Precise GPS Location Collection and Third-Party Sharing

What it is

FanDuel collects your exact GPS location from your mobile device and shares it with vendors and, under Section 4.10, potentially with sports leagues, regulators, and law enforcement.

Why it matters (compliance & governance perspective)

Precise GPS-level location data is among the most sensitive categories of personal information because it can reveal where you live, work, worship, or seek medical care, and this policy authorizes sharing it with a broad set of third parties beyond what is necessary for basic service delivery.

This document changed recently

Consumer impact (what this means for users)

Your exact physical location is collected whenever you use FanDuel's mobile app and may be shared with advertising vendors, gaming regulators, and the other third parties listed in Section 4.10, creating a detailed record of your movements that extends well beyond gameplay purposes.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Precise geolocation data is classified as sensitive personal information under the CPRA (California), and several other state privacy laws including Colorado, Virginia, and Connecticut impose heightened obligations on its collection and use. The FTC has issued guidance treating precise geolocation as a sensitive data category warranting enhanced protection. This provision should be evaluated under each applicable state's sensitive data consent and opt-out requirements. (2) GOVERNANCE EXPOSURE: High. The policy asserts authority to collect continuous GPS-level location data and share it with vendors and third parties under Section 4.10 without a separate consent mechanism specific to sensitive geolocation. Under CPRA and analogous state laws, processing sensitive personal information for purposes beyond service delivery may require opt-in consent rather than opt-out mechanisms. (3) JURISDICTION FLAGS: California residents have the strongest statutory protections for sensitive geolocation data under CPRA. Illinois, Texas, and Washington have enacted or proposed specific location data protections. EU and UK users, if any access the platform, would face the highest bar under GDPR Article 5 purpose limitation and data minimization principles for GPS-level tracking. (4) CONTRACT AND VENDOR IMPLICATIONS: The policy notes that location is shared with vendors as part of location-based services without identifying those vendors specifically. This lack of specificity may complicate data mapping exercises and vendor due diligence. Compliance teams should confirm data processing agreements with all geolocation vendors include appropriate restrictions on downstream use. (5) COMPLIANCE CONSIDERATIONS: Teams should assess whether the current opt-out mechanism for data sales and targeted advertising sharing is sufficient to address sensitive geolocation sharing under applicable state laws, or whether an opt-in consent mechanism is required. A data mapping exercise to identify all vendor recipients of GPS data is recommended.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Disclosure to Sports Leagues, Employers, and Governing Bodies high
• Data Sale and Targeted Advertising Opt-Out medium
• Identity Document Collection as Mandatory Condition high
• Audio Recording of Customer Communications medium
• Third-Party Targeted Advertising and Cross-Device Tracking medium
• Corporate Transaction Data Transfer medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.