How does Google know where I am?
Whenever I open the Google Maps app on my Android mobile phone, Google always seems to know my location, and it is very accurate (usually it places me on the map even in the correct room). Also, this happens even if both WiFi adapter and GPS are off. I know WiFi adapter off doesn't really mean anything, and I have heard Google uses information about nearby routers to geolocate you. But doesn't this mean ISPs are providing Google all (or some) of their routers' location?
As far as I know, no private company aside from my ISP should know sensitive data like my location, name, etc ... So, how does Google locate me so precisely?
As an interesting anecdote, my DSLR doesn't have geotagging information, but if I had my phone in my pocket, took photos somewhere, and uploaded them to Google Photos it will a̶u̶t̶o̶m̶a̶g̶i̶c̶a̶l̶l̶y̶ creepily tag them with the accurate location.
There are 2 location permissions. Fine and coarse. One using gps and the other alternative data (whatever else is avaible to guess your location). In the newest android version you should be able to revoke both in the app settings under permission. (source: am android app dev) On a side note, before android 6 you agreed to the permissions on installing an app, now you can revoke them at any time.
"But doesn't this mean ISPs are providing Google all (or some) of their routers' location?" http://www.zdnet.com/article/how-google-and-everyone-else-gets-wi-fi-location-data/
@WayneWerner Because Google assumes that you are where your phone is, so if you upload photos with a timestamp it assumes they were taken at the same location your phone was at.
@Snowbody: I take photos with an old digital camera without GPS, upload them to Google Photos in a different location, and Google Photos still creates albums titled with the name of the place the photos were taken. The only way it has to know where they were taken is to do a Google Images search, and probably I inadvertently help it a lot by taking photos of monuments.
@Snowbody oh yeah, I knew *how* they were doing it, it was just a bit creepy, especially since it wasn't something that I (explicitly) opted in to. And the first place it tagged wasn't even a place that I live, it was a relative's town. I'm sure they knew whose house I was at, though, and didn't want to creep me out that much.
@Pere If your camera at least dates the pictures it could cross-reference that with Google's location history to find out where you were at the time.
Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location without GPS?”:
Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC address of a access point that gets broadcasted by that access point. It is therefore "public viewable" if the BSSID broadcast is enabled, which is the default for most access points. The BSSID operates on a lower layer as the IP stack, you don't even have to be connected to an access point to receive these broadcasts.
So, essentially, when you ARE using WiFi and GPS, Google's database of BSSIDs is updated with a geographic location associated with that BSSID, as you've assumed. In your case, your AP is sending beacons advertising its BSSID, and because it is already in Google's database, Google Maps knows where you are based on the location of that AP.
So it's not that the ISP is giving Google the location of their routers, it's that your phone has already helped to build a database of the Access Points around you, and Google uses this data for geolocation.
Sadly, even if you get a new router and keep any and all Android devices away from it, they will still be able to approximate your location based on the cell towers your phone connects with (or maybe even your neighbor's AP!), but it won't be nearly as accurate.
I saw in the comments questions about whether or not Android phones will receive location data even with WiFi turned OFF. The answer is, yes, absolutely they can. I'm sorry I didn't make that clearer. Better check your settings if you were unaware:
This "feature" has been included since Android 4.3, and prior versions of the Android OS do not include this feature. Thanks to martinstoeckli for this information.
Although turning off this "feature" on your phone seems like the best way to prevent your BSSID from being added to the database, this isn't necessarily the case. You've got other people's phones, the phones of passers-by, and even Google's own Street View cars to contend with. Thanks to Bakuriu for pointing this out.
Though this may be the case, you can opt out of your involvement in this program by appending
_nomapto the end of your SSID. Your SSID is the "name" of the network that you have chosen or have been given. For example, you connect to the SSID "Home" or "D-Link" for your WiFi at home. In order to opt out you would rename your network
D-Link_nomap. Thanks for the tip Andrea Gottardo. For more, refer to the Google Support article about opting out.
How would it get the BSSIDs with WIFI turned off? Or does "off" only mean it's not sending, but still listens to nearby network broadcasts?
@Bergi I remember some Android phones ask during initial setup whether the location service can temporarily turn Wi-Fi on (even though it won't connect to anything) to get location information.
