Kevinish

Should location privacy violations trigger automatic independent audits?

A regulator cannot verify a fix from a press release. The FTC has required companies to obtain [independent audits every other year for 20 years](https://WWW.FTC.GOV/news-events/news/press-releases/2011/06/ftc-approves-final-orders-settling-charges-companies-failed-protect-consumers-personal-information) in security orders. Location data is sensitive and easy to copy, so an automatic audit after a proven violation gives the public a baseline guarantee that deletion, consent, and retention controls actually work.