Location Data Collection and Compliance

Airship supports location-based messaging across multiple features. Location data collected through mobile apps is subject to increasing regulatory scrutiny. In Europe, the GDPR has long required informed consent for non-essential data collection, and in July 2026, the CNIL, France’s data protection authority, published French-language recommendations  clarifying what “informed consent” for location requires. Similar principles apply across the EU, the UK, and a growing number of US states. This guide explains how these requirements affect your use of Airship’s SDK and platform features, and what steps you should take before collecting or sending location data through the Service.

Airship’s role

Airship acts as a data processor, or “service provider” under the CCPA, and processes location data on your behalf and in accordance with your instructions, as set out in the Airship Data Processing Addendum (DPA). You, the customer, are the data controller and are responsible for ensuring your end users are properly informed and have provided appropriate consent before location data is collected or sent to Airship. Airship does not use Customer Data for any purpose beyond providing the agreed services.

Location data in Airship

Airship processes location data only to the extent you enable location-based features through a third-party application, a customer-developed integration, or another customer-configured functionality. Several Airship features can carry location data, and you should account for each when designing your consent and disclosure practices:

• SDK location permissions: When you use Airship’s SDK to request OS-level location permission, Airship records that the permission was requested and whether it was granted. This event itself may constitute processing of location-related data.
• Tags and attributes: You can set GPS coordinates, zip codes, city names, geofence labels, or other location signals as tags or attributes on channels or named users. Airship stores and processes these like any other audience data.
• Custom events: You can emit custom events that include location metadata. Airship stores these as standard event data.

Airship processes this data to evaluate customer-defined triggers, deliver notifications, and perform related Service functionality you have selected and configured.

OS permission prompts

Under major global privacy frameworks, including the GDPR and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), a user tapping “Allow” on an iOS or Android location permission prompt does not satisfy consent obligations and does not equate to legal consent for the use of location data.

The CNIL’s July 2026 recommendations on geolocation and mobile applications state that the technical authorization granted by the operating system does not, on its own, constitute consent for the use of location data, particularly for advertising purposes or sharing with third parties.

Before collecting location data, users must be clearly informed of the following:

• What data is collected
• The specific purpose for which it is collected
• Who receives it, including Airship and any downstream partners
• How long it will be retained
• What rights the user has

This information must be accessible, understandable, and presented at the right moment within the application, before collection begins.

On iOS, the system permission dialog includes a purpose string NSLocationWhenInUseUsageDescription. This is a useful starting point but is not sufficient on its own. Android’s permission dialogs do not use purpose strings.

Recommended approach

Before triggering the OS location permission prompt, or at minimum before you begin collecting and transmitting location data, implement a pre-permission screen or consent flow that explains your specific use case. Options include the following:

• A custom SceneA mobile app or web experience of one or more screens displayed with fully native UI components in real time, providing immediate, contextual responses to user behaviors. Scenes can be presented in full-screen, modal, or embedded format using the default swipe/click mode or as a story. Scene content can also be displayed in a Message Center message and contain survey questions. or in-app modal
• Your consent management platform (CMP)
• A clear disclosure in your onboarding flow

Your consent path will depend on your app’s use cases and applicable jurisdictions. Consult your legal counsel to ensure your consent flow is appropriately designed for your use cases.

Sending location data to Airship

If your app sends location data to Airship through tags, attributes, or custom events, the following principles apply.

Purpose limitation

Use location data only for the purposes you have disclosed to your users. Obtain consent when location data is not strictly necessary for the application or service to function, for example when it is used for advertising or marketing purposes.

Under the DPA, Airship processes this data only in accordance with your instructions and does not use it for any purpose beyond providing the agreed services. If you are unsure whether you have a DPA in place with Airship, review and sign the Airship Data Processing Addendum .

Data minimization

The CNIL recommends collecting only location data that is adequate, relevant, and necessary for your defined purpose. Airship provides controls within the Service to determine the types of data collected based on your defined processing purposes, including the option to disable data collection entirely. Follow these practical steps:

• Do not send precise GPS coordinates if a city-level or postal-code-level signal is sufficient.
• Consider whether on-device processing could meet your needs before transmitting raw coordinates to a server. The CNIL recommends processing data directly on the device when technically feasible.
• Limit background collection to situations where it is genuinely necessary.

Data retention

Location data stored on the Airship platform is subject to the Data Retention Schedule. Your privacy disclosures to users should accurately reflect how long Airship retains this data on your behalf.

Data subject requests

Users must be able to exercise their GDPR rights over their location data, including the right of access, the right to erasure, and the right to withdraw consent. The Service provides you with controls to retrieve, correct, delete, or restrict Customer Data to help you fulfill these obligations.

Airship does not provide an API to bulk delete all historical instances of a specific attribute or custom event at the channel level. If a user requests deletion of their location history, use the available channel-level deletion and attribute-removing capabilities. See Individual Data Privacy and Setting and removing attributes.

Third-party location integrations

If you use a third-party location partner to source geolocation data that triggers Airship events, the same consent, minimization, and retention rules above apply. In addition, follow these practices:

• Understand what data the partner passes. When a partner integration is enabled, the partner’s SDK collects location data and sends it to Airship directly or through a server-side API, as custom events, tags, or attributes tied to a channel or named user. You are responsible for mapping exactly what the partner collects and what subset reaches Airship.
• Disclose the partner in your consent flow. Users must be told that a third-party location provider is collecting their data and sharing it with Airship. The partner’s own permission flow does not satisfy this requirement on its own.
• Minimize what you transmit. Configure the integration to send only what your use case requires.
• Review the partner’s terms. Depending on their role, the partner may be acting as an independent controller or a separate processor. Your contractual arrangements should clearly allocate responsibility for consent, data minimization, and data subject rights across all parties in the chain.

Checklist

Before going live with location data collection through Airship, confirm the following:

• Do your end users receive clear, specific notice about what location data is collected, why, and with whom it is shared, before collection begins?
• Have you mapped out your data collection practices and purposes for which you collect location data? This is an important step in ensuring location data and other sensitive data is collected for the specific purposes approved by the end user.
• Are you relying solely on the OS permission prompt as your consent mechanism? If yes, this is likely insufficient for GDPR compliance.
• Have you reviewed your privacy policy and in-app disclosures to accurately reflect Airship’s role as a data processor and the applicable retention periods?
• Are you sending location data, such as GPS coordinates, geofence labels, or zip codes, to Airship through tags, attributes, or events? If so, is that use disclosed to your users?
• Are you using a third-party location partner? If so, is that partner properly disclosed in your consent flows? Do your contractual arrangements allocate responsibility for consent and data subject rights?
• Do you have a process for handling user requests to access or delete their location data?