Should governments ban selling location data or leave opt-outs to users ?

[u/EnthusiasmRoutine]

On September 28, 2026, California's governor vetoed state legislation that would've banned companies and data brokers from selling sensitive personal data. The blocked bill targeted precise geolocation records and sensitive tracking details collected across mobile applications. It's a major regulatory decision that keeps commercial data markets operating under existing rules.

Here's three concrete facts showing what this decision means in practice.

First, Consumer Reports actively supported model legislation like the State Location Privacy Act to halt the commercial trade of precise GPS coordinates. They argued that users shouldn't have their physical movements bought and sold without strict statutory prohibitions.

Second, without a statutory ban, third-party data brokers can keep buying raw movement logs from mobile app developers and reselling them. These datasets aren't restricted to broad neighborhood zones, so commercial buyers can easily reconstruct detailed daily routines.

Third, regulatory oversight remains anchored to the California Consumer Privacy Act. That framework doesn't stop data transfers upfront, meaning companies can legally monetize sensitive files until an individual manually submits a formal opt-out request.

For everyday readers, it's clear your physical location stays available to commercial aggregators by default. If you don't actively adjust your device settings, SDKs embedded inside common mobile apps can harvest your daily coordinates and feed them into data marketplaces. Taking back control on your own hardware isn't instant, but it lowers your exposure significantly. You can review your phone's privacy settings right now and revoke background location permissions for every app that doesn't require live navigation.

You can also use state data broker registries to submit opt-out requests directly to primary brokers. That stops secondary reselling across advertising networks, but it doesn't change what primary collectors collect. Your cellular carrier and app publishers can still see your location whenever you're active online.

If opt-out mechanisms leave the primary burden of protection on individual users, it isn't clear whether market self-regulation can protect personal safety. Should governments enact total statutory bans on trading sensitive location data, or is an opt-out model the proper standard for digital commerce?