Everywhere You Go, Someone Knows: The Uncomfortable Truth About Mobile Location Data

You flipped off location services. You felt good about it. Maybe you even told a friend. But here's the uncomfortable part: your phone almost certainly still knows where you are — and so do a dozen companies you've never heard of.

Location privacy is one of those topics where the gap between what people think they've done and what's actually happening is enormous. The location data industry in the US is worth billions of dollars annually, and it didn't get that way by respecting the off switch.

It's Not Just GPS

Most people picture a little satellite icon when they think about location tracking. That's GPS — and yes, disabling it does cut off one data stream. But your phone has a surprisingly deep toolkit for figuring out where you are.

Wi-Fi positioning is probably the sneakiest. Even if you're not connected to a network, your phone is constantly scanning for nearby routers. Those router signals can be cross-referenced against massive global databases — think Google's Street View cars, which mapped Wi-Fi networks across the country for years — to pinpoint your location within a few meters. You don't have to be connected. The scanning alone is enough.

Then there's cell tower triangulation, which works by measuring your signal strength against multiple towers simultaneously. It's less precise than GPS but accurate enough to place you in a specific neighborhood, store, or block. Carriers have this data by default. It's how your phone works.

Bluetooth beacons are another layer. Retailers across the US — from Target to your local mall — have deployed small Bluetooth transmitters that ping your phone as you walk past. If you have Bluetooth enabled and certain apps installed, those apps can log your path through a store, how long you lingered in the electronics section, and when you left.

And then there's the wildest one: ultrasonic tracking. Some apps embed code that listens for high-frequency audio tones embedded in TV commercials, websites, and even physical retail environments. Your phone's microphone picks up the tone, and suddenly an advertiser knows you were watching a specific TV show in your living room at 9 p.m. on a Tuesday. The FTC has investigated this. It's real.

The App Layer Is Where It Gets Messy

Here's where things get genuinely complicated. Many apps that have no obvious reason to know your location are collecting it anyway — or buying it from brokers who pieced it together from other apps.

Think about a free flashlight app, a weather widget, or a casual game. These apps often request location access during setup, and users tap "Allow" without a second thought. That data gets packaged, timestamped, and sold to data brokers, who then aggregate it with location signals from dozens of other apps to build a remarkably detailed picture of your daily life.

A 2021 investigation by the New York Times showed that a single dataset from one broker contained over 50 billion location pings from more than 12 million Americans — all harvested from apps most users would never suspect. Your commute, your doctor's office, your place of worship, your ex's neighborhood at 11 p.m. — it's all potentially in there.

And the apps don't have to be shady. Even well-known, legitimate apps often share location data with third-party SDKs — little bundles of code from advertising and analytics companies that developers drop into their apps to monetize them. You agree to the app's privacy policy, but that policy quietly covers the SDK's data collection too.

Why "Turning It Off" Isn't Enough

Both iOS and Android have made real improvements to location controls over the past few years. The "only while using" permission, approximate location options, and periodic permission reminders are genuinely useful. But they don't close all the gaps.

For one, apps can still infer your location from your IP address — which changes based on your network but still places you in a city or region. Combine that with your Wi-Fi network name and a few behavioral signals, and you've got a pretty solid location estimate without ever touching GPS.

There's also the issue of background refresh. Some apps that you've restricted from location access can still make educated guesses based on your timezone settings, language preferences, and even the weather data they pull for your "current location."

Practical Steps That Actually Work

Okay, so what do you actually do about this? The goal isn't to turn your phone into a brick — it's to make surveillance meaningfully harder without wrecking your daily experience.

Audit your app permissions ruthlessly. On iPhone, go to Settings > Privacy & Security > Location Services. On Android, it's Settings > Location > App permissions. Go through every single app. Ask yourself: does this app have a legitimate reason to know where I am? If not, set it to "Never" or "Ask Next Time."

Use approximate location wherever possible. Both iOS 14+ and Android 12+ let you grant apps an approximate location rather than a precise one. For most apps — weather, local news, restaurant finders — this is more than enough. Reserve precise location for navigation apps like Google Maps or Waze.

Kill Bluetooth and Wi-Fi when you're not using them. This sounds annoying, but it's the most effective way to block passive scanning. Some phones let you automate this with routines or shortcuts.

Use a VPN selectively. A VPN masks your IP address, which removes one more location signal. It's not a silver bullet, but it adds friction for data brokers.

Delete apps you don't use. Every dormant app on your phone is a potential data collection point. If you haven't opened it in 90 days, it's probably not earning its place — and it may be earning someone else money by selling your data.

Check for ad ID tracking. Both iOS and Android let you limit ad tracking or reset your advertising ID. On iPhone: Settings > Privacy & Security > Tracking. On Android: Settings > Google > Ads. These won't stop all tracking, but they break the continuity of your data trail.

The Bigger Picture

Location data is uniquely sensitive. Unlike browsing history or purchase records, your physical movements reveal things about you that you might never voluntarily disclose — your health conditions, your relationships, your political activity, your financial situation. A pattern of visits to a cancer treatment center, a bankruptcy attorney, or a political rally tells a story that advertisers, insurers, and law enforcement are all very interested in reading.

The US doesn't have a comprehensive federal privacy law governing this kind of data collection yet, though several states — California, Virginia, Colorado — have made moves in that direction. Until there's real regulatory teeth, the responsibility falls on you.

Your phone is an incredibly powerful tool. But it's also a remarkably detailed diary of your life, and right now, a lot of people are reading it without your full awareness. The good news is that a few deliberate choices can make that diary a lot harder to access.