When “Imprecise” is Precisely the Place to Be: NAI’s Detailed Guidance on Location Data

The alarm bells have been sounding about location tracking, and the state legislatures have been responding. Perhaps the loudest ringing in 2020 is from the Washington Privacy Act, the Senate and House versions of which are now being reconciled, but both of which count as sensitive data and require prior consent for the collection of geolocation information accurate to less than 1750 square feet. The Network Advertising Institute (“NAI”) just beat Washington’s legislature by updating its own much more nuanced guidance defining imprecise location data for targeted advertising or ad delivery and reporting for its members, exempting them from opt-in consent requirements if their geolocation achieves such imprecision.

The NAI guidance is important – not just for members – as the only comprehensive definition of precise location data now in effect in the United States. For example, despite referring to precise location as “sensitive,” the Federal Trade Commission (“FTC”) recognizes that the agency has not produced standards governing geolocation information. The FTC has historically called on all players in the mobile ecosystem to develop standards governing the collection, use, and disclosure of information “particularly for location data,” reinforcing the NAI guidance’s significance.

 

1. Three Paths to a Safe Harbor

 The guidance provides three safe harbors under which location data is always imprecise: (i) information that is a generic place name, (ii) sufficiently large geofences, and (iii) GPS coordinates with two or fewer decimals.

Perhaps limiting the safe harbors’ utility, the NAI opt-in consent rules apply when an organization receives location data. As such, members that collect precise location data that they subsequently render imprecise are nonetheless required to obtain users’ consent, although such rendering is undoubtedly helpful to downstream recipients and related contracting.

A. Stick to Generic or Ubiquitous Place Names

Location data is de facto imprecise if the data does not describe an actual physical location (e.g., a car dealership). Even if such information is based on precise latitude and longitude, rules governing precise location data do not apply if “general descriptors are saved instead of the latitude/longitude coordinate with seven decimals.” 

As is often critical for attribution analysis (among other uses), a place name that refers to many identifiable locations (e.g., Starbucks) is also imprecise. However, the guidelines draw a clear distinction between using imprecise data describing location at any of a chain’s stores (e.g., Home Depot) versus precise location data of a unique place name (e.g., “Mom and Pop Hardware”).

B. Expand Geofences

 Recording a specific place name that is sufficiently large is also not precise location data. As such, a circular geofence having a radius larger than 500 meters (785,398 square meters) is de facto imprecise.  An organization accordingly does not use precise location data when it collects and uses a consumer’s location at a large place, expressly included examples include Disney World or Central Park.  Even if using circular geofences is not feasible, geofences of any shape are not precise location data if their size is 800,000 square meters or greater.

C. Coordinates with Two or Fewer Decimal Places

Reflecting the NAI’s belief that a user’s location data within an area larger than 785,398 square meters is not precise, a GPS coordinate location with two or fewer decimal places is also rendered imprecise.

 

2. Where to Go if No Safe Harbor is Available

Even in the event that no safe harbor is available, the NAI provides a four factor test to determine whether location data if imprecise. We provide a chart below summarizing those factors.

Members who use location data that the member believes to be imprecise, but that do not fall within a safe harbor, should document an analysis that the location data is not precise. The NAI will consider that the member conducted a “reasonable analysis” relying on its four factors when reviewing a members’ use of location data.

Factor

Factors that Favor Finding that Information is Imprecise

 

Size of the Identified Location

GPS coordinates with fewer decimals or geofences with larger areas favor that data is not precise

 

The Population Density of the Location

Location data collected in a densely populated area is less identifying and therefore less precise

 

Location Accuracy

Location data with noise addition or that is otherwise inaccurate is less likely to be precise

 

Timestamp Accuracy

Information with a longer timestamp, such as a month or week, is less likely to be precise than information with a short timestamp such as a second

 

 

Check out our blog to stay en route to privacy compliance while innovating with information.

 

Latest Thinking

View more Insights
Insights Center
close
Loading...
Knowledge assets are defined in the study as confidential information critical to the development, performance and marketing of a company’s core business, other than personal information that would trigger notice requirements under law. For example,
The new study shows dramatic increases in threats and awareness of threats to these “crown jewels,” as well as dramatic improvements in addressing those threats by the highest performing organizations. Awareness of the risk to knowledge assets increased as more respondents acknowledged that their