The most important question in 2026 mobility procurement is no longer "how many devices are in the panel?" It is what data is intentionally excluded before the feed reaches you. FTC orders against location-data companies changed the buyer baseline: sensitive-place categories, weak consent chains, historical deletion obligations, and unclear downstream uses belong in the first diligence packet, not the final redline. Buyers evaluating Global Mobility and Location Data, POI and geofencing, or audience targeting should treat sensitive-location controls as a product requirement. Pair with FTC location data enforcement, data brokers post-FTC consent orders, and the geo-panel audit.
Privacy, security, and procurement should share one mobility intake form: intended use, maximum precision, retention, activation partners, and countries. Divergent forms produce divergent risk postures: legal approves aggregate measurement while marketing licenses device-level activation from the same vendor without a second review. A single intake form forces explicit tradeoffs before budget is committed.
Board-ready reporting should describe exclusions in plain language: which venue categories never appear at device level, which geographies are out of scope, and maximum retention: rather than linking only to a vendor PDF. Directors and general counsel increasingly ask direct questions after public enforcement headlines; the checklist is your answer script.
Sensitive location data generally means precise location information that can reveal visits to medical facilities, reproductive-health clinics, religious institutions, domestic-violence shelters, correctional facilities, military sites, and other high-inference venues. The exact category list should be defined in the vendor control framework and your contract. The FTC X-Mode / Outlogic order names the risk pattern: location traces can reveal intimate facts even when identifiers are pseudonymous.
The buyer-safe frame is not "we do not use names." It is: we do not receive or activate device-level traces tied to sensitive venues, and any aggregate insight is governed by documented suppression and use limits.
Procurement should distinguish collection-time exclusions from delivery-time exclusions from activation-time exclusions. A vendor may exclude sensitive venues in the warehouse but still expose raw traces in a pilot bucket. Ask for architecture diagrams that show where filters run and who can change them without buyer approval.
Request a redacted sample of exclusion QA, not a policy PDF alone. Buyers should see evidence that exclusions run before delivery, not only in the activation UI.
Include bidstream and SDK inventory in the same diligence packet when vendors blend supply types. Bidstream diligence and mobility diligence are not interchangeable: field lists and consent artifacts differ materially.
The DPA and order form should define prohibited uses, venue exclusions, retention limits, audit rights, subprocessor notice, and source-removal steps. For higher-risk use cases, require written approval before combining mobility with identity graphs, CTV/ACR, or CRM segments, especially for audience targeting and cross-channel measurement where the same join can be safe in aggregate and risky at device level.
Use the NIST Privacy Framework to map identify, govern, control, communicate, and protect activities across procurement, security, and privacy teams.
Indemnity and audit clauses should reference sensitive-location representations explicitly. If the vendor warrants exclusions but cannot demonstrate QA, negotiate cure periods and termination rights tied to evidence failure, not only to data latency SLAs.
Use the enterprise data pilot checklist and RFP scoring matrix so legal, data science, and finance score the same evidence.
Pilot analysts should attempt a prohibited join on paper: for example, device-level activation near healthcare corridors, and confirm controls block it in the pilot environment. If the join succeeds in pilot, assume production risk until engineering certifies otherwise.
U.S. state data-broker registration regimes increasingly intersect with location-data procurement. Align vendor posture with state data broker registration diligence and published registrations on /trust/data-broker-registrations. Schedule quarterly re-certification when source paths, fields, or permitted uses change: treat it like SOC evidence, not a one-time legal review.
GSDSI documents sensitive-place controls and consent posture in privacy policy and sourcing methodology materials buyers can attach to security packets before pilot transfer.
Privacy engineering should test re-identification risk on sparse cohorts even when the vendor labels outputs "aggregate." A heat map with five devices in a census block is not safe for publication. Require minimum thresholds in the contract and verify them on delivered files, not only in the UI.
Marketing and analytics leads must align on activation boundaries before legal review finishes. Teams that license mobility for site selection sometimes repurpose the same feed for audience extension without a new permitted-use analysis. Build a use-case registry tied to each licensed table and review it quarterly.
Incident response should include a play for source takedown: what gets deleted in the warehouse, what happens to models trained on the feed, and how downstream partners are notified. FTC orders made deletion propagation operational, not theoretical. Buyers should demand runbooks, not promises.
Provide leadership a one-page summary: what is excluded, what is never collected, maximum retention, and prohibited joins. Executives approve budgets faster when risk is concrete, "no device-level healthcare visits" beats "privacy compliant."
Revisit the summary when vendors add sources or fields. A static 2024 legal memo does not cover a 2026 feed with new SDK partners.
Train media and analytics buyers on the difference between measurement aggregates and activation segments: the same vendor contract often allows the former while prohibiting the latter. Lunch-and-learns with legal reduce mid-campaign surprises when a segment builder exposes device paths the DPA forbade.
Log every exception approval with use case, geography, and retention. Exception logs become your best defense in diligence and your best signal for when to renegotiate: clusters of exceptions mean the standard contract no longer fits the business.
CISOs should ask for penetration-test results on vendor APIs that deliver mobility, not only SOC 2 Type II summaries. Delivery security and collection compliance are related but distinct: both belong in the checklist before production keys are issued. Include subprocessor lists and breach-notification timelines in the same packet. Ask whether the vendor will notify you within seventy-two hours if a source partner revokes consent affecting your production feed, and require that commitment in the DPA exhibit.