Key facts

  • Operator location data comes from network events (a phone connecting to a cell, handovers, calls, data sessions). It shows which cell or sector a SIM used, not GPS coordinates.
  • In the EU, two rule sets apply: the GDPR and the ePrivacy Directive (2002/58/EC), whose Articles 6 and 9 allow traffic and location data to be used beyond running the network only if it is made anonymous or the user has given consent for a value-added service.
  • Two different product families follow from this: aggregated, anonymous statistics (footfall, catchment, tourism, mobility) and consent-based services (for example location-aware campaigns to subscribers who opted in).
  • Pseudonymised data is still personal data. Only data that passes the anonymisation test falls outside the GDPR. The EDPB calls location data "notoriously difficult to anonymise".
  • The operator is the controller of subscriber data. Buyers typically receive aggregated results or consented services, not subscriber records.
  • Main limits: one operator's subscribers are a sample that must be extrapolated, and precision depends on cell size.

What operator location data is

To deliver calls and data, a mobile network must know roughly where each phone is. When a phone attaches, moves between cells, makes a call or opens a data session, the network records an event linked to a cell or antenna sector. Over time these events form a coarse trace of where a SIM has been.

This is not GPS. Precision depends on cell size: a few hundred metres in a city centre, several kilometres in the countryside. Network data describes movement between areas well, but not which shop entrance or floor someone was on.

In the ePrivacy Directive, data processed to carry a communication is traffic data (Article 6). Location data that is not traffic data falls under Article 9. Both are regulated more strictly than ordinary personal data.

Anonymisation vs pseudonymisation

  • Pseudonymisation replaces the phone number or other identifier with a code. Whoever holds the key, or enough other data, can link it back. Under the GDPR (Article 4(5) and Recital 26) pseudonymised data is still personal data.
  • Anonymisation means no one can reasonably identify the person, taking into account time, cost, technology and other available data. Truly anonymous data is outside the GDPR.

For location data this is hard. A 2013 study of fifteen months of mobile-network data for 1.5 million people found that four points in space and time, at antenna resolution, were enough to uniquely identify 95% of individuals. The EDPB Guidelines 04/2020 draw the conclusion: a single person's location trace over a significant period cannot be fully anonymised, and poorly aggregated data may not be anonymous either. Anonymisation applies to a dataset as a whole, not to individual records.

In practice, operators and their technology providers use several safeguards together:

  • Aggregation into counts per area and time window instead of individual traces.
  • Minimum-count thresholds, so that a cell in a table with too few people is suppressed or merged. Each operator and use case sets its own value.
  • Coarsening of space and time (larger zones, longer intervals).
  • No individual output: the buyer receives tables, maps or indicators, never subscriber records or identifiers.
  • Governance: access control, retention limits and a data protection impact assessment (DPIA) per product.

The Article 29 Working Party (Opinion 05/2014) notes that anonymising personal data is itself further processing, so it needs its own legal assessment.

Two kinds of use: consent-based and aggregated-anonymous

Consent-based services. A subscriber explicitly opts in, usually in the operator's app, self-care portal or at the point of sale, to receive offers based on where they are or spend time. The operator then runs campaigns (SMS, RCS, push) on behalf of advertisers to that opted-in group. The advertiser chooses an area and audience; the operator sends the message. The advertiser does not receive the phone numbers. Consent must be specific, informed and as easy to withdraw as to give (GDPR Articles 4(11) and 7; ePrivacy Articles 6(3) and 9(1)).

Aggregated, anonymous statistics. No individual is contacted and no individual data leaves the operator. Typical outputs:

  • Footfall: how many people are present in an area by hour, day or season.
  • Catchment: where visitors to a site, mall or event come from, at district or municipality level.
  • Tourism: domestic and foreign visitors (by the country of their SIM), length of stay.
  • Transport planning: origin-destination flows between zones, commuting patterns, load on routes.

Public statistics use it too: Spain's INE published experimental mobility statistics from aggregated, anonymised data of the three main mobile operators.

Legal bases and who is responsible

  • GDPR Article 6 lists the legal bases. Consent (6(1)(a)) is the usual basis for location-based marketing. Some operators assess legitimate interest (6(1)(f)) as a basis for producing anonymous statistics; this depends on national law and DPA guidance.
  • ePrivacy Directive Articles 6 and 9, as transposed into each country's electronic-communications law, add a stricter layer: beyond running the network and billing, traffic and location data may only be used if made anonymous or with consent for a value-added service. National implementations differ. The Commission announced the withdrawal of the proposal for an ePrivacy Regulation in February 2025, so the Directive and national laws remain the rules.
  • The operator is the controller. It collects the data, decides on purposes, answers to the national data protection authority and the telecom regulator, and carries out DPIAs. A technology provider that builds or runs the platform normally acts as a processor under contract. A buyer of aggregated statistics does not receive personal data; a buyer of a consent-based campaign receives campaign results, not contact data.

Limitations

  • Single-operator panel. One operator sees only its own subscribers. Results must be extrapolated to the whole population using market share and demographic weighting, and market share differs by region and age group.
  • SIMs are not people. Some people carry two phones, children often have none, and machine-to-machine SIMs must be filtered out.
  • Cell precision. Shop-level or entrance-level questions are beyond what network data can answer reliably; in rural areas, zones become large.
  • Thresholds hide small groups. Suppression protects privacy but means small areas, short time windows or rare segments may show no data.

Buyers should ask for the methodology, extrapolation and known biases.

Alternatives

  • App SDK data: GPS location from apps whose users consented. Precise, but panels are smaller and skewed towards certain apps and users, and consent quality in the supply chain varies.
  • Wi-Fi/Bluetooth sensors, counters and cameras: accurate at one venue, door or road; they need hardware and say little about origin.
  • Surveys and travel diaries: give reasons and demographics, but are expensive, infrequent and rely on recall.

Many planning teams combine sources: network data for coverage and trends, local counters or surveys for calibration.

In practice

instarea, a Bratislava software company, builds and operates platforms of this kind for mobile operators. Its Crowdspector platform has been deployed since 2014 under the Market Locator brand for operators in Slovakia and the Czech Republic, and earlier as Slisor for STC in Saudi Arabia. The products are operator-controlled and each use has its own subscriber consent: location-based campaigns go only to subscribers who opted in to them, and the anonymised, aggregated location analytics also rest on a separate consent collected by the operator. Subscriber data stays with the operator.

FAQ

Is telco location data the same as GPS data?

No. It is derived from network events tied to cells or antenna sectors. Precision ranges from a few hundred metres in cities to kilometres in rural areas.

Can an operator sell location data about individual customers?

Not without a legal basis. Under the ePrivacy Directive, location data beyond network operation and billing may only be used if anonymous or with the user's consent for a value-added service. Common models deliver aggregated statistics or consented services rather than subscriber records.

Is pseudonymised location data anonymous?

No. Replacing the phone number with a code is pseudonymisation; the data is still personal data under the GDPR. Location traces are particularly easy to re-identify, which is why aggregation and minimum counts are used.

Who is responsible for GDPR compliance?

The mobile operator, as controller of subscriber data. Technology providers usually act as processors. Buyers remain responsible for their own use, for example the content of a campaign.

How representative is data from one operator?

It is a large sample, not a census. Results are extrapolated using market share and demographics; accuracy depends on how even that share is across regions and groups.

Sources

More on the platform behind Market Locator: https://instarea.com/products/crowdspector (see also https://instarea.com/products/market-locator)