Google gathers Android users’ location data even when location services are disabled

Pierluigi Paganini November 23, 2017

Google is secretly gathering location data from billions of Android users, the news is disconcerting and once again raise the debate about user’s privacy.

The disconcerting discovery was made by researchers from Quartz.
Big G has been caught collecting location data on every Android device owner in the past 11 months. The worse news is that the Google is gathering location data even when location services are completely disabled.

“Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals’ locations and their movements that go far beyond a reasonable consumer expectation of privacy.” states Quartz.

The experts discovered that Android smartphones have been collecting the addresses of nearby cellular towers, an information that could be used to track the location of mobile devices with the “Cell Tower Triangulation” technique.
When an Android device is within the range of a new cell tower, it gathers the cell tower address and sends this data back to Google when the device is connected via a WiFi network or cellular data network.
A source familiar with the matter said Quartz that the cell tower addresses were being sent to Google after a change in early 2017 to the Firebase Cloud Messaging service.

The Firebase Cloud Messaging service is the component responsible for collecting location data that manages push notifications and messages on the operating system, unfortunately it cannot be disabled.

“Even devices that had been reset to factory default settings and apps, with location services disabled, were observed by Quartz sending nearby cell-tower addresses to Google.” continues Quartz media.

“Devices with a cellular data or WiFi connection appear to send the data to Google each time they come within range of a new cell tower. When Android devices are connected to a WiFi network, they will send the tower addresses to Google even if they don’t have SIM cards installed.”

Quartz contacted Google for a comment and a spokesman for the company replied that the location-sharing practice was implemented to improve its service.

“We began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery.” said Google spokesperson. 

Google location data

“It has pretty concerning implications,” explained Bill Budington, a software engineer at  the Electronic Frontier Foundation. “You can kind of envision any number of circumstances where that could be extremely sensitive information that puts a person at risk.”

According to the experts there is no doubt, the fact that the Google Android system is collecting location data is a complete violation of user’s privacy.

Why Google collects data from Android devices when all location services are disabled?

Reading the Google privacy policy about location sharing, it is possible to note that the company will collect location information from devices that use its services, but there is no reference to data gathering from Android devices when all location services are disabled.

“When you use Google services, we may collect and process information about your actual location,” Google’s privacy policy reads.

“We use various technologies to determine location, including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points, and cell towers.”

Google declared that never used or stored this location data it collected and that it is now taking steps to end this practice.

According to Google, Android phones will no longer collect location data by the end of this month.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – location data, Google)

[adrotate banner=”5″]

[adrotate banner=”13″]

you might also like

leave a comment