Investigation Finds Google Collected Location Data Even With Location Services Turned Off

Privacy

from the questionable-practice-raises-Fourth-Amendment-questions dept

What if you take every precaution you can possibly take to avoid leaving a digital trail of your movements… and it still doesn’t matter?

Many people realize that smartphones track their locations. But what if you actively turn off location services, haven’t used any apps, and haven’t even inserted a carrier SIM card?

Even if you take all of those precautions, phones running Android software gather data about your location and send it back to Google when they’re connected to the internet, a Quartz investigation has revealed.

Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google.

So much for going off the grid. There are some caveats to Google’s permissionless collection of cell site location data, with the most significant being the fact Google didn’t store the auto-collected cell tower info. That doesn’t excuse the practice, but it at least keeps it from becoming tracking data the government can access without a warrant.

Google’s collection of cell tower data occurred when notifications were pushed or phone users utilized the phone’s built-in messaging service. In both cases, it’s reasonable to assume users weren’t expecting Google to be collecting this data. (It wouldn’t be necessarily reasonable to assume cell providers weren’t, as that’s what’s needed to deliver messages and notifications if the user isn’t using a WiFi connection.) But no one would reasonably assume the operating system would still send cell tower info to Google with the SIM card pulled.

This is a troubling practice to be engaged in, no matter how temporary the storage of cell site data. It flies directly in the face of what phone users expect when they shut off location services or undertake other affirmative actions to minimize their digital footprint.

SIDEBAR:

This does raise some interesting Fourth Amendment questions, even if the circumstances under which the collection occurred make it unlikely these factors will ever be the centerpiece of a motion to suppress evidence. US courts have made it clear on multiple occasions there’s no expectation of privacy in cell site location records. Judges have stated cell phone users should know cell companies collect tower location data to provide service to their phones. According to this line of thinking, the third party location records have no expectation of privacy because phone users are aware of the realities of cell phone usage: phones connect to towers and create records of the tower’s location.

The question in this case would be whether the expectation of privacy is still nonexistent when phone users undertake deliberate efforts to disable the collection of location records. It would seem these efforts would restore an expectation of privacy — at least if judges are going to be consistent and intellectually honest. As some judges have pointed out, defendants who don’t like being tracked by their cell phones can just not use them. (This is still a somewhat ridiculous assertion — roughly comparable to the TSA suggesting people who don’t like invasive searches/biometric data gathering can just choose to not fly. Both ignore the realities of the modern world.)

If a person makes efforts to prevent collection of location info and a company does it anyway, should law enforcement still have warrantless access to these records? This remains a hypothetical question, but given the amount of surreptitious tracking performed by a number of tech companies (providers, ad networks, etc.), it won’t remain hypothetical forever.

Phones generate a wealth of third party records just a subpoena away from being in the government’s possession. Users cannot possibly be aware of all the information gathered by multiple companies each time they use their smartphone, but they do “reasonably expect” shutting off location services means no one (outside of their service provider) will be gathering location data. Would someone, in performing these actions, be granted a higher expectation of privacy as a result of their actions? Or would a court treat savvier digital natives the way it treats the unwashed masses who make zero effort to limit collection of location info?

Filed Under: 4th amendment, android, location, privacy, tracking
Companies: google