Senate Geolocation Bills Aim to Clarify Legal Framework on Tracking

There’s no clear legal framework to govern the collection of location data from mobile and GPS devices, the senators said. Though the Cable Act and the Communications Act prohibit cable and phone companies from disclosing their customers’ locations, the Electronic Communications Privacy Act permits wireless service providers and third-party applications to share customers’ location information without user consent, they said. “We are trying to give a clear legal framework that is missing,” said Wyden, “and give Americans confidence that their privacy rights are protected.”

The primary difference between the two bills is that Franken and Blumenthal’s legislation applies only to non-government entities like companies and individuals, whereas Wyden and Chaffetz’s legislation extends to law enforcement and federal agencies as well. “Law enforcement agencies are going too far,” said Chaffetz, and the GPS Act will specifically limit police and government entities from warrantless tracking of individuals’ location data, he said.

The GPS Act requires federal and law enforcement agencies to acquire warrants in order to intercept an individual’s geolocation information and forbids courts from considering evidence based on geolocation information acquired without a warrant. The GPS Act carves out situational exceptions for emergencies, threats to national security, organized crime conspiracies, and cases of theft or fraud. The GPS Act permits private companies to collect geolocation information in the “normal course of business” but they will only be allowed to share and sell customer data after acquiring consumer consent.

The Federal Law Enforcement Officers Association (FLEOA) condemned Wyden and Chaffetz’s bill as a “framework for disaster,” in the words of J. Adler, the group’s national president. “By changing procedures and requiring law enforcement to seek a warrant, Chaffetz and Wyden will be unwittingly empowering the criminal element,” said Adler. “When pursuing suspected terrorists and violent fugitives, time is of the essence. Their bill, if passed, will increase the risk to our homeland and the American citizenry.”

Franken and Blumenthal’s geolocation bill has a more narrow focus and aims to restrict only companies and individuals who collect location information. The Location Privacy Act of 2011 requires companies to obtain express consent from consumers before collecting or sharing their location data with third parties. The bill also contains a provision that requires companies that track more than 5,000 mobile devices to protect the data from disclosure, tell inquisitive consumers what data they track, and delete the data if requested. “Our laws do too little to protect information on our mobile devices,” said Sen. Franken. “This legislation would give people the right to know what geolocation data is being collected about them and ensure they give their consent before it’s shared with others.”

NetChoice was critical of Franken’s bill because it leaves major e-commerce companies vulnerable to expensive lawsuits over small, technical violations, it said in a email Wednesday. “The local high school bus is full of kids with smartphones, many whose geolocation is shared with their parents,” said NetChoice Executive Director Steve DelBianco. “And what if, say, Google and Facebook haven’t obtained affirmative consent when these kids turned 18? Every sharing by every kid equals $2,500 per violation, plus attorney’s fees. This can’t be what Sen. Franken had in mind."

The Center for Democracy and Technology supports both bills, said Justin Brookman, director of CDT’s Consumer Privacy Project. “We like the idea that sharing location data among businesses should be conducted on an opt-in basis and sharing among government agencies should take place on a warrant basis,” he said. Brookman couldn’t say whether one bill had a better likelihood of passage than the other, but said he hoped both ideas are somehow incorporated into law.