How apps track your location

Apps can obtain location through device services when they have the relevant permission. The system may use GPS, Wi-Fi, cellular signals, Bluetooth, and sensors; the combination depends on the device and settings. Separately, a service may estimate your general area from your IP address or obtain information from content you send.

Start with the permission for the app you need. Then check saved history and the data you share with photos separately. One switch does not control all these sources.

Record storage is covered in the article about centralized data storage risks. Analysis of user data is discussed in the article about AI in surveillance.

What signals apps use to locate you

Distinguish sources the system may use from data available to a particular app:

• GPS and other satellite systems: help determine coordinates if the device supports reception.
• Cellular networks and Wi-Fi: are used by location services alongside other available signals.
• Bluetooth: Apple lists it among Location Services sources. This does not give every app access to every beacon.
• Sensors: Google describes using the accelerometer and gyroscope in Android’s location accuracy feature. A sensor’s presence does not confirm that an app reconstructs a route.
• IP address: may be used to estimate a general area independently of an app’s permission to access coordinates.

GPS.gov gives a typical accuracy radius of about 4.9 meters for GPS-enabled smartphones under open sky. Accuracy worsens near buildings, bridges, and trees. This is the source’s reference figure, not our test result or an accuracy guarantee for every app.

The available signals and result depend on the device, conditions, and settings. The list above is not an inventory of what every app receives.

How apps get access to location data

Check access timing and available precision separately in permissions. Android and iPhone offer access while an app is in use and other modes; the choices depend on the system and app. Approximate location is not a complete denial of coordinates, and precise location does not mean GPS alone is used.

Android’s system-wide location accuracy feature and the precision switch for an individual app serve different purposes. Do not treat them as one permission.

An embedded SDK is third-party code inside an app. Google Play’s user data handling requirements also apply to this code. A store rule does not confirm that a particular developer follows it; check recipients and processing purposes in the app’s policy.

Why companies are so interested in your location

The purpose depends on the product. Google, for example, describes using location to find nearby restaurants and display traffic information.

Data can also be used for advertising. The FTC’s announcement about InMarket describes matching visit histories to points of interest and sorting consumers into advertising segments. This describes a particular case, not how every app necessarily works.

Before granting access, check which feature needs the information, whether it serves other purposes, and who receives it.

Less obvious ways your location is tracked

Denying an app access to coordinates does not erase information you already shared or send another way:

• The connection’s IP address may be used to estimate a general area.
• A photo may contain capture coordinates. A recipient can see them if the metadata survives sharing.
• An address, place tag, or route description you provide itself conveys location information.

Wi-Fi and Bluetooth behavior depends on permissions, system version, and the feature. Do not treat them as a universal way around denied location access. A device identifier is not itself a set of coordinates.

What risks constant location tracking creates

On January 18, 2024, the FTC announced its case against InMarket. According to the Commission, the company collected and used location for advertising without adequate disclosure and consent. Sources included third-party apps with the company’s embedded SDK.

The FTC also cited five-year retention of location data and risks of disclosure, misuse, and linking records back to consumers. These were conditions in the case, not a typical retention period for all apps.

For your app, check the records collected, retention period, recipients, and available deletion procedure. A visit or a model’s inference should not be treated as an established fact about a person’s health, beliefs, or family circumstances.

What can be established from movement history

In the 2013 study Unique in the Crowd, four randomly selected points in space and time uniquely characterized 95% of traces among 1.5 million users in the studied mobile operator dataset.

This was the result of matching records in one dataset. It does not mean 95% GPS accuracy, automatic identification by name, or the same analytical performance from every app today. The study also does not test all modern AI models.

Check separately which data were used, what the model estimates, and how its output is checked. A prediction of a future visit remains a prediction. AI in surveillance is covered in a separate article.

How to check location access

Check app permissions, history saving, and data before sharing separately. After a change, reopen the setting and check the feature you need. A switch’s state does not confirm deletion of previously shared records.

How to check an app’s permission on Android

1. Find the app icon and touch and hold it.
2. Select App info.
3. Open Permissions → Location.
4. Check the available modes. If access is unnecessary, select Don't allow. If it is only needed during use, consider Allow only while using the app.
5. If Use precise location is available, check whether approximate location is sufficient and turn precision off if appropriate.
6. Reopen the app and check the feature you need.

Google’s instructions include Pixel and Android version conditions; paths and options may differ on other devices. Use the manufacturer’s help if the menu differs. Restricting permission does not delete records from the app’s server.

How to check an app’s permission on iPhone

1. Open Settings → Privacy & Security → Location Services.
2. Find and select the app.
3. Check the available options. If access is unnecessary, select Never. If it is needed during use, check While Using the App.
4. If exact coordinates are unnecessary, turn off Precise Location if available.
5. Reopen the app and check the feature you need.

Options depend on the app and system version. As Apple’s instructions explain, sharing approximate location is not the same as denying all location data.

How to check Google Maps Timeline on Android

1. Open Google Maps and check the selected account.
2. Tap your profile picture → Your Timeline.
3. Open More → Location & privacy settings.
4. Check Timeline’s state. If it is on and you want to stop saving, open Timeline is on and select Turn off following Google’s instructions.
5. Check deletion of earlier records, backups, and data on other devices separately. Read the consequences before confirming deletion.

Timeline is stored on the device; if you choose backup, an encrypted copy is saved on Google’s servers. Turning off Timeline does not control every other use of location.

How to hide location when sharing an iPhone photo

1. Open Photos and select the picture.
2. Tap the share button and open Options.
3. Turn off Location. Check whether Location Not Included appears.
4. Choose the sharing method you need in the share sheet.

This applies to the selected sharing operation through Photos. It does not delete earlier copies or hide an address or recognizable place within the image itself. To stop adding location metadata to new pictures, separately check Camera’s access to Location Services using Apple’s instructions.

What to check in an app’s policy

1. Find the app’s official policy and version date.
2. Check which location data are collected, for which features, and whether they are sent to third-party recipients.
3. Find the retention period or criteria used to determine it and the deletion request procedure.
4. If the answer is unclear, ask the developer about a specific data category. Keep the response.

A detailed policy helps you ask questions but does not prove compliance or the absence of undisclosed collection. Disclosure requirements are described in Google Play’s rules.

What to check after changing settings

Reopen the selected app’s permission and check the saved mode. Then check the feature you need: does it work without precise or background access? Check Timeline and photo sharing settings separately.

These actions show the state of specific settings. They do not confirm the absence of every way to determine location or deletion of previously collected records. If you need deletion details, ask the app operator for a response.