NearScrub

2026-10-03

Connecticut just banned selling your precise location data — the GPS coordinate already sitting inside your photos isn't what the law reaches

On October 1, 2026, Connecticut's Public Act 26-64 (SB 4) took effect, and most of the coverage has focused on what it now forbids companies from doing: selling a consumer's precise location. That's worth covering on its own — it's a real, specific restriction, not a vague gesture at privacy. But it's also a useful occasion to be precise about something this blog keeps coming back to: closing one pipeline that carries your location does nothing to a completely different pipeline that also carries it. The GPS coordinate your phone's camera already wrote into a photo sitting in your camera roll right now has no company and no sale anywhere near it, and this law — like every law like it — was never written to reach it.

What Public Act 26-64 actually restricts

As InfoLawGroup's rundown of the October 1 changes explains, Connecticut's amendment bans "controllers and third parties" from selling a consumer's "precise geolocation data." Per an analysis of the bill's text, that term is defined as location information identifying a person's specific location within a 1,750-foot radius, and "sell" means exchanging it "for monetary or other valuable consideration" — a commercial transaction between businesses, not a ban on collecting location in the first place. InfoLawGroup notes that Connecticut "joins Maryland, Oregon, and Virginia in moving away from an opt-in consent model and imposing an outright ban on selling precise location data," a meaningfully stronger approach than the disclosure-and-consent model most state privacy laws still rely on. The restriction is also wider than it first looks: Connecticut's general privacy-law threshold, lowered this year to controllers handling data on 35,000 or more state residents, drops away entirely once a business is selling the data at all — so the ban isn't limited to large companies with the usual carve-outs.

A photo's GPS tag never goes near a "sale"

None of that reaches what's sitting inside a JPEG the moment your phone's camera takes it. A camera with location services on writes an exact latitude and longitude straight into the file's EXIF data at the instant of capture — no app, no company, no "controller" anywhere in that specific act. The U.S. government's own gps.gov states that a GPS-enabled smartphone is typically accurate to within a 4.9-meter (16-foot) radius under open sky — far tighter than the 1,750-foot threshold Connecticut's new law uses to define "precise" in the first place. That coordinate doesn't become a "sale" when you text the photo to a friend, post it to a forum, attach it to a classifieds listing, or email it to a landlord. You're not a controller exchanging data for consideration in any of those moments; you're a person sharing a file, and nothing in what these statutes say they restrict has a category for that. (This isn't legal advice — just a plain description of the specific transaction the law names.) It's not an oversight waiting to be fixed, either: a coordinate sitting inside a file you created and chose to hand to someone has never been the kind of thing a consumer-privacy statute aimed at data brokers and ad-tech companies was built to reach.

Two pipelines carry your location — only one lives in a file Commercial location sale App or service collects your location via a permission; a controller then sells it. Banned as of Oct 2026: CT, MD, OR, and VA now ban selling precise location — inside roughly 1,750 ft — for money or other value. A photo's own GPS tag Camera writes an exact coordinate into EXIF the instant you take the photo. Not a "sale" of data: handing someone that file isn't a controller selling data — no law like this one reaches it. Scrub it first.
Two different pipelines carry a location, and new state laws reach only one of them — the coordinate already sitting inside a photo's own metadata isn't a "sale" these statutes were written to cover, so it stays there until you remove it yourself.

What a browser-based scrub changes here — and what it can't

This is exactly the gap a tool like NearScrub sits in, and it's worth being precise about its size, not just its existence. Running a JPEG, PNG, PDF, or Office file through a scrub that strips EXIF/GPS, XMP, and IPTC data — entirely in the browser, no upload, no server — removes the coordinate from the file itself before it goes anywhere. That means there's nothing left inside that specific file for a recipient, a platform, or some future data broker to ever read out, whether or not the place you're sending it even qualifies as a "controller" under Connecticut's law — a friend's phone and a printed flyer aren't covered by Public Act 26-64 either way. It is not a substitute for what that law does, and it doesn't do what that law does: it has no effect on location a company collects through other means entirely — an app's permission prompt, Wi-Fi and cell-tower positioning, your account activity, your IP address — none of which lives inside a photo's metadata to begin with. It can't pull back a copy you already shared before you started scrubbing, and since it's a client-side tool limited to those four file types, it has nothing to offer a video's own location metadata either. Two different pipelines carry your location; only one of them is a file already sitting on your device, and that's the only one a tool like this was ever built to reach.