Location Data Sales Face New Limits: What It Means for You

Since August 1, 2026, registered data brokers in California have been required to process deletion requests that residents file through the state's DROP tool, and Maryland, Oregon and Virginia now bar covered businesses from selling residents' precise location data. For you, where you live now decides what happens to the location data apps collect: in those three states companies above a size threshold cannot sell your precise location, in California you can ask more than 600 brokers to delete it, and elsewhere your levers are phone settings and broker opt-outs. This is the picture as of October 20, 2026.

Key takeaways

California's DROP has accepted requests since January 1, 2026; brokers had to start processing them on August 1, 2026, and must re-check at least every 45 days.
Maryland (law effective October 1, 2025, applying to processing from April 1, 2026), Oregon (since January 1, 2026) and Virginia bar the sale of precise location, defined in all three as accurate to within 1,750 feet, by businesses above each state's size threshold.
The FTC's location-data orders bind only the companies they name, and the FTC still listed the Kochava case as pending at its last update, June 26, 2026.
Turning off Precise Location or deleting your advertising ID limits what apps collect from now on; it does not pull back data a broker already holds.

What it means for you

Californians: one DROP request goes to all registered brokers; see "How DROP works for Californians".
Residents of Maryland, Oregon or Virginia: businesses that meet the state's size threshold may not sell your precise location; see "State laws that ban location sales" for the conditions.
Everyone else in the US: the FTC orders (named companies only), phone settings and broker opt-outs are what you have; see "Reducing your exposure".
Parents of teens: Oregon bans selling the personal data of anyone under 16, and a California parent can file a DROP request on a child's behalf.

Where location data goes next

The California Privacy Protection Agency's registry page describes a data broker as a business that collects personal information about consumers from various sources and sells it. An app can sell or license the location it collects, or embed a software development kit (SDK), a block of third-party code, that passes location to the SDK's owner.

The FTC's InMarket case shows the second route: the agency's January 2024 announcement required InMarket to check that apps supplying location through its SDK obtained informed consent, and to stop using the data if they did not. What happens to the data afterward is governed by the orders and laws below.

What the FTC orders ban

Each FTC order applies only to the company named in it.

Company	Order date	Main restriction
X-Mode Social / Outlogic	Proposed Jan. 9, 2024; final Apr. 12, 2024	No sharing or selling of sensitive location data; delete earlier location data unless consumers consent or it is de-identified or made non-sensitive
InMarket	Proposed Jan. 18, 2024; final May 1, 2024	No selling, sharing or licensing of any precise location data; an easy way to withdraw consent
Gravy Analytics / Venntel	Final Jan. 14, 2025	No selling, disclosing or using sensitive location data, except in limited national security and law enforcement cases
Mobilewalla	Final Jan. 14, 2025	No using, selling or disclosing location data from sensitive places; limits on collecting data from ad auctions
Kochava / Collective Data Solutions	Settlement announced May 4, 2026; case listed as pending	No selling or sharing of sensitive location data unless the consumer gives affirmative express consent and the data provides a service the consumer asked for

What counts as sensitive differs by order. The X-Mode release gives medical and reproductive health clinics, places of worship and domestic abuse shelters as examples. The Mobilewalla release adds correctional facilities, labor union offices, LGBTQ+-related locations, political gatherings and military installations. Several orders also require the company to keep its own list of sensitive locations.

Kochava, sued in August 2022 over data the FTC said tracked people at health facilities and places of worship, is still open. The FTC says the settlement takes effect once the District of Idaho judge approves and signs it, and its case page, last updated June 26, 2026, lists the case as pending, with a stipulated order filed that day. Some of the order's programs, such as the sensitive-location list and checks on data suppliers, bind Kochava only if it sells or uses precise location data. Its subsidiary, which took over the data broker business, must meet them regardless.

State laws that ban location sales

These laws regulate sale, not every use. They protect each state's residents, apply only to businesses above a size threshold, and do not stop you sharing location with an app you choose. This is general information, not legal advice.

