Lawmakers balk after Facebook explains how it collects and monetizes smartphone location data of users who have location tracking turned off for its app
- In response to a letter from Sen. Josh Hawley, R-Mo., and Sen. Chris Coons, D-Del., Facebook explained why it tracks users' locations …
Context & Ripple Effects
This letter is the third round of the same exchange. In 2018, Facebook answered congressional questions by detailing what it collects from logged-out web users (a disclosure prompted by earlier Senate scrutiny), then acknowledged in December that it approximates locations from IP addresses, check-ins, and profile cities even with tracking off (the mechanism now at issue). February's Android location controls were pitched as giving users limits, and September's blog post pre-positioned the company ahead of iOS 13's background-location warnings (that defensive explainer).
Sens. Josh Hawley and Chris Coons are testing whether those disclosures actually match the settings users see: Facebook's answer confirms that turning off app location does not stop location-based monetization. The bipartisanship matters — a Republican and a Democrat converging on the gap between the toggle and the data flow is what elevates this beyond a single-company story.
First-order effects
- Hawley and Coons get written confirmation that Facebook monetizes inferred location for users who disabled tracking, handing them a concrete exhibit for follow-up oversight of the company's consent claims.
- Facebook is immediately exposed on the credibility of its own controls: the Android location settings introduced in February promise limitation while IP- and check-in-based inference continues.
Second-order effects
- Apple's iOS 13 background-location warnings become the de facto enforcement layer Congress lacks — a later study found marketers collected far less background location after rollout — shifting the burden of constraining Facebook onto Apple's platform rules.
- Rival social platforms face the same senatorial template: any ad business built on inferred location can expect the same letter-and-disclosure treatment Facebook just underwent.
Third-order effects
- The pattern points toward a regulatory redefinition of consent where 'location off' must mean no location monetization from any signal, not just no GPS access — a standard that would force platforms to rebuild how they infer and disclose.
- Oversight is settling into a disclosure-by-letter regime in which congressional questioning substitutes for formal rulemaking, leaving platform privacy architecture shaped by adversarial document exchanges rather than statute.
The trend: Platform privacy is moving from toggle-based consent toward a fight over inferred data, with Apple's OS-level warnings and Senate letters filling the vacuum left by absent US location-privacy law.