On February 21, 2025, representatives in the California legislature introduced California Assembly Bill 1355, also known as the California Location Privacy Act (“AB 1355”).  AB 1355 seeks to amend the California Consumer Privacy Act (the “CCPA”) by imposing several new restrictions on the collection and use of consumer location data. 

Under AB 1355, “location data” means device information that reveals, directly or indirectly, where a person or device is or has been within the State of California, with precision sufficient to identify the street-level location of such person or device within a range of five miles or less.  AB 1355 provides examples including, but not limited to:

  • An IP address capable of revealing the physical or geographical location of an individual;
  • GPS coordinates;
  • Cell-site location information;
  • Information captured by an automated license plate recognition system that could be used to identify the specific location of an automobile at a point in time;
  • Information or image captured by a speed safety system or other traffic monitoring system that could be used to identify the specific location of an automobile at a point in time; and
  • A video or photographic image that is used as a probe image in a facial recognition technology system that could be used to identify the specific location of an individual at a point in time.

AB 1355 would impose the following restrictions on this broad category of location data:

  • Opt-In Consent:  Prior to collecting or using an individual’s location data, a covered entity would be required to obtain the individual’s express opt-in consent to collect and use their location data for the purpose of providing the goods or services requested.
  • Restrictions on Use & Disclosure:  Even if consent is collected, covered entities would be prohibited from (i) collecting more precise location data than necessary to provide the goods or services requested, (ii) retaining location data for longer than necessary to provide the goods or services requested, (iii) selling, renting, trading, or leasing location data to third parties, (iv) deriving or inferring from location data any information that is not necessary to provide the goods or services requested, or (v) disclosing the location data to any government agency without a valid court order.  The intent of these restrictions is to create “no-go zones” where data revealing visits to certain locations, such as reproductive health clinics or places of worship, cannot be used for discriminatory or otherwise improper or unlawful purposes.
  • Location Privacy Policy:  A covered entity would be required to maintain a “location privacy policy” that is presented to consumers at the point of collecting such location information.  The location privacy policy would be required to include, among other things, (i) the type of location data collected, (ii) the disclosures required to provide the requested goods or services, (iii) the identities of service providers and third parties to whom the location data is disclosed or could be disclosed, (iv) whether the location data is used for targeted advertising, and (v) the data security, retention, and deletion policies.
  • Changes to Location Privacy Policy:  A covered entity would be required to provide notice of any change to its location privacy policy at least twenty (20) business days in advance.
  • Enforcement & Penalties:  The California Attorney General, along with district attorneys, would be able to bring a civil action against a covered entity for violations of AB 1355, which may result in a civil penalty up to $25,000 per offense.

These proposed changes that are similar to the approach to consumer location data already adopted under Maryland’s Online Data Privacy Act, which takes effect October 1, 2025.  If enacted, AB 1355, however, would represent a significant departure from the opt-out framework currently set forth under California law under the CCPA, where businesses can generally sell and share sensitive personal information, such as geolocation information, unless the person opts out and directs the business to limit its usage.