Is my phone secretly tracking my location?
A movement history contains no messages or photos, and it still reveals where you live, work, and who you spend nights with. Here is what is actually collecting your location - apps, ad code, photo metadata, Wi-Fi scanning - and how confident you can be that it is really private.
The short answer
- Short answer: yes, more than you likely realise - through apps, embedded advertising code, photo metadata, Wi-Fi/Bluetooth scanning and your mobile network, not just the obvious mapping apps.
- Location history identifies your home, workplace, relationships and medical visits without containing any content at all.
- Location data described as anonymised is trivially re-identified - the place you sleep and the place you spend weekdays name you on their own.
- Setting apps to while-using, with approximate rather than precise location, covers almost every legitimate need and is the single highest-value change.
- Photos carry embedded coordinates, so sharing an image can share your home address unless you strip it first.
Almost certainly, yes — and through more routes than the mapping app you would expect. Location leaks through apps you granted access to, through advertising code embedded inside apps that have nothing to do with maps, through coordinates saved inside your photos, through Wi-Fi and Bluetooth scanning even with GPS switched off, and through your phone connecting to mobile masts. The single biggest fix is going through each app's location permission and setting it to "while using" with approximate rather than precise location — see "what to change" below.
Most privacy discussion is about content — what you said, what you searched, what you bought. Location data contains none of that and is more revealing than any of it.
A movement history has no words in it. It still shows where you sleep, where you work, which building you enter every Sunday, which clinic you visited on a Tuesday afternoon, and whose home you stayed at overnight.
You never told anyone any of that. The pattern says it anyway.
Why anonymisation does not work here
Location data is frequently described as anonymised, meaning the name has been removed. For movement data this offers almost nothing.
Consider what a trace shows without any identifier at all: the address where a device spends most nights, and the address where it spends weekday hours. Those two points identify a person with very high confidence, and they are the most obvious features of any movement history.
How it is collected
Apps you granted access to
The visible route, and the smallest part.
Embedded advertising code
Third-party SDKs inside otherwise unrelated apps report location to advertising and analytics companies. The app's own function may have nothing to do with location. This is a major inflow to data brokers.
Photo metadata
Most cameras embed coordinates and a timestamp in the image file itself.
Wi-Fi and Bluetooth scanning
Nearby network names can locate a device accurately even with GPS switched off, because the positions of Wi-Fi networks are extensively mapped.
The mobile network
Your phone connects to masts continuously. This is inherent to the service and is not something a setting changes.
IP address
Coarse, but present in every connection you make.
What to change
Location permissions — the main event
Go through every app holding location access and downgrade it. The realistic distribution:
| Setting | Which apps |
|---|---|
| Always | Almost nothing. Perhaps a family-safety app you deliberately use |
| While using | Maps, ride-hailing, weather, delivery tracking |
| Never | Games, shopping, news, social, utilities, most of the list |
Then turn off precise location for everything except navigation and ride-hailing. Approximate is a general area of several square kilometres — entirely sufficient for weather, local news and shop finders.
iPhone: Settings → Privacy & Security → Location Services Android: Settings → Location → App location permissions
Stored location history
Both platforms keep a history by default, and it is the single most detailed record either holds about you.
iPhone: Location Services → System Services → Significant Locations. Review it — most people find it startling — and turn it off, or clear it.
Android: Location → Location Services → Location History (in your Google account settings). Turn it off, set auto-delete, or clear it.
Photo location
Stop recording it: iPhone — Settings → Privacy & Security → Location Services → Camera → Never. Android — open Camera, Settings, turn off location tags.
Strip it when sharing: iPhone — in the share sheet, tap Options and turn off Location. Android — depends on the gallery app, but most offer removal on share.
Bluetooth and Wi-Fi scanning
iPhone: Settings → Privacy & Security → Location Services → System Services → turn off Wi-Fi & Bluetooth Networking if you do not need it. Android: Location → Location Services → turn off Wi-Fi scanning and Bluetooth scanning.
Also review which apps hold Bluetooth access — some use it purely for proximity detection, which is location by another route.
