Location & Geolocation
Access to the browser’s geolocation API and transmission of location data, especially before consent or inside authenticated areas.
Location is sensitive data.
Several state laws treat precise location as sensitive personal information. Collecting it without consent, or inside account pages, adds regulatory and interception exposure.
Context matters. A store locator a visitor chooses to use reads very differently from silent collection before any consent.
Location and geolocation tracking
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Location and geolocation tracking | High | May Affect Coverage |
| Location tracking within authenticated accounts | High | May Affect Coverage |
The site is observed accessing the browser’s geolocation API before consent or after a visitor rejects tracking.
Gate geolocation access behind the consent signal, disclose location collection with its purpose and recipients, and offer an opt-out from location-based advertising.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“How is visitor location used, and is it shared with third parties?”
“Gate geolocation behind consent and disclose it, verified by CyRisk rescan.”
Informs regulatory terms. Weigh more heavily when location is shared with data brokers.
Keep exploring.
Laws this exposure can trigger
Related exposure families
Is a store locator a problem?
Not usually, if the visitor chooses to use it after consent. Silent collection before consent is what raises exposure.
Why is location treated as sensitive?
Several state privacy laws classify precise location as sensitive personal information.
What if location goes to a data broker?
That raises the regulatory exposure. See Data Brokerage & Sharing.
Find out where visitor location goes.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.