Updated April 2026 · 13 min read

Phone Tracking Laws by Country: A Complete Legal Guide for 2026

Phone tracking laws vary dramatically from one country to the next. What is perfectly legal in the United States may carry a prison sentence in the UAE. This guide breaks down the rules in eight major jurisdictions so you know exactly where you stand before you track anyone's location.

Before diving into country-specific rules, it helps to understand a universal principle: consent-based tracking is legal almost everywhere. When the person being tracked actively agrees to share their location, the legal risk drops to near zero in every jurisdiction we cover below. This is the model that services like Tracify use, and it is why consent-first design is so important.

That said, the details matter. Some countries regulate who can track, how data must be stored, and what penalties apply when someone tracks a phone without permission. Let us walk through each one.

United States

Federal law

At the federal level, phone tracking is governed primarily by three statutes:

• The Electronic Communications Privacy Act (ECPA), 1986 — makes it illegal to intercept or access electronic communications without authorization. Tracking a phone's location falls under this umbrella when done without consent or a warrant.
• The Computer Fraud and Abuse Act (CFAA) — prohibits unauthorized access to computer systems, which courts have extended to mobile devices. Installing tracking software on someone's phone without permission can be prosecuted under the CFAA.
• The Stored Communications Act (SCA) — restricts access to stored electronic data, including location history held by carriers or cloud services.

For law enforcement, the 2018 Supreme Court ruling in Carpenter v. United States established that police need a warrant to obtain cell-site location information (CSLI) from carriers. Before Carpenter, many agencies used subpoenas, which required a lower evidentiary standard.

State-level variation

Several states have enacted their own tracking laws that go further than federal statutes:

• California (CalECPA, 2015) — requires a warrant for all electronic device searches and location data requests by government agencies. The California Consumer Privacy Act (CCPA) also gives residents the right to know what location data companies collect about them.
• Illinois — the Biometric Information Privacy Act (BIPA) covers certain forms of tracking and imposes statutory damages of $1,000 to $5,000 per violation.
• Texas — Penal Code Section 16.06 makes it a Class A misdemeanor to install a tracking device on a vehicle or person without consent, punishable by up to one year in jail and a $4,000 fine.
• New York — GPS tracking without consent is a Class B misdemeanor under Penal Law 120.45 (stalking in the fourth degree).

Is consent-based tracking legal in the US? Yes. If the person being tracked voluntarily agrees to share their location, no federal or state law is violated. This is the approach Tracify takes: the recipient must tap a link and explicitly approve the location request before any data is shared.

Penalties for illegal tracking in the US

Unauthorized tracking can result in federal charges carrying up to five years in prison under the ECPA, or state-level charges ranging from misdemeanors (fines of $1,000 to $5,000) to felonies in extreme cases involving stalking or domestic abuse.

United Kingdom

Key legislation

Phone tracking in the UK is governed by a combination of:

• Regulation of Investigatory Powers Act 2000 (RIPA) — controls surveillance powers for public bodies. Under RIPA, law enforcement can request communications data (including location) from carriers, but must obtain authorization from a senior officer. For more intrusive surveillance, a warrant from the Secretary of State is required.
• Investigatory Powers Act 2016 (the "Snoopers' Charter") — expanded RIPA's scope, requiring internet service providers and telecom companies to retain communications data for 12 months. It also introduced "equipment interference" powers, allowing intelligence agencies to hack devices under warrant.
• UK GDPR and Data Protection Act 2018 — location data is personal data. Any company processing it must have a lawful basis, such as consent, and must comply with data minimization, purpose limitation, and security requirements.

Is tracking legal for private individuals?

Yes, with consent. A parent can track a minor child's phone. An employer can track company-owned devices if employees are informed. One adult can track another adult only with that person's explicit consent. Installing spyware or covert tracking apps without consent is a criminal offence under the Computer Misuse Act 1990, carrying penalties of up to two years in prison.

Penalties

Unlawful interception of communications: up to two years' imprisonment. Unauthorized access to computer systems (including phones): up to two years under the Computer Misuse Act, or up to 14 years if done with intent to commit further offences.

European Union (GDPR)

The GDPR framework

The General Data Protection Regulation applies across all 27 EU member states and treats location data as personal data. Key requirements for anyone processing location information:

• Lawful basis — consent is the most common basis for phone tracking services. Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not count.
• Data minimization — you can only collect the location data you actually need. Continuous tracking when you only need a one-time location check would violate this principle.
• Right to erasure — the person being tracked can request deletion of their location data at any time.
• Data Protection Impact Assessment (DPIA) — required when tracking is likely to result in high risk to individuals' rights and freedoms.
• Cross-border data transfers — location data sent outside the EU must be protected by Standard Contractual Clauses or an adequacy decision.

Penalties

GDPR violations can result in fines of up to 20 million euros or 4% of annual global turnover, whichever is higher. In practice, enforcement authorities have issued fines ranging from a few thousand euros for minor breaches to hundreds of millions for systematic violations by large companies.

For a broader look at how consent factors into tracking legality, see our post on whether phone tracking is legal.

Australia

Key legislation

• Telecommunications (Interception and Access) Act 1979 — prohibits interception of communications in transit, including location pings, without authorization. Law enforcement can access location data with a warrant or, for metadata, with an authorization from a senior officer.
• Surveillance Devices Act 2004 (federal) — makes it an offence to use a tracking device to determine someone's location without their consent or a warrant. Each state and territory also has its own surveillance devices legislation.
• Privacy Act 1988 — the Australian Privacy Principles (APPs) require organizations to collect personal information (including location data) only with consent and for a stated purpose.

Is consent-based tracking legal?

