Location makes ads more relevant (the nearest shop, the service in my area), but it is also sensitive data. The more precise and continuous, the more care it demands. It pays to use only the precision needed, with adequate consent, and to know the limits that platforms and the law impose.
The essentials in a definition
Location data in ads lets you show messages to those in an area or searching nearby, and measure visits. They are sensitive from a privacy standpoint, because they reveal habits and routines. The ePrivacy Directive requires consent to process location data in certain cases, the GDPR sets principles, and EDPB guidelines help interpret. Precision should be proportionate to the objective.
Types of location
There is declared location (a city or postcode the person states), inferred (from the network address or the search) and precise (phone GPS, with permission). Each type has different levels of precision, risk and legal requirements.
Many campaigns only need precision at area level.
Legitimate uses in ads
Targeting by region, radius around a shop, showing the nearest branch, adapting lead times and prices to the area, measuring store visits. Precision should match the purpose: to find the nearest shop, the area is enough; for a home service, it may be the address, supplied by the customer.
Avoid targeting locations that reveal sensitive data (hospitals, places of worship, clinics).
Using location proportionately
- Choose the minimum precision needed
- Avoid sensitive places in targeting
- Explain and ask for consent where required
- Do not keep unnecessary history
Consent and transparency
Precise location in apps requires the user’s permission. On sites, use for personalised advertising may require consent. Explain simply what you use location for and allow refusal without losing the essentials of the service. Respect ad platforms’ rules on sensitive categories and places.
Do not reuse location data for different purposes.
Knowing where someone is is always more than knowing where they live; use only what you need.
Good practice
Use the lowest precision and shortest duration that meet the objective. Avoid storing location history associated with people. Review suppliers and integrations that collect location. Document the purpose and legal basis. Check with whoever handles data protection.
Review geographic campaigns to ensure they do not improperly exclude or discriminate.
Decision table
| Use | Precision needed | Caution |
|---|---|---|
| Ads by city or region | Low | Lower risk; usually enough |
| Ads by radius around a shop | Medium | Inform and respect choices |
| Visit measurement | High, aggregated | Consent and anonymisation |
| Movement profiles | Very high | Avoid; high risk |
Common mistakes to avoid
- Using precise location without need. It raises risk without improving the result.
- Ignoring consent. It is required in many cases.
- Inferring sensitive places. Avoid deducing health, religion or beliefs from places.
How to measure the result
Compare the performance of targeting at different precision levels and document the minimum precision needed for the objective.
Limits and exceptions
Rules on location vary by context and jurisdiction, and location data are particularly sensitive, so this content does not replace legal advice. Visit measurement is approximate and limited by consent. Prioritise aggregated solutions and minimise data, weighing benefit against risk.
Illustrative example
Illustrative example: a restaurant chain uses 3-kilometre area targeting around each shop, without using movement history, and measures visits in aggregate, when available and with consent. Cost per booking falls, and privacy risk is reduced. It documents the purpose and data used.
In practice: checkpoints
Ask for location only when it clearly helps the user, explain why in plain words and make refusal easy. Use the lowest precision that works and avoid storing exact locations without need. Review how partners use location data, and document the legal basis and retention period.
Frequently asked questions
Do I need precise location?
In most campaigns, no. The area is usually enough.
Can I target a sensitive place?
Avoid it. Platforms restrict it and there are legal and ethical risks.
How do I ask for consent?
Clearly, explaining the purpose and allowing refusal.
Do I need precise location?
Rarely; the area usually suffices for the commercial objective.
How do I inform users?
In the privacy policy and consent notices, clearly and simply.
Use location at the minimum precision needed, with consent when required, and avoid movement profiles and inferences about sensitive places.
Sources and recommended reading
- ePrivacy Directive (2002/58/EC)
- General Data Protection Regulation (GDPR)
- EDPB: guidelines and recommendations
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.