Can you comment on whether the BSSID broadcasting can be disabled? Does this have undesirable side effects?
@E.P. It can be disabled. It is undesirable only in the sense that the ease of connecting to that AP is *slightly* more complicated. If you're the kind of person who knows an SSID can be hidden, you're most likely the kind of person who can easily find a hidden network.
In the latest version (N) of Android, it will also scan for Bluetooth devices in the same way. Both of these can be turned off.
You can change your SSID to tell Google you don't want your access point to be part of their database. Have a look here: https://support.google.com/nexus/answer/1725632?hl=en "You can opt out by changing the SSID (name) of your WiFi access point (your wireless network name) so that it ends with “_nomap”. For example, if your SSID is “12345,” you would need to change it to “12345_nomap”."
Something you didn't mention: when a Google-car goes around taking pictures for StreetView it also maps the location and all wifi networks name. So taking a new router with a new network name from a different ISP might work, but only until they come near your house to update their pictures...
It's also a privacy concern if you ever sell a router. It will be possible to find out its most recent active address. I bought one off a friend a few years back and my iPod Touch located me at his house for a while.
@martinstoeckli & INV3NT3D What was default before that? No scanning when wifi is off or constant scanning but no way to turn it off? Surely it wouldn't work in airplane mode at least?
@Relaxed - No, there was no scanning in Android 4.2 and before, when WLAN was turned off.
As a reference to the comment of @Bakuriu : https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data
A few things to add... since it does use BSSID, some common BSSIDs can actually confuse it. For example, if you're near an airplane that has in-flight wifi, this will confuse it because the airplane shows up in different cities/countries with the same BSSID. This is worse when you're in the air because there are no other nearby APs to check against. Similarly if you're in an area with a lot of chain hotels that have wifi at multiple properties, it might think you're in San Francisco when you're actually in New York.
In Android 6.0.1 this setting, along with Bluetooth, moved to LOCATION>SCANNING: http://i.imgur.com/Q7F2HAy.png?1
@bluesmoon I think you're confusing SSID and BSSID: the SSID is a string chosen by the admin, which will show up in Android's list of nearby wifis. Multiple access points can have the same SSID. The BSSID is a (theoretically) unique hex address in the form of `00:60:97:ba:da:55` which normally can't be changed. Geolocation uses the BSSID, as it is more stable and less collision-prone. The SSID and other parameters might be used as extra criteria to identify moved wifis. Thus, chain hotels are no issue, but mobile wifis, as those on buses or airplanes, can confuse geolocation.
I understand @user149408. An airplane's BSSID remains the same but its geo location changes as it travels, however Google assumes it is static (heck, it still thinks my BSSID is at my old apartment). The SSID was about the hotel. I believe that this might be an additional heuristic by looking at multiple SSIDs, since the likelihood of the same 5 or 6 SSIDs showing up in more than one location is low... unless you're in a popular city with a lot of hotel chains.
It may also be that the app is using your last known location, which just happens to be your current location.
@Bakuriu: or the other way round, you move,take your routers with you, and google is utterly confused about your location for years to come
Even if your Wi-Fi and cellular is off, your phone has an accelerometer. That means vectors still work. Depending on the app you're using, it could have used the initial starting point, say, 2 hours ago before you left cell tower range, and then use accelerometer vectors to calculate movement and therefore a rough current location. You can see this in action while driving around Iceland with Google Maps open. It continues to follow you along the roads, well after you leave Wi-Fi, cell tower, and human habitation ranges.
You disabled WiFi and GPS, but you still have cellular data turned on. That means that the phone is in communication with the local cell towers. Android uses cell tower geolocation to estimate your current location.
Each cell tower has a set of ID numbers that identifies them to the phones. It broadcasts its identity constantly so that phones can connect to it as they move around. Cellular tower antennas are directional, with each tower serving roughly three different areas; you can think of them as three pie-shaped wedges with the cell tower at the center of the pie. Each of those wedges is a "cell" (which is where the technology got its name.)
Each of the radios serving those cells transmits using a certain amount of power - the closer you are to the tower, the stronger the signal your phone receives, and vice versa. Your phone uses the received signal strength to save batteries. The farther away a cell tower is, the more power it takes your phone transmit to it. So a cell phone always tries to lock onto the strongest signal so that it can transmit using the least amount of power. A more useful way of looking at it is that received signal strength represents the rough distance to the cell tower.
