GDPR and Phone Location: What Consent Really Requires
Under the GDPR, a person's location is personal data, and processing it needs a lawful basis. For locating an individual's phone, that basis is consent, and the GDPR sets a high bar: consent must be freely given, specific, informed, and unambiguous, and it can be withdrawn at any time. A service that asks the holder to actively agree before showing any location is built to meet that standard.
The GDPR governs how anyone in the EU and UK handles personal data, and location counts. That does not make locating a phone illegal, it makes the manner of it decisive. Get consent right and you are compliant; skip it and you are not.
The four qualities of valid consent
The GDPR says consent must be freely given, meaning no coercion; specific, meaning tied to this purpose; informed, meaning the person knows what they are agreeing to; and unambiguous, meaning a clear affirmative action. A pre-ticked box or buried clause does not qualify. Tapping a plain-language link that says a location has been requested does.
Consent must also be as easy to withdraw as to give. In a consent-based location flow, that is inherent: the person shares a single location by tapping, and there is no standing permission left running afterward.
Data minimisation matters too
Beyond consent, the GDPR expects you to collect only what you need. A single, purpose-specific location shared once is far more defensible than continuous background tracking. The narrow scope is a feature, not a limitation.
Frequently asked questions
- Is locating a phone a GDPR violation?
- Not if it is done with valid consent. Location is personal data, and consent is a lawful basis for processing it. Covert location without consent would be a violation.
- Can consent be withdrawn?
- Yes, and it must be easy to withdraw. In a consent-based location flow there is no ongoing permission to withdraw, because each location is shared once, deliberately.
- Does the GDPR apply outside the EU?
- It applies to processing the personal data of people in the EU and UK, regardless of where the service is based. Similar consent principles apply under many other privacy laws.
Locate a phone with their consent
Enter a number, they approve by a tap, and you see the location on a live map. No app to install.
Locate a phone