State	What the law says	Who it covers	When
Maryland	A controller may not sell sensitive data, which includes precise geolocation and data of a consumer it knows or has reason to know is a child	Data of 35,000+ consumers, or 10,000+ with over 20% of revenue from selling data	Effective Oct. 1, 2025; applies to processing from Apr. 1, 2026
Oregon	Businesses may not sell any consumer's precise geolocation data, past or present, or the personal data of anyone under 16	Data of 100,000+ Oregonians, or 25,000+ with at least 25% of revenue from selling data	Jan. 1, 2026
Virginia	Controllers must "not sell or offer for sale precise geolocation data" concerning a consumer; there is no consent exception	Data of 100,000+ consumers, or 25,000+ with over 50% of revenue from selling data	In the Code as of October 2026 (added by a 2026 amendment)

Maryland also bars collecting, processing or sharing sensitive data unless strictly necessary for a product or service the consumer requested. Virginia still lets a business process precise location with your consent; it just cannot sell it. Some sectors are carved out: Oregon's law does not apply to banks, credit unions and insurers, and Virginia's excludes financial institutions covered by the federal Gramm-Leach-Bliley Act and HIPAA-covered health entities.

Oregon's rules come from the state Department of Justice's consumer FAQ; its business guidance notes exceptions to "sale" in ORS 646A.570(17)(b) without listing them.

How DROP works for Californians

DROP is the Delete Request and Opt-out Platform run by the California Privacy Protection Agency under the Delete Act (Senate Bill 362, 2023). One request asks registered data brokers to delete "all non-exempt personal information" related to you. The state's consumer page says the request is free, reaches over 600 registered brokers, and is open to California residents, including on behalf of another resident such as a child or an elderly relative.

Date	Milestone
Jan. 1, 2026	Residents can submit requests
Aug. 1, 2026	Brokers start processing, then must access DROP and delete new matches at least every 45 days
Nov. 2026	All brokers expected to have finished their first download and upload cycle

Status updates can take up to 90 days to appear, and timing varies by broker. Three limits matter for location. DROP reaches only brokers active in it, so an unregistered company does not receive your request. First-party data, meaning data you gave a business directly, which can include location you let its own app collect, is not deleted, and neither is publicly available data. And brokers may keep data covered by a legal exemption. Deletion may reduce targeted ads, the state says, but less spam is not guaranteed. The registry can be filtered by data category, including precise geolocation, so you can see which brokers say they collect it.

Reducing your exposure

On iPhone (Settings, Privacy & Security, Location Services) and Android (App info, Permissions, Location), you can turn off precise location app by app, which on Android limits the app to an area of about 3 square kilometers. You can also delete or reset the Android advertising ID under Settings, Privacy, Ads (apps then receive zeros), or stop iPhone apps from asking to track you under Settings, Privacy & Security, Tracking.

Outside California, opt-outs are broker by broker. Oregon's DOJ says brokers must register with the state's Department of Business and Consumer Services, and that registry shows whether you can opt out of a broker's collection and sale of your data and how to ask. California's registry lists contact details and request metrics for each broker.

Frequently asked questions

Do I need an account to use DROP?

No. You don't need a California Identity Gateway account; you enter basic details to confirm you are a California resident, or sign in with Login.gov if you already use it.

Can I add my phone's advertising ID to DROP?

Yes, optionally. The state's identifier guide lets you add an Android phone's Mobile Advertising ID and says extra identifiers can help a broker find and delete your information. Apple does not show the iPhone's ID (IDFA) on screen, so iPhone users have none to enter. A reset gives you a new ID, so copy the old one into DROP first.

Does approximate location fall under these bans?

On its face, no. A 1,750-foot radius covers about 0.89 square kilometers, while Android's approximate location covers about 3 square kilometers, roughly 3.4 times larger. Data that coarse does not meet the "precise" definition in Maryland, Oregon or Virginia, so those bans do not stop its sale, though other rules in each law may still apply.

Is every transfer of location data a "sale"?

No. Virginia defines a sale as an exchange for money, while Maryland also counts other valuable consideration. Both exclude disclosures to a company processing data on the business's behalf, to an affiliate, to provide a product or service you requested, and in a merger or bankruptcy.

Has Kochava been barred from selling location data?

Not confirmed. The May 4, 2026 settlement takes effect only when the Idaho federal judge signs it, and the FTC's case page still listed the case as pending at its June 26, 2026 update.

A ten-minute checklist

If you live in California, file a DROP request; on Android, add your advertising ID before you reset it. Check back for status updates over the next 90 days.
Then apply the two phone settings described under "Reducing your exposure".
Filter California's broker registry by precise geolocation to see which brokers say they collect it.
If you live in Oregon, search the state broker registry and use any opt-out it lists.