The Ways Your Phone Is Located Without Its GPS
The satellite receiver in a phone works out where the phone is and transmits nothing. What reports a person’s location is the cellular connection the phone must keep in order to be reachable, and ther
A common assumption about a mobile phone is that the part of it most dangerous to a person’s privacy is the satellite receiver, the part people call GPS. The assumption is close to backward. A satellite receiver only listens. It takes in faint timing signals from satellites overhead and uses them to work out where it is, and in doing so it sends nothing. The position a phone computes from those signals stays inside the phone until some piece of software chooses to transmit it. What actually reports where a person is, over and over, with no satellite involved, is the ordinary cellular connection the phone must keep open in order to be reachable. It can be read in several ways, and the law treats them very differently.
Figure 1. A satellite receiver takes in signals and computes the phone’s position on its own. The result leaves the phone only when software on the phone transmits it.
The connection itself comes first. For a phone to receive a call or a message, the network has to know where to send it, so the phone continually announces its presence to the nearest cell towers and announces it again as the person moves. The carrier therefore holds, at every moment, a record of which tower and which sector is serving each phone, and from the timing and strength of the signal that record can be narrowed considerably. The rules the government wrote for emergency calls require carriers to locate a caller closely enough to identify the building in most cases, which is the level of precision the network is capable of producing when it is asked to.1 None of this depends on the phone’s satellite receiver, and none of it can be switched off by a person who wishes to remain reachable. The record exists because the phone works the way it must in order to be a phone.
Figure 2. To remain reachable, a phone keeps registering with the nearest towers, so the carrier holds a continuous record of which cell is serving it, narrowed by timing and signal strength.
That record is the subject of the one clear rule in this area. The Supreme Court has held that when the government obtains the accumulated cell-tower records that trace a person’s movements over an extended period, it conducts a search and needs a warrant.2 The same data, however, has moved through commerce with far less friction. Until 2019 the major carriers sold access to their customers’ location information to intermediaries, who resold it to location-finding services, and in at least one documented case a sheriff obtained a person’s location after uploading, in place of a warrant, paperwork that had nothing to do with the request. The Federal Communications Commission fined the four national carriers a combined total near two hundred million dollars, on the ground that a phone’s location is customer information the carriers were required to keep confidential and had not. The carriers contested the penalties on procedural grounds for years, and in 2026 the Supreme Court resolved that procedural dispute in the government’s favor, leaving the penalties in place.3
The second route does not wait for the carrier. A cell-site simulator, known in law enforcement for years by the trade name Stingray, is a portable device that broadcasts as though it were a legitimate cell tower, and broadcasts more strongly than the real towers nearby, so that every phone within range treats it as the most attractive tower and registers with it. In doing so each phone gives up the identifiers that distinguish it, and the device measures the phone’s signal and fixes its location, through the walls of a home or an office.4 Because it imitates the network rather than photographing anything, it needs no clear line of sight, and because it compels every phone in the area to answer, it collects the phones of bystanders who are the target of nothing.
Figure 3. A cell-site simulator broadcasts as a stronger tower so that nearby phones register with it, revealing their identifiers and location, including the phones of bystanders.
How that device has been governed is seen most clearly in New York, where the record is unusually complete because a civil-liberties organization pried it loose. In response to a public-records request, the New York Police Department disclosed that it had used cell-site simulators more than a thousand times between 2008 and 2015 with no written policy in place, and that its practice had been to obtain not a warrant but a pen register order, a lower form of court authorization meant for recording the numbers a telephone dials.5 In 2017 a Brooklyn court, in People v. Gordon, held that a pen register order does not authorize a cell-site simulator at all, and that using one to find a person is a search requiring a warrant supported by probable cause.6 The Police Department has since adopted a policy that requires a warrant in most cases, but it did so under a city disclosure law and a court ruling rather than a state statute.7 New York itself has enacted nothing. Bills to require a warrant, and bills to bar the devices outright, have been introduced repeatedly and have not passed, and while the federal government requires its own agents to obtain warrants as a matter of Justice Department policy, and a handful of states have written the requirement into law, the requirement remains a patchwork rather than a rule.8
The third route reaches a phone without touching it and without the carrier’s cooperation, by exploiting the system the carriers use to speak to one another. To connect a call that crosses from one network to another, and to let a phone work while it roams, the world’s carriers exchange messages over a set of signaling protocols, the oldest of which was designed in the nineteen-seventies for a small circle of national telephone companies that had no reason to distrust one another. That trust is now the weakness. A party with access to the signaling network can ask it, in effect, which cell is serving a given telephone number, and receive an answer, from anywhere in the world, while the phone displays nothing and no software is installed on it. The same access can be used to intercept calls and text messages and, in some configurations, to deliver spyware to the device.9
Figure 4. A party with access to the signaling network that carriers share can request a phone’s serving cell from anywhere, with nothing shown on the device.
