EFF Reports Progress and Challenges in Location Data Privacy Enforcement
EFF's 2026 report spotlights mixed progress on enforcing location data privacy rights.
Why it matters: Location data privacy intersects consumer protection, compliance, and regulatory law. Effective enforcement safeguards sensitive personal information and dictates industry standards.
- In 2024, FCC fined AT&T, Verizon, T-Mobile, and Sprint $196M for unauthorized location data sharing.
- FTC took five major enforcement actions since 2024 against data brokers handling sensitive location data.
- In 2025, a $46.9M fine against Verizon for selling location data without consent was upheld by appeals court.
- FTC's 2026 proposed settlement with Kochava restricted its collection, sale, and disclosure of sensitive location data.
The Electronic Frontier Foundation (EFF) published its report Privacy on the Map (Part 2): Progress, Pitfalls, and the Fight for Enforceable Location Data Protections on August 31, 2026. This comprehensive analysis underscores the incremental regulatory victories and persistent challenges in the location data privacy space.
The report highlights pivotal enforcement actions: In 2024, the Federal Communications Commission (FCC) imposed $196 million in fines on major U.S. carriers — AT&T, Verizon, T-Mobile, and Sprint — for providing customer location information without valid consent or protections. FCC Chairwoman Jessica Rosenworcel noted, "Our communications providers have access to some of the most sensitive information about us. These carriers failed to protect the information entrusted to them." (itechguides.com)
Enforcement by the Federal Trade Commission (FTC) intensified with five major actions against data brokers since 2024. A landmark 2025 final order barred Mobilewalla from using, transferring, or selling location data obtained from sensitive locations. Moreover, the U.S. Court of Appeals for the 2nd Circuit upheld a $46.9 million penalty against Verizon for selling location data without customer consent, reinforcing legal accountability (Ars Technica).
In May 2026, the FTC proposed a settlement with data broker Kochava Inc. This agreement imposes wide-reaching operational restrictions on Kochava's handling of sensitive location data. Attorney F. Paul Pittman of White & Case LLP described the settlement as "notable both for the breadth of its operational requirements and for the FTC’s characterization of sensitive location data as an area of heightened consumer protection concern" (whitecase.com).
Despite these advances, the EFF report emphasizes continuing pitfalls, including gaps in state law implementation and ongoing data broker practices that remain insufficiently transparent. These challenges underscore the need for sustained regulatory focus and legislative refinement to secure enforceable location privacy rights.
By the numbers:
- $196 million — FCC fines against major carriers in 2024 for unauthorized location data sharing
- $46.9 million — Verizon fine upheld by the U.S. Court of Appeals in 2025
- 5 — Major FTC enforcement actions on location data brokers since 2024
Yes, but: Though enforcement actions have increased, the EFF highlights ongoing gaps in state-level protections and full transparency among data brokers.
What's next: Further legislative initiatives and regulatory scrutiny are expected to address remaining loopholes in location data privacy enforcement.