Yes. If the person being tracked provides informed consent, it is lawful under both federal and state legislation. Employers can track company devices with disclosure. Parents can track minor children's devices. Tracking an adult without consent is a criminal offence under the Surveillance Devices Act, carrying penalties of up to two years' imprisonment and fines of up to AUD 55,000 at the federal level.

Canada

Key legislation

• Criminal Code, Section 184 — prohibits interception of private communications without consent. Courts have interpreted "private communications" broadly enough to include location tracking in some circumstances.
• Personal Information Protection and Electronic Documents Act (PIPEDA) — requires organizations to obtain meaningful consent before collecting, using, or disclosing personal information, including location data. Consent must be informed: the person must understand what data is being collected and why.
• Provincial privacy laws — Alberta, British Columbia, and Quebec have their own private-sector privacy legislation that is substantially similar to PIPEDA.

Is tracking legal?

Consent-based tracking is legal. Covert tracking without consent is likely to violate PIPEDA and may constitute criminal harassment under Section 264 of the Criminal Code if it amounts to stalking. Penalties for criminal harassment include up to 10 years' imprisonment.

India

Key legislation

• Information Technology Act, 2000 (IT Act) — Section 43 covers unauthorized access to computer systems, and Section 66 criminalizes computer-related offences. These provisions extend to mobile devices.
• Digital Personal Data Protection Act, 2023 (DPDPA) — India's first comprehensive data protection law. It requires explicit consent for processing personal data, including location information. Data fiduciaries must provide clear notice about what data they collect and why.
• Indian Telegraph Act, 1885 — gives the government broad powers to intercept communications in the interest of national security, sovereignty, or public order.

Is tracking legal?

Consent-based tracking is lawful under the DPDPA. However, the government retains wide-ranging surveillance powers under the Telegraph Act and IT Act Section 69, which allows the government to intercept, monitor, or decrypt any information transmitted through a computer resource. For private individuals, tracking someone's phone without their consent is punishable under the IT Act with imprisonment of up to three years and fines of up to INR 500,000 (approximately USD 6,000).

United Arab Emirates

Key legislation

• Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes — replaced the earlier cybercrime law and significantly tightened penalties. Article 44 prohibits eavesdropping, interception, or recording of communications without authorization.
• Federal Decree-Law No. 45 of 2021 on Personal Data Protection — the UAE's first standalone data protection law. It requires consent for processing personal data and mandates that data controllers implement adequate security measures.

Is tracking legal?

The UAE has some of the strictest cybercrime laws in the world. Tracking someone's phone without their consent can result in imprisonment of six months to three years and fines ranging from AED 150,000 to AED 500,000 (approximately USD 41,000 to USD 136,000). Even possessing spyware can be prosecuted. Consent-based tracking is permitted, but data must be handled in compliance with the Personal Data Protection Law.

Important note for UAE residents

VoIP services and certain messaging apps have been restricted in the UAE. Always verify that the SMS delivery method used by your tracking service is compliant with UAE telecommunications regulations.

Japan

Key legislation

• Act on the Protection of Personal Information (APPI) — revised in 2022 to strengthen consent requirements and impose stricter penalties. Location data is personal information under APPI, and its collection requires informed consent and a specified purpose of use.
• Anti-Stalking Act (2000, revised 2021) — specifically criminalizes repeated location monitoring of another person without consent. The 2021 revision expanded the definition to include GPS tracking and social media monitoring.
• Unauthorized Computer Access Law — prohibits unauthorized access to computer systems, extending to mobile devices.

Is tracking legal?

Consent-based tracking is legal under APPI. However, repeated or persistent location monitoring without consent is a criminal offence under the Anti-Stalking Act, punishable by up to one year in prison or a fine of up to JPY 1,000,000 (approximately USD 6,700). If a restraining order is in place and violated through GPS tracking, the penalty increases to up to two years in prison.

Key takeaways across all countries

After reviewing eight major jurisdictions, several patterns emerge:

1. Consent is universally recognized — every country we examined treats voluntary, informed consent as a valid legal basis for phone tracking. This is why Tracify's consent-first model works globally.
2. Covert tracking is almost universally illegal — installing spyware, intercepting communications, or monitoring someone's location without their knowledge is a criminal offence in every country listed above.
3. Penalties are escalating — across the board, countries are increasing fines and prison terms for unauthorized surveillance. The UAE and EU lead with the heaviest penalties.
4. Parents generally have more latitude — most jurisdictions allow parents to track minor children without the child's explicit consent, though best practice is to inform children about tracking.
5. Employers must disclose — tracking company-owned devices is generally permitted, but employees must be informed. Covert workplace surveillance is increasingly restricted.

For a more technical breakdown of how phone tracking actually works at the network level, see our guide on how phone number tracking works. And if you are weighing up different tracking technologies, our GPS vs. cell tower tracking comparison explains the accuracy and privacy tradeoffs of each method.

How Tracify handles legal compliance

Tracify is designed from the ground up to operate within the legal framework of every country covered in this guide:

• Explicit consent — the person being tracked must tap a link and approve the location request. No data is collected until they do.
• Transparency — the SMS message clearly states who is asking and why. No deception, no hidden software.
• Data minimization — Tracify collects only the GPS coordinates needed to fulfill the request. No continuous background tracking, no location history.
• No app install — because no software is installed on the target phone, there is no unauthorized access to the device itself.

To see exactly how the process works step by step, visit our How It Works page. If you have questions about legality in your specific situation, check the FAQ.

Disclaimer

This article is for informational purposes only and does not constitute legal advice. Laws change frequently, and enforcement varies by jurisdiction. If you are uncertain about the legality of phone tracking in your country, consult a qualified attorney before proceeding.