This could be the first state to ban selling cell phone location data

Some 250 years after the Sons of Liberty threw chests of tea into the Boston Harbor, the State of Massachusetts could be about to lead the nation in a different sort of revolution.

Lawmakers in the state are considering a bill that would place a virtual total ban on the selling or buying (or renting or trading) of location data from any consumer’s mobile device. Additionally, law-enforcement agencies would need to obtain a warrant to access the information.

If passed, the bill would make Massachusetts the first state to completely ban the sale of this sort of data. Other states that have attempted to regulate the use of that data have required data brokers to obtain a consumer’s consent and only restricted data sales. Democrats have a supermajority in both the state’s House and Senate, and the bill is likely to become law.

The emphasis on digital privacy comes, in part, as a result of last year’s Supreme Court decision that overturned Roe v. Wade. Advocacy groups, led by the American Civil Liberties Union (ACLU) in Massachusetts, began pushing for the data restrictions last month, endorsing the passage of a bill called the Location Shield Act (H.357|S.148).

The shield would apply to any individual within the state, whether they are residents or not. That’s a critical component, since Massachusetts is a safe haven state for both those seeking an abortion and those receiving gender-affirming care. Out-of-state patients who travel to Massachusetts for care sometimes unwittingly leave digital footprints that can be used against them, since HIPAA medical privacy laws do not apply to apps.

Politicians and law-enforcement officials would not be able to track user data once someone crosses over the Massachusetts state line without a warrant or unless in response to a reported imminent threat to human life.

Should the bill pass, an app provider that did not comply would be subject to both legal action from the Massachusetts Attorney General and at risk of a civil suit from the individual.

Location data is generally collected by apps and services, though the amount of data varies from company to company. For the most part, it doesn’t include a consumer’s name or phone number, but despite that, there’s often enough information in the movement patterns to determine the identity of the owner.

Many apps then sell that information to data brokers, which has led to the location intelligence market becoming a $16 billion industry last year. It’s a controversial one, as you might expect, giving people the ability to track everything from military officials with security clearances to law enforcement officials taking their children to school. A New York Times special report on data tracking in 2019 noted, “Watching dots move across a map sometimes revealed hints of faltering marriages, evidence of drug addiction, records of visits to psychological facilities.”

It hasn’t gone unnoticed by the Federal Trade Commission (FTC), either. Last August, the FTC sued data broker Kochava, which lists Disney, McDonald’s, and Hilton among its clients, accusing it of selling location data that could identify people seeking an abortion. (The company responded to the suit by accusing the FTC of “flamboyant press releases and frivolous litigation.”)

The Massachusetts bill would make tracking both patients and anyone worried about possible harassment considerably harder—at least in the 10,551 square miles within the state’s borders.