Why Wi-Fi Data Counts as Precise Location
Imagine a hotspot finder that shows nearby access points with signal strength. The page runs AdSense. To display results, the app sends Wi-Fi scan data that can pin a user's position. Under Google's publisher policy, that page is now collecting precise location data, and the obligations below apply before the first scan.
Google's publisher policy groups Wi-Fi signals with GPS and cell tower data. Any information that identifies or can be used to infer a user's precise geographic location falls under the policy's location-data obligations, no matter which technical source produced it. That matters for Wi-Fi publishers because Wi-Fi positioning can be more subtle than GPS. A speed-test page that measures connection quality, a hotspot finder that maps nearby access points, or a coverage-map app that compares signal strength can all collect data that, combined, reveals where a user is standing. If that data can infer precise geolocation, the full set of obligations applies.
The policy does not treat every piece of network data the same way. General connectivity data that cannot identify or infer a precise location is outside this rule. The trigger is whether the data can be used to determine a user's geographic position, not whether the page happens to run over a Wi-Fi connection. Publishers auditing their data flows should ask one question first: can this dataset identify or infer where a specific user is?
The Four Obligations Before You Collect
All four obligations are cumulative. Meeting one does not satisfy the others.
1. Disclose before you collect. Before collecting, processing, or disclosing precise location data, you must give users an interstitial notice or an immediate notice explaining what the data will be used for. The policy notes this may include ad personalization, analytics, and attribution, and that data may be shared with partners. The notice must appear before collection begins, not buried in a privacy-policy page. Practically, it should sit on the same screen where collection starts, and it must state the uses clearly enough for a user to make an informed choice.
2. Obtain explicit opt-in consent. Disclosure is not consent. You must obtain the user's explicit consent, a true opt-in, before collecting, processing, or disclosing precise location data. A passive acknowledgment or pre-ticked setting does not meet this standard. If the user declines, collection must not proceed.
3. Encrypt data sent to Google. If precise location data is transmitted to Google, it must be sent in encrypted form or through encrypted channels. Encryption is not optional once consent is given; it is a separate technical requirement that applies at the transmission layer.
4. Cover it in all applicable privacy policies. Your privacy policy must disclose how you collect, process, and disclose precise location data. Separately, AdSense program policy requires publishers to maintain a privacy policy that clearly discloses any data collection, sharing, and use resulting from Google products and services, including technologies such as cookies, web beacons, IP addresses, or other identifiers.
GPS, Wi-Fi, and Cell Tower Data Are Treated the Same
| Data source | Counted as precise geolocation under policy | Requires disclosure + opt-in consent | Must be encrypted when sent to Google |
|---|
| GPS data | Yes — named in policy | Yes | Yes |
| Wi-Fi data | Yes — named in policy | Yes | Yes |
| Cell tower data | Yes — named in policy | Yes | Yes |
The table reflects an important boundary: Google's policy names GPS, Wi-Fi, and cell tower signals as equivalent triggers. There is no hierarchy where Wi-Fi-derived data is treated more leniently than GPS. If your implementation pulls location from any of these sources, the same disclosure, consent, and encryption duties apply. The practical difference is detection: a hotspot finder may not realize it is collecting precise location because the data arrives indirectly through signal measurements rather than a GPS permission prompt.
The COPPA Edge Case
If a site or an app section is covered by COPPA and uses Google ad services, it must be marked as child-directed, through Google Search Console, the AdMob SDK, or ad request markers. The consequences extend to ad targeting: interest-based advertising, including retargeting, must not be used to target users known to be under 13. For a Wi-Fi app with mixed audiences, this means segmenting child-directed sections and confirming that location-data consent and ad personalization never apply to those users. Note also that in the US and Canada, personalized ads must not be based on gender, age, parental status, marital status, or zip code when advertising housing, employment, or credit-related products.
Consequences of Non-Compliance
Google may take corrective action for policy violations, including suspending any Google service, requiring you to stop using or modify an implementation, or exercising rights under the applicable service agreement. The policy does not promise a warning count or a fixed timeline, so treating the four obligations as prerequisites, not post-hoc fixes, is the safer reading. If you discover a violation during an audit, stopping the collection and correcting the disclosure and consent flow should be your immediate step, alongside reviewing your agreement with Google.
Compliance Checklist for Wi-Fi Publishers
- Audit every data field: can it identify or infer a precise location?
- Add an interstitial or immediate notice stating uses (ad personalization, analytics, attribution) and partner sharing.
- Implement explicit opt-in consent before any collection, processing, or disclosure.
- Encrypt precise location data or transmit it only through encrypted channels to Google.
- Update all applicable privacy policies, including Google-product data disclosures.
- Mark COPPA-covered sections as child-directed and exclude under-13 users from interest-based ads.
Limits and Professional Advice
Google states it may revise its policies at any time, and publishers are responsible for staying current. Requirements can also vary by jurisdiction, and this article is informational, not legal advice. Before finalizing consent flows, encryption, or privacy-policy language, consult a qualified attorney who can evaluate your specific data flows.
研究の知恵