The US Supreme Court just ruled location data is private. EU operators should note what that means for AI systems that track movement.
elcome to issue ten. This week the most consequential ruling in our inbox comes not from Brussels but from Washington, where the US Supreme Court has decided that location data revealing your physical movements is constitutionally protected. Meanwhile, X Corp is trying to escape a 2022 FTC privacy consent decree simply because it rebranded, and Illinois is pushing a device-level age-gating law that digital rights groups say will harm the very young people it claims to protect. The throughline is one we keep returning to: data about where you go, who you are, and how old you are is increasingly a battleground, and the rules being written right now will shape what AI systems can legally ingest.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We have added a location-data sensitivity flag to the Flux compliance scan following this week's Chatrie ruling, so AI tools that ingest movement data are now surfaced for manual review.
- Updated The Flux vendor tracker now notes X Corp's FTC petition status, since any rollback of that consent decree would affect how EU operators should assess X's data-handling commitments.
- ICYMI Our issue nine deep-dive on Russian FSB-linked face recognition in Georgia is still the most-shared piece in the archive if you missed it and want the full surveillance infrastructure picture.
US Supreme Court rules location data is constitutionally protected, setting a global benchmark for AI surveillance limits
What the ruling says, and why it reaches beyond the United States. In Chatrie v. United States, the Supreme Court held that even short-term surveillance of a person's physical movements via location data constitutes a search under the Fourth Amendment. The case centred on geofence warrants, where police vacuum up location records from everyone near a crime scene. The court said that kind of dragnet collection requires proper legal process, full stop.
Why EU AI Act operators should care about an American constitutional ruling. Many AI systems sold or deployed in Europe ingest location data as a core input, whether for logistics optimisation, retail analytics, or employee monitoring. The EU AI Act's risk classifications are partly calibrated against the sensitivity of the data an AI system processes. A US ruling that treats location data as inherently sensitive adds weight to the argument that location-based AI systems deserve high-risk treatment under Article 6 and Annex III.
Does your AI inform a decision that affects a person's job, credit, education, or essential service?
- ✓No new EU AI Act implementing measures published this week, but the location data ruling indirectly pressures EU supervisors to clarify how location-sensitive AI systems are classified under Annex III.
- ✓UK age-verification data collection practices are under scrutiny from EFF, highlighting a gap between UK and EU data minimisation expectations that EU-facing operators must track.
- ✓The Illinois device-level age-gating bill shows how fragmented national approaches to sensitive data are becoming, underlining why the EU AI Act's unified framework matters for cross-border operators.
- ~US Supreme Court rules in Chatrie v. United States that location data and geofence surveillance require Fourth Amendment protection, a landmark privacy ruling with global resonance.
- 1EFF: Chatrie v. United States ruling explainerLegal ruling
EFF's plain-English breakdown of the Supreme Court's geofence warrant ruling and what Fourth Amendment protection for location data actually means in practice.
Why we like it. If you deploy any AI system that uses location signals, this is the clearest starting point for understanding the new global baseline.
- 2EU AI Act Annex III (High-Risk Categories)Regulation
The official list of AI system types that automatically qualify as high-risk under the EU AI Act, including systems used in critical infrastructure and biometric identification.
Why we like it. Cross-referencing your location-data AI tools against Annex III is exactly the exercise this week's ruling makes urgent.
- 3
Location data is the new biometrics. Start treating it that way.
By John Ferguson
This week I kept coming back to one question: how many of the AI tools our readers use every day quietly ingest location data without anyone having classified that as sensitive? My guess is most of them.
The Supreme Court ruling in Chatrie is American law, and I know that tempts EU operators to file it under 'not our problem'. That would be a mistake. The ruling is a signal that the global consensus around location data as an inherently sensitive data class is hardening. The EU AI Act's risk framework will catch up to that consensus, whether through guidance, enforcement, or both.
The X Corp FTC petition is the week's dark comedy entry. Changing your name and hoping your compliance obligations evaporate is, apparently, a legal strategy someone paid lawyers to draft. It will not work, but it tells you a lot about how some platforms think about accountability.
My practical advice this week: pull up whatever AI systems touch movement or location data in your stack and ask whether you have a Data Protection Impact Assessment for each one. If the answer is no, that is your Monday morning task. The deadline clock for high-risk AI rules keeps ticking.
John Ferguson · Founder, Agentic Fluxus
Short answer.The Chatrie ruling is US law, so it does not directly change your EU obligations. But it reinforces what EU data protection rules already say: real-time location data is sensitive personal data. If your route-optimisation system processes this data and influences decisions about workers, it likely warrants a Data Protection Impact Assessment and possibly a high-risk review under the AI Act's employment-related provisions in Annex III.
Does your organisation have a clear policy on what AI systems are allowed to do with location data?
X Corp argued to the FTC that because it changed its name from Twitter, it should be released from a 2022 consent decree covering 140 million users' misused data. The FTC has not yet agreed, and EFF has formally opposed the petition.
The US Supreme Court ruled in Chatrie v. United States that geofence warrants, where police scoop up location data from everyone near a crime scene, are a constitutional search. It is the clearest statement any apex court has made about AI-era surveillance limits.