Yes, banks can track your location, and most do. The primary channel is the mobile banking app on your phone, which can pull GPS coordinates, Wi-Fi network identifiers, and cellular tower data whenever you’ve granted it permission. Web banking leaks less, usually just a city-level estimate from your IP address. Federal law requires your bank to disclose what it collects and gives you a right to limit some sharing, and your phone’s permission settings let you shut off most of the collection at the source.
How Banks Actually Pinpoint You
Mobile banking apps rely on your phone’s GPS for a precise fix on your coordinates. When GPS is weak, as it often is indoors, the app falls back on cellular tower triangulation, estimating your position from the signal strength of nearby towers. Wi-Fi adds another layer: large databases map router identifiers to physical addresses, so the network you’re connected to can itself reveal where you are.
Browser-based banking works differently. When you log in through a web browser, the bank sees your IP address, which usually narrows your location to a city or zip code rather than a street. The bank also builds a browser fingerprint from details like your screen resolution, installed fonts, and device type, and compares it to past sessions. An unfamiliar fingerprint or IP location can trigger extra verification like two-factor authentication.
A VPN changes what the bank sees from your IP address, since the lookup returns the VPN server’s location instead of yours. It does not hide your GPS coordinates or Wi-Fi data from the app. If the banking app has location permission, it knows where you are regardless of any VPN running on the device.
Why Banks Want the Data
Fraud Detection
This is the main reason banks push for location access. When you swipe your debit card in Denver, the bank’s system checks whether your phone is also in Denver. If the card is being used in Miami while your phone pings from your living room in Colorado, the transaction gets flagged. Real-time matching catches stolen card numbers quickly and cuts down on false declines when you travel.
Some banks go further with card-lock features that tie your card directly to your phone’s location. You set a geographic boundary, and transactions outside it are declined automatically by comparing the merchant’s address to your phone’s coordinates in real time.
Branch and ATM Finders
Your app uses location to show the nearest branch or fee-free ATM. The app only needs your location at the moment you ask, which makes this the lowest-stakes use of the data.
Marketing and Planning
Banks analyze aggregated location data to figure out where customers spend time, which influences decisions like where to install an ATM. Some use geofencing to send push notifications tied to specific places, such as a card offer when you’re near a partner retailer. This is one reason banks prefer the “Always” permission over “While Using the App.”
What the Law Requires Your Bank to Tell You
The main federal law covering how banks handle your personal data is the Gramm-Leach-Bliley Act, at 15 U.S.C. §§ 6801–6809. The GLBA requires every financial institution to give you a written privacy notice when you become a customer and at least once a year after that. The notice must describe what categories of personal information the bank collects, who it shares that information with, and how it protects the data.1Office of the Law Revision Counsel. 15 USC Chapter 94, Subchapter I – Disclosure of Nonpublic Personal Information
The GLBA protects what it calls “nonpublic personal information.” The statute does not list “geolocation data” by name, but location collected through your banking app falls under that umbrella when it’s gathered in connection with a financial product. In practice, most major banks explicitly list geolocation data as a category they collect in their privacy notices.
When you download a banking app and tap “Accept” on the terms, you’re consenting to the practices described in those documents. The GLBA was written in 1999, before smartphones, and it leans on disclosure and opt-out rather than on blocking collection. It doesn’t prohibit location collection; it requires the bank to tell you about it and offer you certain choices about third-party sharing.
Your Opt-Out Right for Third-Party Sharing
Before a bank shares your personal information with a non-affiliated third party, the GLBA requires it to give you notice and a reasonable opportunity to opt out. If you don’t opt out, the bank can share.1Office of the Law Revision Counsel. 15 USC Chapter 94, Subchapter I – Disclosure of Nonpublic Personal Information
There is a significant exception. Banks can share your data with service providers and companies that market on the bank’s behalf without triggering the opt-out requirement, as long as a contract prohibits the third party from using the data for anything other than the bank’s services.2CFPB Laws and Regulations. GLBA Privacy – Gramm-Leach-Bliley Act Privacy of Consumer Financial Information Banks can also share without an opt-out when the disclosure is needed to process a transaction you requested, to prevent fraud, or to comply with legal requirements.
The practical effect: your location data can reach advertising and analytics partners through the service-provider exception even if you never explicitly agreed to that sharing. Opt-out instructions live in the bank’s annual privacy notice, usually with an online form, a phone number, or a mailing address.
