Android devices have been sending location data to Google regardless of privacy settings

There are plenty of reasons to turn off location services on your phone. Not only does location tracking use up precious battery life, it’s kind of creepy knowing that your smartphone is tracking your every move.

According to an investigation by Quartz, Android phones have been collecting the addresses of nearby cell towers and sending the data back to Google— even when location services are disabled. This has been happening since the beginning of 2017.

Google has been collecting cell tower data via the system used to manage push notifications and messages. The company says the data was never stored on its servers.

After being contacted by Quartz, Google says it’s now taking steps to end the practice by the end of November.

What is Google’s reasoning behind this? A Google spokesperson explained in an email that using Cell ID codes could help further improve the speed and performance of message delivery on Android phones. “However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID,” the spokesperson went on to say.

No matter which Android device you own, your location was likely being tracked. Google was apparently collecting cell tower data from “all modern Android devices” before Quartz contacted the company. The report didn’t explain how many devices were affected or what the term “modern” entails in this case, but we can assume it’s a pretty big number.

Android devices that have been factory reset, have location services disabled, and even devices that don’t have a SIM card are vulnerable to the data collection. As long as an Android device has a cellular or Wi-Fi connection, it will send location data to Google each time it’s in range of a new cell tower.

One source claims Google started collecting location data after a change in early 2017 to the Firebase Cloud Messaging service.

It’s certainly worth bringing up Google’s privacy policy, which touches on location data collection and how it’s collected. The policy does not mention whether or not location data will be collected when location services are turned off, however:

When you use Google services, we may collect and process information about your actual location. We use various technologies to determine location, including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points and cell towers.

This particular section of the privacy policy might not pertain to this specific data collection practice. A Google spokesperson says the company’s push notification system is “distinctly separate from Location Services, which provide a device’s location to apps.” That may be true, but it’s worth pointing out Android devices never gave users a way to opt out of the collection of cell tower data.

Exactly how cell tower addresses improve message delivery on Android phones is still unclear.

Suffice it to say, this seems extremely intrusive for Google to collect this type of data with no way to opt out. That’s especially true looking at it from a security perspective, as this cell tower data could be compromised if an Android device were to be stolen. Google says the cell tower data is encrypted, but that doesn’t mean it can’t be compromised by a hacker.