPT-IN CONSENT (other states VCDPA/C...
ICDPA-SensitiveData-Notice-OptOut-NotConsent-Children-COPPA-Alignment-De-Identification · Iowa CDPA Sensitive Data + Notice + Opt-Out (NOT Consent unlike VCDPA) + Children Under 13 + COPPA Alignment + De-Identification Standards + Heightened Risk Awareness →Section 4(4)(a) of Kentucky CDPA establishes the heightened consent requirement for sensitive data processing. (1) Section 2 Sensitive Data Definition - 8 Categories: (a) Racial or ethnic origin; (b) Religious beliefs; (c) Mental or physical health diagnosis;
KY-CDPA-Sensitive-Data-Affirmative-Consent-Race-Religious-Health-Genetic-Biometric-Children-Citizenship · Kentucky CDPA Sensitive Data + Affirmative Consent + Race/Ethnicity + Religious + Mental/Physical Health + Sexual Orientation + Citizenship/Immigration + Genetic + Biometric + Children's Data + Precise Geolocation (1,750 ft) + Section 4 Heightened Consent Standard →Procedural controls in company policy, SMS and security procedures govern how people use onboard systems, and security-sensitive plans stay confidential.
BIMCO-7.3 · Procedural protection measures →A controller must honour a consumer's opt-out of the collection of sensitive data, including precise geolocation data, and of the processing of sensitive data (in addition to the consent required by 501.71(2)(d)).
florida-digital-bill-of-rights-fdbr::501.705(2)(f) · 501.705(2)(f): right to opt out of collection or processing of sensitive data →Questions people ask about geolocation data
What is Geolocation Data?
Why is Geolocation Data important for compliance?
Which compliance frameworks address Geolocation Data?
Where can I learn more about Geolocation Data?
See how Geolocation Data applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.