Amid reports that the U.S. government is collaborating with tech companies to understand Americans' movement during the coronavirus pandemic, legal implications of the practice depend on how closely companies adhere to their stated privacy practices and on how anonymous anonymized data truly is.

In response to the ongoing outbreak, mobile advertising and tech firms are offering up their geolocation data to track the spread of the virus and the adoption of social distancing. Now, government officials at the federal, state and local level are hoping to use this data to better understand current public behavior, according to The Wall Street Journal. Companies note that the data is anonymous and thus protects user privacy, but privacy experts are divided on how the sharing of this data comports with privacy laws and consumer expectations.

READ MORE: Sign up for our weekly coronavirus newsletter here, and read our latest coverage on the crisis here.

Michelle Cohen, member and chair of the privacy and data security practice at the law firm Ifrah Law PLLC, said in an interview that it is "generally considered reasonable" for privacy policies to state that a company collects and shares nonpersonally identifiable information.

"In most privacy policies, when it comes to anonymized info, organizations often speak more broadly, indicating they may share with third parties for research and analytics uses," she said.

Unacast Inc., a New York City-based startup, uses anonymous device location data to assess social distancing. The company recently created a Social Distancing Scoreboard, which assigns counties and states grade letters based on whether residents have reduced their travel around town amid the outbreak.

In its privacy statement, Unacast says that in disclosing partner-provided data to third parties, it does not include any data that can directly identify a user of a mobile device, such as a name, mobile phone number or an email address.

Unacast also says in its privacy policy that when it comes to data collected automatically on its website, it "may disclose information to third parties in an aggregate format that does not constitute personal data and does not allow the identification of individual users."

However, some argue that certain data capturing claiming to be anonymous is not, in fact, anonymous.

"Re-identification of de-identified data is a constant infosec threat," Electronic Frontier Foundation staff attorneys Adam Schwartz and Andrew Crocker wrote in a March 23 blog post, noting that location data is particularly concerning since "location data points serve as identification of their own."

For instance, Ashkan Soltani, who previously was the chief technologist at the U.S. Federal Trade Commission, recently pointed to a visualization that used anonymous data to show people congregating on a beach in Florida amid the pandemic.

"Tracking the precise GPS location of a device when it goes 'home after being at the beach' is not 'anonymized' as it would reveal its home address," Soltani wrote in a March 29 tweet.

Soltani said the data for the visualization came from X-Mode Social Inc, an information technology company that monetizes location data. The company says on its website that its data is aggregated at the advertising ID level and associated to a device, but not a physical person.

When it comes to use of de-identified information, the company's privacy policy says it may use aggregate, de-identified data for "any purpose," including research and marketing, and "may also share such data with any third parties, including advertisers, promotional partners, and sponsors."

As for possible legal risks associated with the practice of sharing location data with third parties, Cohen said the FTC could have the authority to step in and take action if a company handles or shares data in a way that is at odds with its stated privacy policy.

"If you say something in your privacy policy and you're not following that, then that's the FTC issue right there, because you're making a false or deceptive statement," she said.

But Cohen noted that the FTC has recently focused on companies that did not protect personal and identifiable information.

For example, the agency went after Facebook Inc. and the data analytics and consulting company Cambridge Analytica LLC after the latter company was found to have engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting. Specifically, the agency said users of an app associated with Cambridge Analytica were told they would not have their names or identifiable information collected. The app did, in fact, collect that personally identifiable information.

Cohen said an FTC case against anonymous data practices would be more challenging.