Every time my team begins to explore the scenarios that are possible with mobile device location data, location data that is part of user data, or even location data that may be retrieved or inferred from IP address or browser cookies, we are stopped dead in our tracks by the risk of violating a user's privacy. It's frustrating, because working with location data creates whole new areas for providing a great user experience.
I have taken a look at the Mobile Device Privacy Act, related online opinions, such as the ars technica article, and the Electronic Frontier Foundation's recent Mobile User Privacy Bill of Rights, but there isn't really an authoritative (or even de facto) standard and opinions differ.
Is it as simple as obtaining a user's permission to make use of location-based data and then safeguarding the data? I would like to know how others are addressing or even skirting this issue. Do you obtain user permission before utilizing location data? Are you just riding it out for now and waiting to see if a national law is passed?