Android Location Services: Google Tracked Users Even With Setting Turned Off

Google has been gathering location data from users with Android smartphones and tablets—even when those users have turned off the location services setting and removed the SIM card, according to a report from Quartz.

Google admitted to developing a system that would be able to track user locations despite users choosing to opt out of such a feature but said it never went through with implementing the system.

Typically with Android devices, users have the option to turn on or off a feature called “location services.” The feature provides exact GPS data for apps to help locate the user. It’s commonly used for navigation apps like Google Maps or ride hailing services like Lyft and Uber to determine exactly where a user is located. When the service is turned off, apps are unable to track a user’s location.

Back in January of this year, Google started collecting user location data another way—bypassing its permission structure that allowed users the ability to opt out of having their location tracked.

Google started collecting data from cellular towers to determine where users were located. Google would gather addresses from nearby cell towers any time a user had a Wi-Fi or cellular connection and would send that data to the system Google uses to manage push notifications and messages on Android devices.

The data was encrypted and Google claimed to have never stored or used the information, though it was collected no matter what—even after a factory reset on the device and even if the SIM card was removed from the phone.

The information from the cell towers could pinpoint a user’s location with a quarter-mile radius—an area that could be narrowed down further with multiple tower pings that could better determine a person’s location and movements.

Google reportedly added the cell tower data collection in an attempt to improve its Firebase Cloud Messaging service, which has to regularly communicate with a server in order to send and receive messages in a prompt fashion.

“In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery,” a Google spokesperson told Quart z. “However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID.”

Google will remove the feature that collects data from cell towers from Android devices by the end of November. However, its inclusion in the first place with no notification or opt-out for users should raise concerns about the priority of user privacy.

There are any number of reasons a person would not want to share their location data, and Google’s practice of collecting cell tower data without explicit permission could potentially put users at risk of harm. While the data collected is encrypted, it is possible for that information to be shared with third-parties or intercepted by a malicious actor.

Even with the update that will remove the cell tower data collection, Google’s terms of service still remain relatively vague and could open users up to other methods of tracking. According to the terms of service, “When you use Google services, we may collect and process information about your actual location” using “various technologies... including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points and cell tower.”