Your Location History Is a Product, and a Few Rules Are Finally Letting You See the Shelf

There is an entire industry most people have never knowingly interacted with, and its product is them. Data brokers assemble profiles from a thousand small leaks — apps that phone home with location, loyalty schemes, public records, the invisible auctions that run every time an ad loads — and sell the result: where a person goes, what they buy, what they might be worried about. Location data is the crown jewel of this trade because a month of someone's movements reveals their home, their work, their doctor, their place of worship and their habits without a single word of stated intent. The person profiled is not the customer; they are the inventory. What has changed is not that the trade stopped but that it has become visible and, in places, controllable. A set of privacy rules now gives individuals concrete levers: the right to ask what data is held, the right to have it deleted, the right to say the data must not be sold, and in some markets a single signal — a browser or device setting — that communicates that refusal automatically to everyone who would otherwise sell it. Enforcement has begun to focus specifically on location data and on the brokers who deal in it, treating precise movement history as the sensitive category it always was rather than as ordinary exhaust. For an individual the practical controls are more real than they were, even if they remain more effort than they should be. Reviewing which apps have background location permission and revoking it from the ones with no reason to need it cuts the supply at the source; the platform advertising-identifier reset and opt-out limits how easily the pieces are joined; and where a universal opt-out signal is honoured, turning it on speaks the refusal once instead of site by site. None of this is complete, and much of the collection continues, but the difference between a person who has taken these steps and one who has not is substantial. The part businesses miss is that they are frequently on the supply side without meaning to be. An app that embeds a third-party advertising or analytics kit may be shipping its users' location into exactly this market, which is now not only a reputational hazard but, under the new rules, a compliance one — you can be responsible for a sale you did not know your own software was making. The sensible response is to audit what every embedded component actually transmits, strip the location and identifiers that the product does not genuinely need, and be able to state plainly what leaves the app and to whom. The trade in location is decades old; the novelty is that both the person and the business finally have reasons, and tools, to look at the shelf they are on.