Geofencing event histories

Detects geofencing event histories: a geofence event / location history log phrase combined with populated location data - precise coordinate pairs, labelled geofence/zone values or labelled device/advertising identifiers. Phrase-only mentions (developer guides, app permissions) stay discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Enforce tiers require populated location data (precise coordinates, labelled geofence values or device identifiers) beside the geofence phrase; developer documentation and app-permission notices stay at 65, as do header-only exports. 'location data' and 'proximity alert' were removed from the primary as too generic. Medium because fleet telematics logs share the structure.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
Frameworks: ISO 27001, ISO 27701
Data categories: pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:geofenc(?:e|ing)\s+(?:events?|histor(?:y|ies)|logs?|triggers?|breach(?:es)?|entr(?:y|ies)|exits?|alerts?)|location\s+(?:history|tracking)\s+(?:logs?|data|exports?)|boundary\s+triggers?)\b

Corroborative evidence keywords

dwell time, home location, work location, overnight, visit frequency, clinic, place of worship, precise location, background location, repeated visits

Proximity: 300 characters

Should match

Geofence event log - device export device_id,geofence_id,event_type,timestamp,lat,lon,dwell_mins d-99f3a1c7,GF-CLINIC-014,enter,2026-09-12T08:02:11+10:00,-27.46981,153.02512,47 d-99f3a1c7,GF-HOME-001,exit,2026-09-12T07:41:03+10:00,-27.39214,153.00188,0 Home location and overnight dwell time inferred from repeated visits. — Event log - header, coordinates and location-inference evidence (85)
Geofence breach alert Device ID: d-99f3a1c7 Forwarded to the fleet supervisor. — Single labelled device identifier (75)
Fleet telematics - geofence exit alerts, week 38 Vehicle ID: TRK-0417 Geofence: Yatala Depot Last position: -27.38412, 153.17066 Dwell time: 3h 12m overnight outside the depot boundary Repeated visits to the same residential street on four nights; referred to the fleet manager for review. — Fleet alert with labelled vehicle ID, geofence name and precise coordinates plus overnight dwell-time evidence (85)
Geofence breach alert Device ID: d-99f3a1c7 Overnight dwell near the clinic; forwarded to the fleet supervisor. — Single labelled device ID plus overnight/clinic evidence - one structure, so 75 not 85 (a labelled ID is not a column header)

Should not match

Developer guide: create a geofence around each store and log geofence events when a customer enters or exits. Only request background location with consent. — Developer documentation
Geofence events device_id,geofence_id,event_type,timestamp,lat,lon — Blank export - column header only (65)
Police obtained geofence logs covering phones near the protest, a news report said. — News item
unrelated generic text without domain phrases — Unrelated
customer invoice — Generic word pair

Known false positives

Privacy notices, help-centre articles, product pages and policies describing geofencing and location tracking. Mitigation: They name the topic without populated rows, labelled values or identifiers, and guidance/help framing is excluded, so they stay at 65.
Analytics training material and documentation with worked examples of geofencing and location tracking. Mitigation: Training and template framing is excluded; unframed worked examples with realistic rows can still reach 75.
News and industry commentary with aggregate statistics. Mitigation: Aggregate percentages are not keyed to a record identifier, so they do not satisfy the row or labelled-value structures.
Fleet and asset telematics logs. Mitigation: They can reach 75/85 with coordinates and device IDs; vehicle location tied to a driver is still personal information.