How Geofencing Data Is Collected
Understanding geofencing privacy starts with understanding how location data may be collected and used. When a user downloads a mobile app and grants location permissions, an app SDK may collect location data. Data providers and programmatic platforms may process that data subject to the app's disclosures, the scope of permissions, provider practices, platform rules, and applicable law.
Location-data advertising may use a device ID, a pseudonymous advertising identifier, rather than a name, email address, phone number, or physical address in the advertiser interface. That distinction does not make the data anonymous or de-identified: device identifiers and location history can be linkable, and whether privacy requirements apply depends on the facts and data flows.
Permissions, Notice, and Data Controls
An app permission prompt is not a blanket authorization for every advertising use of location data. Before using location data, marketers should review the provider's documentation for the source of the data, user-facing notices, permissions and consent signals, opt-out handling, retention, onward transfers, and applicable platform requirements.
Provider descriptions or consent-management tools can help inform that review, but they do not themselves establish that a campaign is compliant. Campaign-specific review should account for the advertiser's and vendor's roles, the jurisdictions involved, and the particular audience and activation proposed.
CCPA/CPRA Considerations for Geofencing
CCPA/CPRA obligations can depend on the organization, the data involved, the parties' roles, and the campaign's data flows. Marketers should work with appropriate privacy and legal reviewers to determine applicable notice, choice, opt-out, contractual, and consumer-rights requirements, including how relevant preference signals are handled.
Do not treat a provider statement that it supports opt-out signals as a substitute for reviewing the campaign's own responsibilities and the provider relationship.
GDPR Considerations for Geofencing
For campaigns involving EU residents, the appropriate legal basis, notices, permissions, and vendor arrangements require campaign-specific review. A consent-management framework or a platform signal may be relevant, but it does not by itself establish that a particular use of location data is permitted.
Before activating a campaign, confirm with appropriate privacy and legal reviewers how the intended use, data source, jurisdiction, and platform rules affect the campaign. This site does not certify legal compliance.
Sensitive Location Categories
Location associated with healthcare facilities, religious institutions, political organizations, and reproductive healthcare can present heightened privacy and policy concerns. Marketers should not use visits to hospitals, clinics, mental health providers, addiction treatment centers, pharmacies, patient parking, or other care areas to create advertising audiences, retargeting triggers, or health-service conversion zones.
Do not use patient, clinical, appointment, injury, condition, or procedure information; healthcare-derived household or cross-device activation; or health-linked household expansion. For healthcare-related outreach, use alternatives that do not identify people through health visits or infer health, such as contextual placements, broad community outreach, professional events, education, referral awareness, or employer-owned channels. Review applicable platform policies for all sensitive categories.
Privacy Review Practices
For each proposed campaign, document the intended audience, data source, permissions and notices, vendor roles, opt-out handling, retention, transfers, jurisdictions, and platform rules. Use only the data necessary for the defined purpose, avoid sensitive-location and health-linked targeting, and reassess practices when the campaign or data supply changes.
Healthcare campaigns require campaign-specific review of data, vendor roles, permissions, state law, and platform rules. The site does not certify legal compliance.
