Telecommunications firms and mobile-based apps make billions of dollars per year by selling customer location data to marketers and other businesses, offering a vast window into the whereabouts of cellphone and app users, often without their knowledge.
That practice, which has come under increasing scrutiny and criticism in recent years, is now the subject of proposed legislation in New York. If passed, it is believed that the city would become the first to ban the sale of geolocation data to third parties.
The bill, which will be introduced on Tuesday, would make it illegal for cellphone companies and mobile app developers to share location data gathered while a customer’s mobile device is within the five boroughs.
Cellphone companies and mobile apps collect detailed geolocation data of their users and then sell that information to legitimate companies such as digital marketers, roadside emergency assistance services, retail advertisers, hedge funds or — in the case of a class-action lawsuit filed against AT&T — bounty hunters.
“The average person has no idea they are vulnerable to this,” said Councilman Justin L. Brannan, a Brooklyn Democrat who is introducing the bill. “We are concerned by the fact that someone can sign up for cell service and their data can wind up in the hands of five different companies.”
In the absence of a federal law specifically protecting consumers’ location data, cities and states have stepped up to enforce privacy regulations and location data rules. In San Francisco, voters approved a ballot measure in 2018 that would require companies to disclose their data practices and secure customer data to win city contracts.
In January, the City of Los Angeles filed a lawsuit against the Weather Channel app, accusing it of deceptively collecting location data from millions of American users. The app tricked users into turning on location data by telling them that it would be used only to localize weather reports. Instead, the data was used for commercial purposes like analysis for hedge funds, the suit alleged.
The proposed legislation in New York will almost certainly be opposed by the ad tech industry, which has a strong presence in the city. Mr. Brannan said he did not consult industry leaders for input.
The bill would restrict cellphone companies and mobile apps from sharing location data to situations where they were “providing a service explicitly requested” by the customer. The language is designed to challenge the vague agreements customers click on when signing up for an app or a cellular service. The legislation would also exclude the collection of location data in “exchange for products or services.”
Marc Rotenberg, president of the Electronic Privacy Information Center, said the collection of location data was now the “primary technique to track people in physical space” and “raises far-reaching privacy concerns.”
“New York City is joining a growing list of cities that are not waiting for Washington to pass privacy legislation,” he added.
It is not yet clear whether the bill will pass the full Council, but the Council speaker, Corey Johnson, said he was open to exploring solutions to the privacy issues addressed in Mr. Brannan’s bill.
“We live in an age where people’s private information is being sold to the highest bidder, and it is important for us to think of 21st-century fixes,” Mr. Johnson said.
The bill provides for steep fines, ranging from $1,000 per violation to $10,000 per day per user for multiple violations, while giving the right to sue to customers who have had their location data shared without their explicit permission. The city’s Department of Information Technology and Telecommunications would enforce the law.
Exceptions include information legally supplied to law enforcement agencies; data provided to emergency responders; data required under federal, state or city law; and situations where customers knowingly provide their location data.
Before the bill can come to a vote, it would probably first be heard by the Council’s Committee on Technology. Robert F. Holden, the committee chairman, called the bill a “priority.”
“Privacy is a serious concern, especially in a day and age where more and more of it is stripped from us as technology progresses,” said Mr. Holden, who added that he was interested in seeing “how municipal government can do better in protecting user data.”
AT&T, T-Mobile and Verizon have pledged to stop selling location data to brokers who may sell the information on the black market. But data on users’ whereabouts is lucrative: Location-targeted advertising sales brought in an estimated $21 billion last year.
Senator Kamala Harris of California, a Democrat seeking her party’s nomination for president, has called on Congress to pass laws ending the sale of location data.
Mr. Brannan said the failure of cellular companies to police themselves was all the more reason for cities to step up.
“Why should we trust them?” he said. “Once municipalities know they have this tool in the arsenal, hopefully it will have a chain reaction.”
Natasha Singer and Jennifer Valentino-DeVries contributed reporting.