Stronger Rights Under State Law
Several states have passed consumer privacy laws that go beyond the GLBA. California’s Consumer Privacy Act classifies geolocation data as sensitive personal information and gives you the right to opt out of its use for cross-context behavioral advertising. Some national banks apply these rules across all states rather than running separate systems. At least one large bank discloses that while it does not sell personal data, it does share geolocation data with ad-tech and analytics providers for behavioral advertising, subject to opt-out rights. If you live in a state with a comprehensive privacy law, you likely also have the right to request deletion of location data the bank has collected.
Who Else Can See the Data
Location records your bank holds don’t sit in isolation. Law enforcement can request them, but the Right to Financial Privacy Act, at 12 U.S.C. § 3401 and following, prohibits government authorities from accessing your financial records unless they use one of five specific mechanisms: your written consent, an administrative subpoena, a search warrant, a judicial subpoena, or a formal written request.3Office of the Law Revision Counsel. 12 USC Chapter 35 – Right to Financial Privacy
The Supreme Court’s 2018 decision in Carpenter v. United States added another layer, holding that the government generally needs a warrant supported by probable cause to access historical cell-site location information. The Court recognized a legitimate expectation of privacy in the record of your physical movements even when a third party holds that data.4Supreme Court of the United States. Carpenter v. United States Carpenter involved wireless carrier records rather than bank-held location data, but its reasoning applies broadly to detailed location histories held by third parties.
How Long the Data Sticks Around
Federal rules under the Bank Secrecy Act generally require banks to retain customer records for at least five years.5FFIEC BSA/AML. Appendix P – BSA Record Retention Requirements So even if you revoke the app’s location permission today, the bank may be required to keep what it already collected for years. Federal law doesn’t currently include a general right to demand deletion of previously collected records, though some state privacy laws do, and banks in those states must honor those requests. Turning off location permissions stops new data from flowing; it does not erase the history. For historical deletion, you’ll need a formal request to the bank’s privacy office, and the bank may deny it where retention is federally required.
Shutting Off Location on Your Phone
Your phone’s operating system controls which apps can see your location and when. On iOS, check Settings, then Location Services. On Android, use the Permissions Manager. Find the banking app and you’ll see its current access level.
Most phones give you three options:
- Always: The bank can access your location even when the app is closed. Maximum data for fraud detection and for everything else.
- While Using the App: Tracking is limited to moments when the app is open. A reasonable middle ground.
- Never: The bank gets no GPS or cellular location data from your device.
Newer versions of both iOS and Android also let you choose between precise and approximate location. Approximate gives the app a general area of roughly 2 to 7 kilometers rather than pinpoint coordinates. That’s fine for finding a nearby ATM. For real-time fraud matching against a specific store address, it may not be granular enough to be useful.
What You Give Up by Turning It Off
Setting the app to “Never” doesn’t break mobile banking, but it disables specific features. You lose ATM and branch finders, real-time fraud matching between your phone and card transactions, and any location-based card-lock controls. The bank will still flag suspicious transactions using spending patterns and merchant categories, but the geographic cross-check is gone.
Travel is the clearest example of the trade-off. Many major card issuers no longer require or even accept travel notices, because location data from your phone has largely replaced the old system of calling ahead. With location on, the bank’s system can see your phone traveled to the same city where your card is being used, and your purchases go through. With location off, you may see more fraud alerts on out-of-pattern spending, though most banks will contact you to verify rather than blocking the card outright.
A Reasonable Middle Ground
If you want to cut back without giving up mobile banking, a few targeted changes do most of the work:
- Switch the banking app to “While Using the App.” This single change eliminates passive background tracking while keeping fraud protection active during transactions.
- Use approximate location on newer phones for a general area instead of exact coordinates.
- Read your bank’s annual GLBA privacy notice and actually follow the opt-out instructions for third-party sharing.
- Check permissions after major app updates, which sometimes reset settings or ask for new ones.
- Use a web browser for low-risk tasks like checking a balance. Browser logins expose only your IP-based location, which is far less precise than GPS.
Banks have real reasons to want location data, and fraud prevention is a genuine benefit. The default phone settings share more than most people need to share for that purpose. “While Using the App” plus a third-party sharing opt-out gets most people to a sensible balance.