U.S. privacy settlements often require an outside assessment every other year for 20 years, but those obligations are negotiated after an investigation. Making audits automatic after a proven location-privacy violation could create consistency, while also imposing the same long-term remedy on incidents of very different scale and intent.
Sources
Consistency matters. Marriott's order followed breaches affecting more than 344 million customers and imposed 20 years of obligations, while location-data cases can receive a different mix of remedies. A statute could require an initial audit for every violation, then scale the frequency and duration to severity and repeat conduct.
A regulator cannot verify a fix from a press release. The FTC has required companies to obtain independent audits every other year for 20 years in security orders. Location data is sensitive and easy to copy, so an automatic audit after a proven violation gives the public a baseline guarantee that deletion, consent, and retention controls actually work.
Independence on paper does not guarantee useful scrutiny. Companies choose and pay many auditors, and a standard checklist can miss how data really moves. Before making audits automatic, define auditor conflicts, publish meaningful findings, and allow shorter terms for prompt self-reporting. Otherwise we create compliance theater at a cost smaller firms cannot absorb.
Automatic remedies ignore the facts. A one-time vendor configuration error should not trigger the same 20-year burden as deliberate sale of clinic visits. The Outlogic order required deletion, consent, a sensitive-location list, and a privacy program tailored to the conduct. Regulators need room to choose the remedy that closes the actual gap.