Worker Location Tracking: What the ICO and 2026 Rulings Say

Picture a van pulling up outside a job in Leeds at half past seven in the morning, the engineer climbs out, taps a screen once to say he has started, does the work, taps again at the end to say he has finished, and that is the whole of what anyone needs to know about where he was. Now picture the other version, the one running quietly in the background, the dashboard back at the office that knows he stopped for eleven minutes near a chip shop on the ring road, that he took the long way round on Tuesday, that he sat in a layby for half an hour on Friday, and that nobody ever told him any of this was being recorded. Both of these are called location tracking. Only one of them is going to keep you out of trouble in 2026, and the gap between them is wider than most employers think.

The reason the gap matters is that the rules around watching people while they work have hardened, and they have hardened in a very specific direction. The Information Commissioner’s Office published its guidance on monitoring workers on 3 October 2023, and it is not a vague wish-list, it is the lens through which the regulator now reads every complaint that lands on its desk. The guidance is blunt about the fact that monitoring has to take account of what workers reasonably expect, that it must not be excessive, and that it must be done transparently wherever possible. The ICO even reaches for a memorable example: a miner would reasonably expect a location device underground, because of the genuine safety risk, whereas an office worker would not expect to be tracked at all, and the difference between those two expectations is the difference between lawful and unlawful.

And here is the part that catches people out, because location data is personal data even when nobody’s name is attached to it. You do not need a label reading “Dave’s van” for a court or a regulator to treat a string of coordinates as information about an identifiable person, since the vehicle maps to a driver, the driver maps to a shift, and the shift maps to a human being who has rights. This is settled doctrine across the UK and the EU, what the lawyers call indirect identification, and it means the polite fiction of “we only track the vehicle, not the worker” collapses the moment anyone looks at it properly. So before you point a single GPS feed at your fleet, you have to have already answered the harder questions: why, how much, for how long, and have you told them.

The principle is always the same, only the scale changes

The ICO is firm on lawful basis too, and this is where a lot of well-meaning employers reach for the wrong tool. The instinct is to ask the worker to consent, to slip a clause into the handbook and have everyone sign it, but consent given by someone whose wages depend on saying yes is not freely given consent, and a regulator knows it. The guidance tells you to identify your lawful basis at the outset and to try to get it right the first time, because you should not be quietly swapping it later when the original one turns out to be embarrassing. For most field-service monitoring the honest answer is legitimate interest backed by a proper assessment, not coerced consent, and that distinction is not a technicality, it is the whole ball game.

If you think this is just paperwork for cautious lawyers, look at what happened to a company that nobody could call small. In May 2026 Spain’s data protection authority closed proceedings against Amadeus IT Group, the travel-technology giant, with a fine that started at 18 million euros and settled at 14.4 million after the company paid voluntarily, the 20 percent discount being the only mercy on offer. The case had nothing to do with vans and everything to do with the same principle, because Amadeus had taken passenger booking records from 2019 and reused them in a profiling pilot in 2021 and 2022, processing personal data without a valid lawful basis under Article 6 and without telling the people involved under Article 14. Two failures, one underlying rule: you cannot use someone’s data for a new purpose they were never informed of and never agreed to. A multinational learned that lesson at 14.4 million euros. The principle that felled it is exactly the principle the ICO applies to a tracker on a transit van, the scale changes, the substance does not. If you want the full anatomy of that decision, the breakdown of the Amadeus GDPR fine is worth ten minutes, and the wider practical guide to employee geolocation under the GDPR walks through how the same rules read for an ordinary workforce.

Track the moment that matters, not the human being

So pull the threads together, because they all point the same way. Location tracking of workers in 2026 has to be purpose-bound, meaning you capture only the moment that genuinely matters to the job and nothing else, it has to be minimal rather than greedy, it has to rest on a lawful basis you can defend out loud rather than consent you squeezed out of someone, and the worker has to actually know. Read that list back and you have not described a surveillance product, you have described the opposite of one, a tool that does the smallest possible amount of watching to get a legitimate job done.

That smallest possible amount is the line GeoTapp was built along, on purpose and from the start. The app captures a location reading at the clock-in and again at the clock-out, one tap to begin a shift and one tap to end it, and in between it does nothing, there is no trail, no continuous feed, no map of where the worker drifted at lunch, because those coordinates are never stored in the first place. The tool refuses to do continuous tracking the way a vegetarian refuses the steak, not reluctantly but by design, and it tells the worker plainly what gets recorded and when. Two honest points in time that prove the work was done where it was meant to be done, and not one byte more, which happens to be precisely the shape the ICO keeps describing when it talks about monitoring that is proportionate, transparent and not excessive.

So when you look at whatever is tracking your people right now, can you say, hand on heart, that it captures only the moment that matters, that you could defend the reason in front of a regulator, and that every worker already knows exactly what it sees? If you hesitated on any of those, the fix is not a longer policy document, it is a tool that was built to answer them for you.