Massachusetts Considers Ban on Sale of Phone Location Data

Abortion and privacy activists join over concerns that cell phones track our movements.

Championing civil liberties is often frustrating because a lot of people don't see the urgency until they're on the receiving end of overbearing enforcers. The process gets easier when advocates of one area of liberty find common cause with supporters of another. Such is the case in Massachusetts, where those concerned about government officials tracking people's movements through their cell phones are joined by activists worried about the privacy of women seeking abortions. The result is legislation that would ban the sale of phone location information—a big step that still might not thwart snoops.

"Every day, unregulated data brokers buy and sell personal location data from apps on our cellphones, revealing where we live, work, play, and more. To protect our privacy, safety, access to abortion and other essential health care, Massachusetts needs to ban this practice now by passing the Location Shield Act," urges the ACLU of Massachusetts. "In the aftermath of the Supreme Court's Dobbs decision, for example, journalists found that data brokers have continued to buy, repackage, and sell the location information of people visiting sensitive locations including abortion clinics. This puts people who seek or provide care in our state at risk of prosecution and harassment, creating a vulnerability in our state's post-Roe protections."

Cops Are Loyal Customers for Surveillance Data

The issue, actually, is less who sells the data than who buys it—often police or agencies of the security state. Last month, Reason's Joe Lancaster wrote up a report from the Office of the Director of National Intelligence revealing that government agencies frequently evade Fourth Amendment protections by purchasing commercially available information about the public—including data on people's movements. While, under Carpenter v. United States (2017), law enforcement needs a warrant to get records from communications providers (our phones really are tracking beacons), no such requirement applies to information purchased from third–party vendors.

Various agencies have bought access to our whereabouts for years, giving them the ability to track movements during crimes, civil disturbances, and political protests. Following the protests and riots after the 2020 murder of George Floyd by a police officer, demonstrators were plotted and demographically categorized using data provided by the phones in their pockets. Shortly thereafter, "Google provided investigators with location data for more than 5,000 devices as part of the federal investigation into the attack on the US Capitol," Wired noted.

It's not just the feds. Last summer, the Electronic Frontier Foundation revealed that "dozens of state and local law enforcement agencies" purchase "often warrantless access to the precise and continuous geolocation of hundreds of millions of unsuspecting Americans, collected through their smartphone apps and then aggregated by shadowy data brokers."

Privacy Reforms Get a Boost

That's enough to outrage civil libertarians and inspire a flurry of state-level reforms. But some people feel little urgency about the issue, perhaps because they don't see themselves on the receiving end of official scrutiny. Then the U.S. Supreme Court's Dobbs v. Jackson Women's Health decision returned questions over the legal status of abortion to the states, and the privacy of women crossing state lines to end pregnancies became an issue. "Phones Know Who Went to an Abortion Clinic. Whom Will They Tell?" the Wall Street Journal headlined a 2022 story about a concern that also applies to gun owners and political activists, but quickly became important to those concerned about reproductive rights. So, Massachusetts lawmakers proposed An Act Protecting Reproductive Health Access, LGBTQ Lives, Religious Liberty, and Freedom of Movement by Banning the Sale of Cell Phone Location Information, also (mercifully) termed "The Location Shield Act."

As the title suggests, the proposed legislation is a near-total ban on the sale of location information, stating "it shall be unlawful for a covered entity or service provider that lawfully collects and processes location information to…sell, rent, trade, or lease location information to third parties." Gathering data at all is restricted to "permissible purposes" defined as providing services, fulfilling commercial transactions, and responding to emergencies. The legislation also requires warrants for the disclosure of location information "to any federal, state, or local government agency or official."

A Step Too Far?

The State Privacy & Security Coalition, a trade group, opposes the Massachusetts bill in its current form and supports "passage of well-crafted federal legislation that will provide clarity to both individuals and businesses about their rights and responsibilities." Well, of course it does—one set of national rules is easier to follow than a patchwork of state laws. But the organization is correct that the Bay State bill is an outlier, and especially restrictive.

"No state has gone so far as to completely ban the sale of location data on residents," observes The Wall Street Journal. "The most common approach in other states is to require digital services and data brokers to obtain clear consent from consumers to collect data and put some restrictions on transfer and sale."

Typical of such laws is the California Consumer Privacy Act which gives consumers "the right to delete personal information collected from them (with some exceptions)" and "the right to opt-out of the sale or sharing of their personal information," according to the state attorney general's office. Virginia's law similarly requires disclosure of data sales and requires companies to inform people how they "may exercise the right to opt out of such processing."

Arguably, choice is better than a one-size-fits-all dictate, which might result in higher costs if companies replace lost revenue streams by raising prices. While those of us especially troubled by snooping would be willing to pay more to preserve our privacy, others could prefer to exchange anonymity for lower bills or free phone apps. Different strokes for different folks is generally a good policy, but it's one not permitted by the Massachusetts proposal.

The Real Problem Lies with the Snoops

Another problem is that there's a sense that these reforms play at police state whac-a-mole. Massachusetts is considering restrictions on phone location data obtained from third-party vendors because cops and security state agencies started buying that information after the Supreme Court said warrants are needed to get data from phone companies. Government snoops really want to be able to spy on people's movements and they'll certainly look for new sources after this one is restricted. At some point, we're going to have to talk about limits on the ability of the powers-that-be to track people no matter what clever means they invent for doing so.

Until then, the Massachusetts bill demonstrates that people are becoming aware of the privacy-threatening implications of the devices most of us carry every day. The proposed legislation and reforms in other states recognize the dangers of pierced anonymity to the exercise of our liberty.

But while lawmakers argue, remember that if you don't want your whereabouts to be recorded on a digital map, your best option is to leave the phone at home.