Location Data Controls: Your 90-Day Compliance Build

The Irish Data Protection Commission's €403m fine against Google for location data violations between May 2018 and February 2020 highlights a fundamental issue: organizations can't prove compliance without proper documentation. Google violated GDPR's lawfulness, fairness, transparency, and retention requirements across three features (Web & App Activity, Location History, and Location Accuracy) and couldn't demonstrate compliance with accountability obligations for Location Accuracy processing.

If you're processing location data, you're under similar scrutiny. This guide provides a structured path to build defensible location data controls before a regulator comes knocking.

The Problem: Why This Matters Now

Location data is both highly useful and highly sensitive. It powers essential services while revealing patterns that regulators view as private. The DPC's investigation showed that Google's users couldn't understand how their location influenced ad targeting or profiling, leading to "a loss of control over their personal data."

Your organization faces similar risks if you're collecting location data through mobile apps, web services, delivery tracking, workforce management tools, or analytics platforms. Regulators are examining not just whether you have a privacy policy, but whether you can demonstrate compliance through documented controls, testing evidence, and retention enforcement.

What You Need Before Starting

Authority and Resources:

• An executive sponsor to enforce cross-functional changes
• Access to all systems collecting, processing, or storing location data
• Legal review capacity for consent language and data processing agreements
• Development resources to implement technical controls

Technical Prerequisites:

• Inventory of all location data collection points (mobile SDKs, web APIs, device settings, third-party integrations)
• Current data flow diagrams showing where location data moves after collection
• Existing retention policies and deletion procedures
• Authentication system capable of managing granular user preferences

Documentation Foundation:

• GDPR Article 30 Records of Processing Activities template
• Data Protection Impact Assessment framework
• Control testing protocols aligned with your compliance program

Step-by-Step Implementation

Week 1-2: Map Your Location Data Landscape

Start with a complete technical inventory. Run these queries against your systems:

For mobile applications:

• Review all SDK implementations requesting location permissions (iOS CoreLocation, Android Location API)
• Document permission request timing and justification text shown to users
• Identify background location access versus foreground-only

For web services:

• Audit JavaScript that calls Geolocation API
• Check server-side IP geolocation implementations
• Review analytics platforms (Google Analytics, Mixpanel, Amplitude) for location tracking configurations

For each collection point, document:

• Specific data elements collected (precise coordinates, city-level, IP-derived)
• Legal basis claimed (consent, legitimate interest, contractual necessity)
• Business purpose with specific use cases
• Retention period with justification
• Third parties receiving the data

Week 3-4: Build Transparency Controls

Create layered disclosure that meets GDPR Article 13 requirements:

First, implement just-in-time notices at the point of collection. When your app requests location permission, show:

• What you're collecting (precise location versus approximate)
• Why you need it (specific feature enablement)
• How long you'll keep it
• Who else will receive it
• Link to detailed privacy information

Second, build a preference center where users can view and control:

• Current location sharing status for each feature
• History of location data collection (dates, contexts)
• Download option for collected location data
• Granular opt-out controls per processing purpose

Don't bundle location consent with other permissions. The DPC found Google's approach violated fairness requirements by obscuring how location influenced ad targeting.

Week 5-6: Implement Accountability Controls

GDPR Article 5(2) requires you to demonstrate compliance, not just claim it. Build these evidence-generating controls:

Create automated logging for location data processing:

Log entry structure:
- Timestamp
- User ID
- Data subject consent status
- Processing purpose
- Legal basis applied
- Data minimization check result
- Retention rule applied

Implement control testing protocols:

• Monthly: Verify consent capture is functioning across all collection points
• Monthly: Test that opt-outs immediately stop processing
• Quarterly: Validate retention rules execute correctly
• Quarterly: Confirm third-party processors have current Data Processing Agreements

Document your compliance decisions. When you determine a processing activity is lawful, record:

• The legal basis assessment
• Alternatives considered
• Data minimization analysis
• Proportionality evaluation

This documentation proves accountability when regulators investigate.

Week 7-8: Enforce Retention Limits

Google's violation included retaining location data longer than necessary. Build automated enforcement:

Define retention periods tied to specific purposes:

• Navigation history: 30-90 days (long enough for trip disputes, short enough to limit exposure)
• Fraud detection: Match your fraud investigation window
• Analytics: Aggregate and anonymize after 12 months, delete raw coordinates

Implement automated deletion:

Retention enforcement logic:
1. Tag each location record with purpose and collection date
2. Schedule daily job checking records against retention policy
3. Hard delete expired records (overwrite, don't just mark deleted)
4. Log deletion execution with record counts
5. Generate monthly retention compliance report

For Location History-style features where users expect long-term storage, require explicit opt-in separate from general location permissions, and provide deletion tools with clear confirmation.

Week 9-10: Build Data Subject Rights Workflows

Create processes for GDPR Chapter III rights:

For access requests (Article 15):

• Automated export of all location data associated with user ID
• Human-readable format showing dates, coordinates, processing purposes
• Response within 30 days

For deletion requests (Article 17):

• Immediate cessation of processing
• Deletion from production systems within 7 days
• Deletion from backups at next backup rotation
• Confirmation notice to data subject

For objection requests (Article 21):

• Immediate opt-out from legitimate interest processing
• System flag preventing future processing
• Retention of minimal data needed to honor the objection

Week 11-12: Third-Party Processor Controls

If you share location data with advertising platforms, analytics vendors, or cloud processors:

Execute Data Processing Agreements covering:

• Specific processing instructions
• Security requirements
• Sub-processor restrictions
• Audit rights
• Breach notification timelines

Implement technical controls:

• API-level data minimization (send city instead of coordinates when precise location isn't necessary)
• Contractual prohibition on further sharing
• Quarterly compliance attestation from processors

Validation: How to Verify It Works

Run these tests before considering your controls operational:

User Perspective Testing:

• Create test account and trigger all location permission requests
• Verify disclosure language is clear and complete
• Confirm you can locate and modify all location preferences
• Test data download includes all collected location data
• Verify deletion request removes data within stated timeframe

Technical Control Testing:

• Submit location data with expired retention period, confirm automated deletion
• Revoke consent, verify immediate processing cessation
• Check logs confirm all processing has documented legal basis
• Audit third-party data transfers match Data Processing Agreements

Accountability Evidence Review:

• Assemble documentation for one location processing activity
• Verify you can demonstrate lawfulness, fairness, transparency
• Confirm control testing evidence exists for past 90 days

If you can't pass these tests, you can't demonstrate compliance.

Maintenance: Ongoing Tasks

Monthly:

• Review control testing results for consent capture, opt-out functionality, retention execution
• Check data subject rights request response times
• Verify third-party processors haven't added sub-processors without notice

Quarterly:

• Update Records of Processing Activities for any location data processing changes
• Re-assess legal basis for processing activities
• Audit sample of location data records for retention compliance
• Review and update transparency language for clarity

Annually:

• Conduct Data Protection Impact Assessment refresh
• Review and update retention periods based on business need changes
• Test disaster recovery procedures for location data
• Train engineering teams on location data handling requirements

Trigger-Based:

• New feature using location data: Complete mini-DPIA before launch
• New third-party integration: Execute Data Processing Agreement before data sharing
• Regulatory guidance update: Assess impact on current controls within 30 days

The Google fine shows that good intentions aren't enough for regulators. You need documented controls, testing evidence, and the ability to demonstrate compliance on demand. Build these systems now, before an inquiry starts.