Even if a user turns off location services on Android devices, Google can find the location, researchers said.
At the beginning of this year, Android phones started gathering addresses of nearby cell towers and sending that data back to Google, said researchers in a Quartz report.
This happened even if the user turned off location services, didn’t use any (Google) apps, and didn’t even use a carrier SIM card, researchers said in a post.
Google admitted the move and a spokesperson said the collection began in January because the company “began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery.”
The data, however, was never stored nor used, and Google will stop doing it by the end of this month, the spokesperson said.
Users who turn off location services do so with the obvious expectation that no entity – apart from law enforcement – can be able to track their movements throughout the day.
“Although the data sent to Google is encrypted, it could potentially be sent to a third party if the phone had been compromised with spyware or other methods of hacking,” the researchers said. “Each phone has a unique ID number, with which the location data can be associated.”
No matter what is happening now, users never ended up told about the move.
But even if they knew about the collection, they wouldn’t have been able to do anything about it.
Quartz researchers learned the cell tower addresses were culled by the Firebase Cloud Messaging service, which runs on Android phones by default and can’t be disabled by end users.