ePrivacy: Location Data
Location Data [Art 9]
Rule: Location data (other than traffic data) can only be processed with user consent, and users must be able to temporarily withdraw consent for each connection or transmission.
What is Location Data?
Location data means any data processed in an electronic communications network indicating the geographic position of the terminal equipment of a user.
Examples:
- GPS coordinates from mobile devices
- Cell tower triangulation data
- Wi-Fi positioning data
- IP-based geolocation (less precise)
Consent Requirements [Art 9(1)]
Location data may only be processed when:
- Anonymized — Data is made anonymous, OR
- With consent — User or subscriber has given consent
Conditions for Processing [Art 9(1)]
When processing with consent:
| Requirement | Details |
|---|---|
| Purpose limitation | Only for providing value-added service |
| Duration limitation | Only for time necessary for the service |
| Prior information | User must be informed of data types, purposes, duration, third parties |
| Consent scope | May be limited to certain types of location data |
Temporary Withdrawal [Art 9(2)]
The user or subscriber must be given the possibility to withdraw consent to the processing of such location data at any time.
Key requirement: Users must be able to temporarily refuse processing:
- Using simple means
- Free of charge
- For each connection to the network
- For each transmission of a communication
Practical Implications
App developers must:
- Request location permission with clear explanation
- Provide easy toggle to disable location tracking
- Not block app functionality if location is refused (unless essential)
Telecoms must:
- Offer location-off settings
- Not process location without consent
- Limit processing to stated purposes
Value-Added Services
Location data is often used for value-added services like:
- Navigation / maps
- Local search results
- Location-based advertising
- Emergency services (special rules apply)
- Fleet tracking (employment context requires additional consideration)
Emergency Services Exception
Location data may be processed for emergency calls (112 in EU) without consent for the purpose of responding to emergencies.