Data Minimisation at the Moment of Egress: Enforcing GDPR and EU AI Act Obligations on Precise Location Shared by Apps, SDKs and AI Agents

The GDPR requires that personal data be adequate, relevant and limited to what is necessary (Article 5(1)(c)), used only for specified purposes (Article 5(1)(b)), and protected by design and by default (Article 25). In practice, location is where these principles most often fail quietly. A phone legitimately holds an exact GPS fix for navigation or emergency use. Yet the same coordinate can leave the device at full precision through the app, an embedded analytics or advertising SDK, a background sync or an AI agent’s tool call, when the receiving weather, search or model service needed only a city. Operating-system permissions decide whether an app may read location. They do not decide what precision may leave, to which recipient, for which purpose or under which jurisdiction. Repeated coarse releases can also add up to a movement history that reveals home, work, health visits and routines, exactly the profiling risk data protection law aims to prevent. The EU AI Act sharpens the same problem for AI systems. As assistants and agents act on users’ behalf, a model that decides to forward exact coordinates to a third-party tool creates a disclosure no consent screen described. The Act’s expectations on data governance (Article 10), record-keeping (Article 12), human oversight (Article 14), and robustness and cybersecurity against manipulation such as prompt injection (Article 15) all depend on technical control over what an AI system actually releases. This disclosure turns data minimisation from a written principle into a machine-enforced condition at the point where data leaves the device: Staging. Every outbound location release is held as a non-effective Candidate Act. Precision decision. A Protected Enforcement Domain evaluates the purpose, the requesting component (first-party code, SDK, analytics, advertising or AI agent), recipient, destination, jurisdiction, user authorisation, policy and revocation state, and prior disclosures. It then selects the coarsest sufficient precision on a ladder from EXACT through metre-level, grid, geohash, CITY, REGION and COUNTRY to NONE. Bound authority. It issues signed, single-use, non-bearer authority bound to that precision ceiling, the permitted fields, the recipient and the release point. Payload inspection. An independent egress Finality Sink inspects the actual outbound payload, not the declared label. It blocks any finer value hidden in extra fields, headers, encodings, split values or metadata, and treats unknown formats as non-compliant. Cumulative limit. A protected, device-local accumulator downgrades, delays, randomises or denies releases that would together form a movement profile. Accountability evidence. Each decision produces evidence supporting GDPR Article 5(2) accountability and AI Act record-keeping, without exporting a movement history. Purpose limitation, data minimisation and protection by default thus become verifiable properties of each release rather than policy statements. AI agents receive only the precision their task requires. Transfers to processors or third countries can be bound to approved destinations and jurisdictions. The mechanism is jurisdiction-neutral: it enforces whichever policy a controller adopts and does not itself determine legal compliance. JSON interoperability objects, failure codes, a threat model covering compromised SDKs and AI-agent exfiltration, and a Python reference implementation (98 tests; about 0.5 ms mean local decision time in one test environment) are included. Precise GPS access is not precise GPS-release authority. The GDPR and EU AI Act mapping in this work is AI-generated and is not legal advice. EU AI Act high-risk obligations apply on the timeline set by Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Readers must cross-check the mapping against the official legal texts and the original PCT filings before drawing any conclusion. This technical disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026 (WO 2026/150382). That application claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026 (WO 2026/115520). Related family applications are PCT/IB2026/054453 (WO 2026/150381), PCT/IB2026/055760 (WO 2026/150383), PCT/IB2026/055870 (WO 2026/150384) and PCT/IB2026/056058 (WO 2026/154461). The profile details are as published in Internet-Draft draft-das-precision-bounded-egress-03 on 8 September 2026, and all numbers can be cross-checked on WIPO PATENTSCOPE. Licensed under CC BY-NC 4.0. The author is open to acquihire or strategic collaboration.