Advertising identifiers
iPhone: Privacy & Security → Tracking → turn off "Allow Apps to Request to Track". Android: Privacy → Ads → Delete advertising ID.
This severs the key that links location data to the rest of your profile.
Live sharing
Family location sharing is genuinely useful and worth being deliberate about. Review who has access, whether each arrangement is still current, and whether it should be permanent or time-limited. Sharing set up for one trip in 2023 is frequently still running.
Why it connects to safety
Location data is not only a surveillance question. It is a physical safety one, and it feeds the same fraud machinery as everything else.
A movement pattern reveals when a home is empty. A geotagged photograph reveals where a child goes to school. The FTC's first recommendation for avoiding scams on social media is to limit who can see what you post — because published detail is what makes a targeted approach accurate enough to believe.
See pretexting for how specific, true details are assembled into a story you would act on.
For the settings themselves, one screen at a time on iPhone and Android, how to stop apps tracking your location is the step-by-step version of this page.
See your own location record
Our privacy walkthrough opens the stored history on both platforms and shows what it reveals — then turns it off.
Try it freeFrequently asked questions
- Is my phone secretly tracking my location?
- Most likely, in more ways than the obvious mapping apps. Location is collected through apps you granted access to, third-party advertising code embedded inside otherwise unrelated apps, coordinates stored inside photographs, Wi-Fi and Bluetooth scanning even with GPS off, and your mobile network by virtue of your phone connecting to masts. Reviewing app-by-app permissions is the main lever you control.
- Can anonymised location data still identify me?
- Yes, easily. A location trace does not need a name attached. The place a device spends most nights and the place it spends weekday hours together identify a person with high confidence, and both are visible in any movement history regardless of what identifier is removed.
- Why is location data more sensitive than other data?
- Because it reveals behaviour rather than statements. A movement record shows where you sleep, where you work, which place of worship you attend, which clinic you visited and whose home you stayed at overnight — none of which you ever wrote down anywhere.
- What is the difference between precise and approximate location, and which should I use?
- Precise gives exact coordinates, generally within a few metres. Approximate gives a general area of several square kilometres. Weather, news, shopping and most social apps work perfectly with approximate; only navigation and ride-hailing genuinely need precise, so switch everything else to approximate.
- Do my photos reveal where they were taken?
- By default, yes. Most cameras embed GPS coordinates and a timestamp in the image file. Sharing a photograph taken at home can therefore share your address. Both iOS and Android can strip location when sharing, and the camera can be set not to record it at all.
Sources
- New FTC Data Show People Have Lost Billions to Social Media Scams — Federal Trade Commission, 2026
- About privacy and Location Services in iOS, iPadOS, and watchOS — Apple, 2026
- Manage your Android device's location settings — Google, 2026
- Privacy and Mobile Device Apps — Cybersecurity and Infrastructure Security Agency (CISA), 2022
About the author
Cybersecurity & Digital Literacy
Subash Poudel builds SafeSurf IQ, a digital literacy platform that teaches people to recognise scams by putting them in front of real ones. He writes the online-safety reference material here, working from primary reporting — FBI IC3, the FTC, Verizon's DBIR, NCSC and Ofcom — rather than secondhand summaries.
- Founder and engineer, SafeSurf IQ
- Writes and reviews the platform's phishing, scam and privacy curriculum
- Works from primary incident and fraud reporting, cited on every article
Last reviewed . Figures are checked against the primary sources listed above at each review.
Read next
- Privacy
Online privacy: what is actually collected, and what you can change
Online privacy is not about having something to hide. It is about who holds a record of your behaviour, how precisely you can be identified without cookies, and which of those things you can practically change.
- Privacy
Which app permissions should you turn off?
A dozen apps on your phone are probably still holding location, contacts or microphone access from years ago. Here is which permissions are worth turning off, which are safe to keep, and the ten-minute review that finds them on iPhone and Android.
- Privacy
How to remove your personal information from data brokers
Your name, address, relatives and estimated income are already for sale on people-search sites you have never heard of. Here is how to find what is exposed, remove it from the brokers that matter most, and reduce how quickly it comes back.