How does Google know where I am?
Whenever I open the Google Maps app on my Android mobile phone, Google always seems to know my location, and it is very accurate (usually it places me on the map even in the correct room). Also, this happens even if both WiFi adapter and GPS are off. I know WiFi adapter off doesn't really mean anything, and I have heard Google uses information about nearby routers to geolocate you. But doesn't this mean ISPs are providing Google all (or some) of their routers' location?
As far as I know, no private company aside from my ISP should know sensitive data like my location, name, etc ... So, how does Google locate me so precisely?
As an interesting anecdote, my DSLR doesn't have geotagging information, but if I had my phone in my pocket, took photos somewhere, and uploaded them to Google Photos it will a̶u̶t̶o̶m̶a̶g̶i̶c̶a̶l̶l̶y̶ creepily tag them with the accurate location.
There are 2 location permissions. Fine and coarse. One using gps and the other alternative data (whatever else is avaible to guess your location). In the newest android version you should be able to revoke both in the app settings under permission. (source: am android app dev) On a side note, before android 6 you agreed to the permissions on installing an app, now you can revoke them at any time.
"But doesn't this mean ISPs are providing Google all (or some) of their routers' location?" http://www.zdnet.com/article/how-google-and-everyone-else-gets-wi-fi-location-data/
@WayneWerner Because Google assumes that you are where your phone is, so if you upload photos with a timestamp it assumes they were taken at the same location your phone was at.
@Snowbody: I take photos with an old digital camera without GPS, upload them to Google Photos in a different location, and Google Photos still creates albums titled with the name of the place the photos were taken. The only way it has to know where they were taken is to do a Google Images search, and probably I inadvertently help it a lot by taking photos of monuments.
@Snowbody oh yeah, I knew *how* they were doing it, it was just a bit creepy, especially since it wasn't something that I (explicitly) opted in to. And the first place it tagged wasn't even a place that I live, it was a relative's town. I'm sure they knew whose house I was at, though, and didn't want to creep me out that much.
@Pere If your camera at least dates the pictures it could cross-reference that with Google's location history to find out where you were at the time.
Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location without GPS?”:
Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC address of a access point that gets broadcasted by that access point. It is therefore "public viewable" if the BSSID broadcast is enabled, which is the default for most access points. The BSSID operates on a lower layer as the IP stack, you don't even have to be connected to an access point to receive these broadcasts.
So, essentially, when you ARE using WiFi and GPS, Google's database of BSSIDs is updated with a geographic location associated with that BSSID, as you've assumed. In your case, your AP is sending beacons advertising its BSSID, and because it is already in Google's database, Google Maps knows where you are based on the location of that AP.
So it's not that the ISP is giving Google the location of their routers, it's that your phone has already helped to build a database of the Access Points around you, and Google uses this data for geolocation.
Sadly, even if you get a new router and keep any and all Android devices away from it, they will still be able to approximate your location based on the cell towers your phone connects with (or maybe even your neighbor's AP!), but it won't be nearly as accurate.
I saw in the comments questions about whether or not Android phones will receive location data even with WiFi turned OFF. The answer is, yes, absolutely they can. I'm sorry I didn't make that clearer. Better check your settings if you were unaware:
This "feature" has been included since Android 4.3, and prior versions of the Android OS do not include this feature. Thanks to martinstoeckli for this information.
Although turning off this "feature" on your phone seems like the best way to prevent your BSSID from being added to the database, this isn't necessarily the case. You've got other people's phones, the phones of passers-by, and even Google's own Street View cars to contend with. Thanks to Bakuriu for pointing this out.
Though this may be the case, you can opt out of your involvement in this program by appending
_nomapto the end of your SSID. Your SSID is the "name" of the network that you have chosen or have been given. For example, you connect to the SSID "Home" or "D-Link" for your WiFi at home. In order to opt out you would rename your network
D-Link_nomap. Thanks for the tip Andrea Gottardo. For more, refer to the Google Support article about opting out.
How would it get the BSSIDs with WIFI turned off? Or does "off" only mean it's not sending, but still listens to nearby network broadcasts?
@Bergi I remember some Android phones ask during initial setup whether the location service can temporarily turn Wi-Fi on (even though it won't connect to anything) to get location information.
Can you comment on whether the BSSID broadcasting can be disabled? Does this have undesirable side effects?
@E.P. It can be disabled. It is undesirable only in the sense that the ease of connecting to that AP is *slightly* more complicated. If you're the kind of person who knows an SSID can be hidden, you're most likely the kind of person who can easily find a hidden network.
In the latest version (N) of Android, it will also scan for Bluetooth devices in the same way. Both of these can be turned off.
You can change your SSID to tell Google you don't want your access point to be part of their database. Have a look here: https://support.google.com/nexus/answer/1725632?hl=en "You can opt out by changing the SSID (name) of your WiFi access point (your wireless network name) so that it ends with “_nomap”. For example, if your SSID is “12345,” you would need to change it to “12345_nomap”."
Something you didn't mention: when a Google-car goes around taking pictures for StreetView it also maps the location and all wifi networks name. So taking a new router with a new network name from a different ISP might work, but only until they come near your house to update their pictures...
It's also a privacy concern if you ever sell a router. It will be possible to find out its most recent active address. I bought one off a friend a few years back and my iPod Touch located me at his house for a while.
@martinstoeckli & INV3NT3D What was default before that? No scanning when wifi is off or constant scanning but no way to turn it off? Surely it wouldn't work in airplane mode at least?
@Relaxed - No, there was no scanning in Android 4.2 and before, when WLAN was turned off.
As a reference to the comment of @Bakuriu : https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data
A few things to add... since it does use BSSID, some common BSSIDs can actually confuse it. For example, if you're near an airplane that has in-flight wifi, this will confuse it because the airplane shows up in different cities/countries with the same BSSID. This is worse when you're in the air because there are no other nearby APs to check against. Similarly if you're in an area with a lot of chain hotels that have wifi at multiple properties, it might think you're in San Francisco when you're actually in New York.
In Android 6.0.1 this setting, along with Bluetooth, moved to LOCATION>SCANNING: http://i.imgur.com/Q7F2HAy.png?1
@bluesmoon I think you're confusing SSID and BSSID: the SSID is a string chosen by the admin, which will show up in Android's list of nearby wifis. Multiple access points can have the same SSID. The BSSID is a (theoretically) unique hex address in the form of `00:60:97:ba:da:55` which normally can't be changed. Geolocation uses the BSSID, as it is more stable and less collision-prone. The SSID and other parameters might be used as extra criteria to identify moved wifis. Thus, chain hotels are no issue, but mobile wifis, as those on buses or airplanes, can confuse geolocation.
I understand @user149408. An airplane's BSSID remains the same but its geo location changes as it travels, however Google assumes it is static (heck, it still thinks my BSSID is at my old apartment). The SSID was about the hotel. I believe that this might be an additional heuristic by looking at multiple SSIDs, since the likelihood of the same 5 or 6 SSIDs showing up in more than one location is low... unless you're in a popular city with a lot of hotel chains.
It may also be that the app is using your last known location, which just happens to be your current location.
@Bakuriu: or the other way round, you move,take your routers with you, and google is utterly confused about your location for years to come
Even if your Wi-Fi and cellular is off, your phone has an accelerometer. That means vectors still work. Depending on the app you're using, it could have used the initial starting point, say, 2 hours ago before you left cell tower range, and then use accelerometer vectors to calculate movement and therefore a rough current location. You can see this in action while driving around Iceland with Google Maps open. It continues to follow you along the roads, well after you leave Wi-Fi, cell tower, and human habitation ranges.