CCPA and AI Location Data 2026: Precise Geolocation Is Sensitive Personal Information
Most teams treat location as just another field. The CCPA does not. Once a coordinate identifies someone inside a circle with a radius of 1,850 feet, it stops being ordinary personal information and enters the sensitive category — with a separate notice, a separate consumer right, and a separate set of vendor problems that an ordinary data map never surfaces.
The Line Is a Radius, Not a Purpose
The CCPA's sensitive personal information list is mostly made of categories you would recognise on sight — government identifiers, financial account credentials, precise health and biometric data, contents of communications. Precise geolocation sits alongside them, and it is the only entry defined by a measurement. Any location value that pins a person inside a circle with a radius of 1,850 feet is in. Anything coarser is out.
That threshold is far coarser than what a phone actually reports. A consumer GPS fix is routinely accurate to a few metres, and even a Wi-Fi or cell-tower estimate usually beats a third of a mile in a populated area. In practice, almost every location value collected from a mobile device is precise geolocation. The exceptions are the values you deliberately degraded before storing them.
Where AI Features Quietly Cross the Line
- • Delivery ETA and driver dispatch routing
- • Store locator and in-store pickup handoff
- • Fraud checks comparing device location to billing address
- • Field-service scheduling and technician assignment
- • Local inventory and same-day availability lookups
- • Foot-traffic models that cluster visits into behavioral segments
- • Lookalike audiences built from visit patterns
- • Churn or intent scores that use dwell time at competitor sites
- • Model training on historical trip data across all users
- • Enrichment sold or shared with a location-data broker
The left column is the reason the data was collected, and the permitted purposes generally cover it. The right column is what the same warehouse table gets used for six months later, once someone notices there is a rich behavioral signal sitting in it. That second use is what triggers the limit-the-use right, and it is almost never in the data map that was written when the feature shipped.
The Degradation Trap
A common defence is that the product only shows city-level location, so no precise data is involved. That argument fails almost every time it is examined, because the coarsening is applied at the presentation layer. The device returns a full-resolution coordinate pair, the request carries it to the server, the server writes it to an access log, the analytics pipeline copies it, and only then does a display function round it to a city name.
Collection happened at the first step. If you want a coarse-location product to genuinely be a coarse-location product, the rounding has to happen on the device before transmission, and the raw value must never be persisted anywhere — including the request logs your infrastructure writes by default.
What Compliance Actually Requires
Inventory every path that carries a coordinate
Not just the feature that asked for the permission. Include SDKs, tag managers, crash reporters, ad attribution, and any log that records an IP-derived location alongside a request.
Name the category in the notice at collection
The notice has to identify precise geolocation specifically, state the purpose, and give a retention period. A general reference to 'location information' does not discharge the obligation.
Ship the limit-the-use control if you go beyond service delivery
If location is used only to deliver the requested service, the link is not required. The moment it feeds profiling, audience work, or model training, it is — and it is a distinct control from Do Not Sell or Share My Personal Information.
Make degraded mode a real code path
A limit-the-use request that your pipeline cannot act on is a violation you have documented in advance. The routing call should still work while the analytics write is suppressed, which usually means splitting the write at ingestion rather than filtering at query time.
Read what your location vendors reserve the right to do
Mapping, weather, attribution, and enrichment vendors frequently retain rights to use coordinates for their own products. That is a sale or share, not service-provider processing, and it needs an opt-out and a Global Privacy Control path.
Check whether your inferences landed in another sensitive category
Overnight clusters imply a home address, repeat clinic visits imply health status, and weekly attendance at a place of worship implies religious belief. If your segments encode any of these, you are processing more sensitive categories than your notice discloses.
Frequently Asked Questions
Is location data sensitive personal information under the CCPA?
Precise geolocation is, and the line is drawn by radius rather than intent. Location that places a consumer inside a circle with a radius of 1,850 feet is precise geolocation and sits in the sensitive category. City, metro, or postal-code level location is ordinary personal information. The difference matters because the sensitive category carries a limit-the-use right that ordinary personal information does not.
Our product only displays city-level location. Are we clear?
Only if the coarsening happens on the device before transmission. If the full-resolution coordinate reaches your server, your request logs, or your analytics pipeline before being rounded for display, you collected precise geolocation. What the interface shows is not what the data map records.
What does the limit-the-use right require us to build?
A degraded mode that still delivers the service. Routing, delivery, and store lookup keep working; profiling, audience building, and model training on that person's location stop. If the operational use and the analytical use share one write path, the request cannot be honored, which is why the split usually has to happen at ingestion rather than at query time.
Do we need a separate notice and link for location?
The notice at collection must name precise geolocation as a category, state the purpose, and give a retention period. A Limit the Use of My Sensitive Personal Information link is required once the data is used beyond the narrow permitted purposes — and it is a distinct control from the sale-or-share opt-out, not a rename of it.
An SDK collects the location, not our code. Does that help?
No. The business that decides the purposes and means of processing carries the obligation, and choosing to ship the SDK is that decision. If the vendor uses the coordinates for its own audience graphs, benchmarking, or model training, the transfer is a sale or share and needs an opt-out rather than a service-provider contract.
Are the inferences our model draws also regulated?
Inferences drawn from personal information are personal information themselves, and location inferences routinely land in other sensitive categories by accident. Overnight stays reveal a home address, recurring clinic visits imply health status, and weekly religious attendance implies belief. Behavioral segments built on visit patterns encode all three whether or not anyone intended them to.
Related Reading
Start With What Your Site Actually Loads
Location exposure is rarely a decision anyone remembers making. It is a mapping widget, an attribution SDK, and a tag manager container that three different teams have edited. The compliance work cannot start until you know what is running in production.
Auditing what your pages load and expose is the same discipline applied to the rest of your site. Run a free scan of your site to see what's live today.