The bill would restrict cellphone companies and mobile apps from sharing location data to situations where they were “providing a service explicitly requested” by the customer. The language is designed to challenge the vague agreements customers click on when signing up for an app or a cellular service. The legislation would also exclude the collection of location data in “exchange for products or services.”

Marc Rotenberg, president of the Electronic Privacy Information Center, said the collection of location data was now the “primary technique to track people in physical space” and “raises far-reaching privacy concerns.”

“New York City is joining a growing list of cities that are not waiting for Washington to pass privacy legislation,” he added.

The bill provides for steep fines, ranging from $1,000 per violation to $10,000 per day per user for multiple violations, while giving customers who have had their location data shared without their explicit permission the right to sue.

David LeDuc, vice president of public policy for the Network Advertising Initiative, said he was concerned about allowing consumers to sue. The civil penalties under the law are “substantial” enough to force compliance, he said.

“Tacking on a private right of action is merely an invitation for unscrupulous trial attorneys to sue companies out of business, in many cases likely for merely making a compliance error where consumers have not suffered any injury,” Mr. LeDuc said.