Precise location histories can reveal visits to clinics, places of worship, and shelters. Regulators have ordered data deletion and sales bans, while other consumer-protection cases show that large-scale refunds are possible; the unresolved question is when misuse should automatically create a right to payment.
Deletion stops future use, but it does not repay someone whose movements were already sold. In the Outlogic case, the FTC said raw location data tied to mobile advertising IDs could expose visits to clinics, houses of worship, and domestic-abuse shelters. A statutory payment would give companies a reason to minimize collection before the harm becomes impossible to reverse.
Corporate fines are priced in; customer payments are not. When a data broker gets caught selling location histories, the penalty goes to the government and the company treats it as the cost of a profitable quarter. The users whose clinic visits were sold get a press release. A mandatory payment flips the incentive: every record collected becomes a potential liability owed to a real person, which makes the CFO ask whether hoarding location data is worth it. The FTC's Outlogic order banned sales and ordered deletion, but deletion after the sale is closing the barn door. Payment prices the harm at the point of collection, before the harm happens. Companies respond to liabilities on the balance sheet faster than to lectures in consent decrees. If we want less location harvesting, make each harvested record expensive.
Consumer compensation is administratively possible. The FTC's Epic Games order created a $245 million refund pool, the agency's largest gaming refund. Location cases will need a different formula, perhaps a base amount plus more for sensitive places, but “hard to calculate” should not mean the entire value of misuse stays with the company.
The reason location misuse keeps happening is that each victim's harm is too small to sue over and too personal to ignore. No one hires a lawyer because a broker sold their grocery-store trips for fractions of a cent, so the broker keeps selling millions of them. This is the classic collective-action problem, and the law already solved it elsewhere: wage-and-hour statutes let workers recover small underpayments automatically because the legislature knew nobody sues over $40. Location privacy needs the same machinery. The Supreme Court recognized in Carpenter that movement records paint an intimate portrait of a life. Oyez. A statutory payment turns millions of individually un-sueable violations into one enforceable obligation, which is the only scale that matches how the data was taken: in bulk, automatically, without asking. Individual lawsuits were never going to fix bulk surveillance. Aggregated payment can.
Location data is not like other data. In Carpenter v. United States, the Supreme Court recognized that a detailed record of someone's movements reveals an all-encompassing picture of their life: the clinic, the protest, the place of worship. Oyez. When a data broker sells that history, the harm already happened; deleting it afterward is like returning a stolen diary after reading it aloud. Payment is the only remedy that acknowledges the violation was personal. The FTC's action against Outlogic, formerly X-Mode, showed brokers were selling raw location tied to ad IDs that could expose visits to sensitive places. FTC coverage. If companies must pay the people they tracked, the business model of bulk location sale collapses, which is precisely the point.
Not every location violation creates the same risk. A poorly worded consent screen is different from selling identifiable visits to a shelter. A flat payout could encourage nuisance claims while underpaying the worst cases. Regulators should keep the ability to choose refunds, as they did in the $245 million Epic order, rather than make one remedy mandatory.
Automatic checks to everyone sound fair until most payments are tiny and the claims process consumes the fund. In the Outlogic settlement, the strongest remedies were a sales ban, deletion, consent, and a privacy program. Those measures attack the data pipeline itself. Compensation should be reserved for people who can show concrete loss or unusually sensitive exposure.
I build apps that use location for legitimate reasons: transit directions, weather alerts, finding a nearby pharmacy. If every misuse allegation triggers automatic payouts, the rational move for a small developer is to strip location features entirely or geo-fence only the biggest markets where legal budgets exist. The FTC's Outlogic settlement chose the smarter path: ban the sale, mandate deletion, require real consent, and put the company under orders. FTC coverage. Those remedies actually stop the conduct. Automatic checks, by contrast, mostly enrich claims administrators while users get $1.87 and a privacy notice. Punish the brokers who sell, fix the consent screens, and leave the weather app alone.