Tweet · 19 Dec 2019, 15:20 UTC

For sensitive data like geolocation, it should only be collected first-party, by an actively used interface, purpose-limited, and on mandatory short retention.