So now picture that cell, shaped like a wedge of pie, with the strongest signals received closest to the tower, and weakest furthest from the tower. Imagine slicing the wedge of pie in curved lines ringing the tower, with strong signal strength in the closest slice and the weakest signal in the furthest slice. It looks (very) roughly the WiFi logo. Each of those slices represents some tiny area of the planet, and you're standing in one of them.
If you're in a larger populated area, like a city, your phone will usually get signals from more than one cell tower. So picture the intersection of overlapping slices from tower A, tower B, tower C, and tower D. The intersections define a smaller and smaller area.
So how does Google know any of where these cells, wedges, slices, and intersections are? From the billion Android phones that have GPS turned on (including yours, when your GPS was on), constantly sending reports of their GPS location and what cell towers and signal strengths they see. Google has used this data to map out where each cell is located, and what the approximate signal strength is at each point. They have a giant database on their servers with this information; your phone queries that database by making a network request that lists all cell towers that are in range, and the Google servers respond with your estimated location.
It's all very approximate, of course, because radio signals don't actually travel in perfect little pie wedges - they bounce off buildings and cars, they get absorbed by trees and walls and fog and clouds and people. And new cell towers come and go every day, so the radio transmitter landscape is frequently changing, too. The millions of reports produce only average GPS coordinates. But that's OK, because even imperfect location data is still good enough for most user needs.
Finally, for additional accuracy, the Google Play location services software on your phone keeps track of the last known location of your phone, and may use this to better estimate your current location. In particular, the last known location is a plausible estimate for your current location (under the heuristic that you might not have moved since the last time your location was queried); if this seems consistent with cell tower information, it might be used to improve the accuracy of your estimated location.
Great explanation of cell tower geolocation, but would this account for the accuracy OP describes?
It would certainly help, especially when you account for the massive amount of data that Google has to correlate it with (you know, everybody else)
With this approach, accuracy becomes exponentially greater the more samples you have, and given Google's market share and reach, and longevity, combined with software filtering, they are probably well beyond 4 digits precision in urban regions of the Western world by now.
As I mentioned in my comment to another answer, mobile phones can be location tracked even when they are switched off.
Is there any truth to the rumor that for VSAT internet connections and some remote IP addresses, Google will use ping time to triangulate location on the globe?
@Mok-KongShen , no, mobile phones typically can't be located when powered off. The exception is if your phone has been infected by malware that emulates a powered off state, but this is uncommon. It can also be noticed by the user due to increased battery consumption while powered off. Having a group of people deposit their phones in a Faraday cage before having a sensitive conversation is primarily a good OpSec practice that helps prevent individual mistakes in powering them down properly, not because phones contain magic transmitters.
@INV3NT3D I would expect mapping down to a specific room to only be possible based on Wi-Fi AP BSSID or GPS positioning. If there was a set of femtocell's present in the building that might make positioning possible to a similar degree of accuracy as via Wi-Fi APs. On its own trilateration of normal cell towers will usually only leads to an accuracy of several hundred meters.
@Mok-KongShen there are also stickers to "block radiation" from your phone. They are completely useless (and of course if they did work your phone wouldn't). I suspect the sellers are the same.
@Mok-KongShen, as I said, if you're meeting with unknown people, or people who may not know how to properly switch off their phones every single time you meet, a Faraday bag might help prevent a serious failure of Operational Security. But for everyday use, their main value lies in their profitability for the retailers who sell whatever useless junk they can to paranoid people. And if you're that paranoid, you're much safer leaving the phone at home, or removing the battery from the phone than trusting an overpriced tin-foil hat.
There are also conference rooms of firms that are Farady isolated (certainly done by contractors who claim the efficacy of their work). Do you also consider that protection to be unreliable?
@Mok-KongShen, I never said they were unreliable; I said that they are completely unnecessary (except in extremely rare cases of a malware infection that causes the phone to emulate being powered-off.) Powering off the phone using the ordinary switch is sufficient to prevent it from revealing your location; removing the batteries also solves the malware issue, too. And everyone traveling to a secret meeting site, then dropping all their phones into a Faraday cage, does not prevent someone from seeing that all phones traveled to a common destination at the same time.
