Sensitive Location Data Checklist for Buyers

The most important question in 2026 mobility procurement is no longer "how many devices are in the panel?" It is what data is intentionally excluded before the feed reaches you. FTC orders against location-data companies changed the buyer baseline: sensitive-place categories, weak consent chains, historical deletion obligations, and unclear downstream uses now belong in the first diligence packet, not the final redline. Buyers evaluating Global Mobility and Location Data, POI and geofencing, or audience activation should treat sensitive-location controls as a product requirement. Pair this checklist with FTC location data enforcement, data brokers post-FTC consent orders, and the 2026 geo-panel audit.

What Counts as Sensitive Location Data

Sensitive location data generally means precise location information that can reveal visits to places such as medical facilities, reproductive-health clinics, religious institutions, domestic-violence shelters, correctional facilities, military sites, and other venues where inference risk is high. The exact category list should be defined in the vendor's control framework and your contract. The FTC X-Mode / Outlogic order and related location-data enforcement actions are useful primary sources because they name the risk pattern clearly: location traces can reveal intimate facts even when identifiers are pseudonymous.

The buyer-safe frame is not "we do not use names." It is: we do not receive or activate device-level traces tied to sensitive venues, and any aggregate insight is governed by documented suppression and use limits.

Evidence to Request Before a Pilot

• Source inventory: collection paths, SDK partners or supply types, and whether bidstream data is present.
• Consent artifacts: examples of notices and choices shown at collection, plus the date they were last reviewed.
• Sensitive-place taxonomy: venue categories excluded, POI provider used, polygon QA process, and exception handling.
• Suppression policy: minimum device counts, minimum household counts, and rules for small geographies or narrow segments.
• Deletion propagation: how source opt-outs, revoked consent, and vendor deletion obligations flow into your delivered files.

Contract Controls That Matter

The DPA and order form should do more than say "privacy compliant." They should define prohibited uses, venue exclusions, retention limits, audit rights, subprocessor notice, security controls, and the steps taken when a source is removed. For higher-risk use cases, add a control that requires written approval before combining mobility data with identity graphs, CTV/ACR, or CRM segments. This is especially important for audience targeting and cross-channel measurement, where the same technical join can be benign in aggregate reporting and risky in individual-level activation.

Use the NIST Privacy Framework as a neutral vocabulary for mapping identify, govern, control, communicate, and protect activities. It will not answer every legal question, but it helps procurement, security, and privacy teams score evidence consistently.

Pilot Design for Sensitive-Location Use Cases

1. Pre-register the intended use: site selection, measurement, market research, or activation.
2. Use sample geographies that include edge cases such as dense urban trade areas, malls, airports, and healthcare corridors.
3. Inspect exclusions by category before model testing so lift does not hide policy failure.
4. Require delivery in a clean workspace or secure bucket with limited retention and access logging.
5. Document how pilot outputs will be deleted or converted into production tables after the test.

For a broader procurement flow, use the enterprise data pilot checklist and RFP scoring matrix so legal review, data science validation, and finance scoring happen against the same facts.