Regulating commercial location tracking has reached a turning point. Last year, we published our rubric for what comprehensive and protective location privacy laws should look like, outlining the baseline standards states should meet to shield individuals from pervasive location surveillance. Since then, state lawmakers across the country have begun responding to calls like these, with **Connecticut**, **Maryland**, **New Jersey**, **Oregon**, and **Virginia** enacting new consumer privacy restraints on an industry that profits off our physical movements. Yet, even as these states move the ball forward to restrict location tracking, most of their laws leave significant gaps that still must be filled. Other states – and Congress – need to get into the game, too, and ensure protection of everyone. ## Why Location Privacy Is Important Imagine spending a couple of hours in a coffee shop, a friend's house, or a healthcare clinic, only to discover yourself under police investigation because your cell phone’s location data exposed your presence there. This is the reality of geofence warrants for location data, the controversial surveillance technique recently scrutinized by the U.S. Supreme Court in *Chatrie v. United States*. Through geofencing, tech companies and law enforcement can map everyone who was present within a specific area over a certain window of time, inverting standard constitutional protections by turning every innocent bystander into a potential suspect. While the Supreme Court's ruling in *Chatrie* established that accessing location data via geofencing constitutes a Fourth Amendment search requiring constitutional protections, law enforcement demands via these warrants are only part of the problem. That same geolocation tracking is used by commercial data brokers operating in a largely unregulated market. These brokers regularly harvest, aggregate, and sell physical location data to anyone with a credit card (including government agencies, which are among their regular clients). Especially for individuals seeking reproductive or gender-affirming care, attending a protest, or visiting an immigration law clinic, this pervasive commercial location surveillance represents an immediate threat. In Part 1 of this series, we urged lawmakers to protect people from the growing harms of location tracking tools across all areas of public life. The real-world consequences of this unregulated market impact us all. An anti-LGBTQ+ advocacy group spent millions of dollars buying app location data to track priests across multiple dioceses and used app-harvested location data to “out” a priest after purchasing his **Grindr** location signals. Privacy advocates posing as private investigators gained access to **Locate X**, a location-tracking tool developed by **Babel Street**, and demonstrated how the tool tracked a device traveling from Alabama, where abortion is banned, to an abortion clinic in Florida, where access is less restricted. Data brokers like **Near Intelligence** have sold precise location data of reproductive health clinic visitors directly to political groups. Location data has been used to locate U.S. military personnel in war zones. Law enforcement and private entities have also weaponized location tracking directly against political protesters: surveillance contractors and authorities have utilized location data derived from real-time bidding ad networks to track individuals attending demonstrations. The unregulated sharing of location data has created an ever-larger funnel for data brokers to capture and monetize our movements. For example, a recent **EFF** investigation identified several advertising Software Development Kits (**SDKs**) in Android apps that by default collect and share users' location data whenever app-level location permissions are granted. These advertising libraries automatically feed users' location data into ad systems that location data brokers have used to track people. Because defaults direct real-world outcomes, app developers who fail to carefully scrutinize the third-party SDKs they use, and disable unnecessary data collection, could inadvertently expose their users’ movements to commercial data brokers. ## State Legislative Progress Last year, we outlined six essential core principles that any meaningful location privacy law must contain: * Strong definitions * Clear rules * Affirmation that all precise geolocation data is sensitive * Empowerment of consumers through a strong private right of action * Prohibition of “pay-for-privacy” schemes * Transparency through clear privacy policies While the bills we highlighted from **California**, **Illinois**, and **Massachusetts** are yet to pass into law, a new wave of state location privacy legislation has taken effect across **Connecticut**, **Maryland**, **New Jersey**, **Oregon**, and **Virginia**. These five laws represent progress and share two strong features. First, all five of these states ban the sale of precise geolocation data. This will remove a strong incentive to collect and store this information in the first place. Other types of privacy laws have likewise banned the sale of sensitive types of data, like the **Illinois Biometric Privacy Act** (**BIPA**), which bans the sale of biometric information such as face scans. Second, all five states broadly define the protected data to include all kinds of locations across the board within a particular distance of a person or their device, rather than protecting just narrowly-defined “sensitive” locations. This all-locations protection is crucial, as even seemingly innocuous location data can be aggregated and used to infer sensitive information about an individual's life.