Abstract: A single GPS coordinate reveals almost nothing. A pattern of coordinates can reveal a military base. In 2018, a global fitness-heatmap — built entirely from ordinary jogging routes — accidentally exposed the outlines of sensitive military sites worldwide. It made international headlines. The US Department of Defense changed its policy in response. That was before today's AI. What required a skilled human analyst in 2018 is now something AI can do automatically, continuously, and at a scale no team of analysts could match — correlating fitness routes, delivery records, photographs, and public data into a single high-confidence conclusion. AI can even extract location from a photo with no GPS tag at all. More importantly: AI doesn't need strong signals. It can fuse thousands of individually weak, low-confidence data points — a blurred photo, a delivery timestamp, an approximate cell — into one precise, high-confidence inference. The strength comes from the fusion, not the input. Turning off GPS does not fix this. Historical data, embedded trackers, and third-party libraries keep collecting regardless of what the user switches off. This article does not stop at describing the problem. It sets out a working technical solution: treating location precision as a bounded, purpose-bound capability rather than an on/off permission — enforced at the device and network-gateway level, in real time, without breaking existing infrastructure. Legitimate applications keep the precision they need. Everything else receives only a Normalised Location — enough to function, not enough to expose. The supporting document and the full WIPO publication referenced in this article are uploaded alongside it, with a navigation index for readers who want to go straight to a specific section. No endorsement of this article, its architecture, or its conclusions is requested or implied from any institution. Comments, corrections, and critical feedback are genuinely welcomed.