This is not a theoretical weakness. In 2024 a senior official at the federal cybersecurity agency told the Communications Commission, in a public filing, that he had seen reliable information of numerous attempts to track people inside the United States through these protocols, and that the reported incidents were likely a small fraction of the total.10 A cybersecurity firm reported that as recently as late 2024 it had watched a surveillance vendor exploit a newly discovered method of getting around the defenses the carriers had installed.11 Because the party doing the tracking is frequently outside the country, no American warrant reaches it, and no American statute governs it.
The fourth route is the one place where the satellite receiver does the damage, and it does so only because the phone’s owner has been induced to give the reading away. Thousands of ordinary applications, a weather app, a game, a coupon service, ask permission to know the device’s location and then pass the precise satellite fix to the commercial data market, either through code the app is paid to include or through the automated auctions that place advertisements.12 Brokers assemble those readings into histories of individual movement and sell them.
Turning off what the phone calls “location” closes one route and leaves three open.
Turning off “location” changes almost none of it. You are still being tracked. The location setting governs the satellite fix and the applications that sell it, and nothing else.
It stops the applications from reading the satellite fix, but the phone still registers with the towers, still answers a simulator, and can still be found through the signaling network, because none of those depend on a setting the owner controls.19
One such broker, marketing its service to local police for less than ten thousand dollars a year, has claimed to hold data drawn from two hundred and fifty million devices in the United States.13
Another, together with its parent company, told regulators it handled more than seventeen billion location signals from roughly a billion phones every day, and that the data it sold was not anonymized and could be traced to individuals.14 The Federal Trade Commission has brought a series of actions against these firms, barring several of them from selling location data that reveals visits to sensitive places such as medical clinics and houses of worship, but the orders carve out exceptions that include national security and law enforcement, which is the use that matters here.15
What turns that market into a route around the law is that agencies buy from it.
A partially declassified report to the Director of National Intelligence found that the intelligence agencies were acquiring growing quantities of commercially available information, including location data, and that they had reached no common position on whether the Constitution required a warrant to do so, with at least one agency telling Congress in writing that it did not read the governing Supreme Court decision to apply to data it had purchased.16
In 2026 the director of the Federal Bureau of Investigation confirmed to a Senate committee that the Bureau buys commercially available data capable of tracking Americans’ movements, and, asked whether it would stop, made no commitment.17 Legislation to close the gap, by forbidding the government to purchase what it would otherwise need a warrant to obtain, passed the House of Representatives in 2024 and was not taken up by the Senate.18
Set side by side, the four routes describe the same fact about the same person, where they are and where they have been, reached by four different means and governed by four different standards. The carrier’s own record is protected by a warrant requirement the Supreme Court has recognized.
The impersonator that summons a phone from the street is governed by an agency policy and by the laws of a few states, and by no federal statute. The signaling network that locates a phone from abroad is governed by nothing that can reach the party using it. The purchased fix is restrained only by consent orders that exempt the government. The one component a person is most likely to picture as the threat, the satellite receiver, is the one that reports nothing on its own.
Figure 5. The same location, reached four ways. A warrant is required for the carrier’s record and, in practice, for none of the others.
None of these routes is new, which is what makes the absence of law around them a finding rather than a delay. The cellular network has located phones for as long as phones have been mobile, and each way of reading it has been documented for years, in court records, in regulatory filings, and in the reports of the agencies themselves. What has not arrived is the law.
New York, which could require a warrant for the impersonator and has been asked to for a decade, has not. Congress, which could close the market in purchased location and has voted on the question, has not. The signaling network has no owner willing to answer for it. In each instance the gap is not an oversight waiting to be corrected but the settled condition under which the tracking proceeds.
The result is a device that reports a person’s location at nearly every layer of its operation. It registers with the towers to stay reachable, and the registration is a record. It answers a stronger signal, and the answer can be forced by a box on the street.
It can be found through the network that joins the carriers, from another continent, with nothing showing on the screen.
And the location it computes for its own use can be bought on the open market from the applications its owner installed.
The one part that stays silent is the satellite receiver most people would name first. A person can switch off very little of this and still carry a working phone, which is the point. The exposure is not a feature that was added to the phone. It is the way the phone connects.
End Notes
1. The 50-meter horizontal location accuracy metric adopted for wireless 911 calls, sufficient to identify the building for most calls, appears in the Commission’s Fourth Report and Order (2015); see the FCC’s overview of 911 and E911 services, https://www.fcc.gov/general/9-1-1-and-e9-1-1-services.
2. Carpenter v. United States, 585 U.S. 296 (2018).
3. Federal Communications Commission v. AT&T, Inc., 608 U.S. ___ (2026), which describes the carriers’ sale of customer location data through intermediaries, the incident in which a sheriff obtained location data after uploading irrelevant paperwork, and the penalties imposed under the customer-information confidentiality provision, and which held that the Commission’s forfeiture procedure was constitutional, https://www.supremecourt.gov/opinions/25pdf/25-406_nmip.pdf. The penalties were approximately 57 million dollars against AT&T, 47 million against Verizon, and roughly 92 million against T-Mobile and the former Sprint.
