An investigation by Quartz has revealed that Android devices send cell tower location data to Google even if the user has disabled location services for apps in their device settings.
The company did not limit its collection of data to devices with Location Services enabled, instead opting to collect data from any device that connected to the internet, even if Location Service were disabled and the device did not have a carrier SIM card.
Google spokesperson said in a statement to The Verge that all modern Android phones use a network sync system that requires mobile country codes and mobile network codes, so tower info called “Cell ID” codes were considered an “additional signal to further improve the speed and performance of message delivery.” Google ultimately discarded the cell tower data and didn’t go through with the original plan.
After raising its findings with Google, Quartz reports that a company spokesperson told it the cell tower location data harvesting has been going on for the past 11 months, and that cell tower addresses were included in information sent to the system it uses to manage push notifications and messages on Android devices.
The findings are surprising, given that cell tower data is usually held by carrier networks and only shared with outside companies under extreme circumstances. Through Google’s practices this year, an individual’s particular location within a quarter-mile radius or less could be determined with the addresses of multiple cell towers.
This has particular security implications for individuals who wish to not be tracked, meaning that the safest way to avoid being tracked at all is probably to stick to burner phones. It could also create a bigger target for hackers looking to obtain personal information.