By a Faraday protected conference room I meant one whose walls are specially done to function as a Farady cage such that mobile phones in it don't work at all. (To build such rooms is a good business. Goggle will show this.) Similarly on small scale I consider the Farady bags. Of course, one has to well test the quality of such bags by trying to get connections when it is on. If the test is ok, then switch-off and in bag is double security and convenient. I learned the necessasity of battery removal decades ago, told in German news by one who seemed to be knowledgeable from his work position.
@Mok-KongShen, your base assumption is wrong; a phone that is powered off CANNOT transmit location information. Using a Faraday room is a good operational security procedure for people like FBI agents, who use a secure conference room to avoid being overheard without the risk of everyone remembering to shut their phones off. The room is not to protect their location information. It is strictly to defend against unauthorized transmitters. The phones track their locations before entering the room, and after leaving it, and the room obviously doesn't move while they are meeting in it.
Your 1st sentence is contrary to what I learned from news long time ago. As such it's 1-1, i.e. nothing proved. Faraday rooms are not exotic as you claimed but are indeed popular among large commercial firms (someone told me he was in one). Anyway this shows that Farady protection can practically work. Now, assuming that Farady bags work (this could be simply tested), why should one whose location Information shouldn't be known to adversaries (excepting in times without problems, e.g. at home) not use it as a cautious measure of safety which is cheap and simple like a lock of one's door?
How Maps finds your current location Maps estimates where you are from sources like:
Your web browser’s location information. Your phone's location, if you have Location History turned on.
In addition, you can set your default location using the Google Maps app, so you might've done that in the past.
Try changing your default location and test again with GPS turned off
- Click the gear icon at top right to open a menu
- From that menu, click Search Settings, which opens up a new page
- Enter a new default location in the text box for Location
I have never set up my default location, and this is a new phone with an ad-hoc created Gmail account.
What about the first part? Do you have location history turned on? Are you using Chrome on your mobile? Did you ever connect to this gmail from your home computer? Is it possible that there was any chain of events in which you allowed Google to know your location at home and this information passed on to your device via a Chrome login or another Google service?
I have connected my home PC to this Gmail account, indeed, but the question still applies. I don't use Google Chrome. I will check location history settings.
We have a suspect :) Check out all privacy and location settings on your Google account. I can't really recall what the defaults are, but knowing big-data companies like the big G and the big M, they usually opt in new accounts for their "convenient" tracking features by default.
It may be the case that Google doesn't know where you ARE, but knows where you WERE before you switched everything off.
You can test this theory by switching your phone to flight mode, then moving a distance away. If your phone still thinks you are in the old location, then you know that this is the case. Then, you can switch on features on your phone one at a time, and see when it works out that you've moved. That will tell you which radio was used.
Note that, since GPS is entirely passive, a phone in flight mode may still be able to receive it's location from the GPS satellites.
The most of the browsers and mobile devices support
Geolocation APIand the
The W3C Geolocation API is an effort by the World Wide Web Consortium (W3C) to standardize an interface to retrieve the geographical location information for a client-side device.2 It defines a set of objects, ECMAScript standard compliant, that executing in the client application give the client's device location through the consulting of Location Information Servers, which are transparent for the application programming interface (API). The most common sources of location information are IP address, Wi-Fi and Bluetooth MAC address, radio-frequency identification (RFID), Wi-Fi connection location, or device Global Positioning System (GPS) and GSM/CDMA cell IDs. The location is returned with a given accuracy depending on the best location information source available
You can be traced only if you are online via.
GPS (on) - the GPS provides your location and this location "can be" stored in your phone by some apps and when it senses that you are online it can transfer those information right to your location history or on their ends.
Internet - The internet can trace your location via IP address tracing each known router or if you use mobile it can triangulate your location via the cell sites. It's like a triangulation using an ordinary telephone.
- A malware can do the same thing.
There is no way you can be traced when GPS is off and internet is off in real time.
You can turn it off in google by not allowing you're location not to be seen.
*A malware can do the same thing.*? What is this magical geographically aware malware?
Mike - you can very much be traced when GPS is off and internet is off. Look up cell tower triangulation, for example...