4. On the operation of cell-site simulators, see the New York Civil Liberties Union memorandum in support of a warrant requirement, https://www.nyclu.org/uploads/2015/04/memo_stingrayuse_NY_201508_final.pdf.
5. New York Civil Liberties Union, NYPD Has Used Stingrays More Than 1,000 Times Since 2008, reporting 1,016 uses between 2008 and May 2015 and the absence of a written policy, https://www.nyclu.org/press-release/nypd-has-used-stingrays-more-1000-times-2008.
6. People v. Gordon, 2017 NY Slip Op 27364 (Sup. Ct., Kings County).
7. New York Police Department, Cell-Site Simulators: Impact and Use Policy (Nov. 24, 2023), which states that in most cases investigators must first obtain a search warrant, https://www.nyc.gov/assets/nypd/downloads/pdf/public_information/post-final/cell-site-simulators-nypd-Impact-and-use-policy_11.24.23.pdf.
8. For a pending New York warrant bill, see Senate Bill S6567 (2025-2026), https://www.nysenate.gov/legislation/bills/2025/S6567. On the Justice Department’s 2015 warrant policy and the states that have enacted warrant requirements, see Project On Government Oversight, Issue Brief: The Cell-Site Simulator Warrant Act, https://www.pogo.org/fact-sheets/issue-brief-the-cell-site-simulator-warrant-act.
9. On the vulnerabilities of the SS7 signaling network, see Electronic Frontier Foundation, EFF to FCC: SS7 is Vulnerable, and Telecoms Must Acknowledge That, https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge.
10. The statement of the Cybersecurity and Infrastructure Security Agency official, Kevin Briggs, to the Commission is described in CISA Official Warns US Telecom Networks Are Vulnerable to Spying, https://www.itbrew.com/stories/2024/05/29/cisa-official-warns-us-telecom-networks-are-vulnerable-to-spying.
11. A Surveillance Vendor Was Caught Exploiting a New SS7 Attack to Track People’s Phone Locations, https://techcrunch.com/2025/07/18/a-surveillance-vendor-was-caught-exploiting-a-new-ss7-attack-to-track-peoples-phone-locations/.
12. On how applications transmit location to the data market through embedded code and real-time bidding, see Electronic Frontier Foundation, Federal Regulators Limit Location Brokers from Selling Your Whereabouts, https://www.eff.org/deeplinks/2024/12/federal-regulators-limit-location-brokers-selling-your-whereabouts-2024-review.
13. On Fog Data Science, its claimed access to data from 250 million devices, its pricing to local police, and its sale of movement data without a warrant, see Electronic Frontier Foundation, Inside Fog Data Science, https://www.eff.org/deeplinks/2022/08/inside-fog-data-science-secretive-company-selling-mass-surveillance-local-police.
14. Federal Trade Commission, FTC Takes Action Against Gravy Analytics, Venntel for Unlawfully Selling Location Data (Dec. 2024), noting processing of over 17 billion signals from roughly a billion devices daily and that the data was not anonymized, https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers.
15. Federal Trade Commission, FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (Jan. 2025), https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-prohibiting-gravy-analytics-venntel-selling-sensitive-location-data. On the national-security and law-enforcement exceptions in these orders, see the Electronic Frontier Foundation review cited above.
16. On the ODNI Senior Advisory Group report and the Defense Intelligence Agency’s written statement that it does not construe Carpenter to require a warrant for purchased commercially available data, see Electronic Privacy Information Center, ODNI Report on Intelligence Agencies’ Data Purchases Underscores Urgency of Reform, https://epic.org/odni-report-on-intelligence-agencies-data-purchases-underscores-urgency-of-reform/.
17. The testimony of FBI Director Kash Patel before the Senate Intelligence Committee, and his refusal to commit to ending the practice, are recounted in Warren Davidson, Americans’ Fourth Amendment Rights Are Not for Sale, https://davidson.house.gov/2026/4/op-ed-americans-fourth-amendment-rights-are-not-for-sale.
18. Fourth Amendment Is Not for Sale Act, H.R. 4639, 118th Congress (2023-2024), https://www.congress.gov/bill/118th-congress/house-bill/4639. The House passed the measure in April 2024; the Senate did not take it up.
19. On the distinction between the location setting, which governs application access to the satellite receiver, and the cellular network's independent record of the serving cell, see Envista Forensics, Is My Cell Phone Tracking Me If I Turn Off Location Services?, https://www.envistaforensics.com/knowledge-center/insights/articles/is-my-cell-phone-tracking-me-if-i-turn-off-location-services/.