Why location can be tracked at all
“Location tracking” is the process of inferring where something is (typically a person’s device) using observable signals. Even when you do not share an address directly, systems can estimate location from:
- Device data: GPS, Wi‑Fi scanning, Bluetooth beacons, cellular signal measurements, and sensor context.
- App and account context: whether an app is allowed to access location, and whether you’re signed in.
- Network signals: approximate location can be derived from where network services are provided.
- Web tracking mechanisms: some browsers and websites can request geolocation and can also combine indirect identifiers.
A key takeaway is that location tracking is rarely one single method. It’s usually a combination, which is why different changes (permissions, browser settings, or network choices) can reduce different parts of the signal.
How location tracking typically works
Most practical location tracking systems follow a pipeline like this:
- Collection: a device or app gathers signals (GPS readings, nearby Wi‑Fi names, cellular tower info, etc.).
- Processing: the device or a service converts those signals into an estimate (often an “approximate” area rather than an exact street address).
- Sharing: the estimate is used by an app feature (maps, location reminders) or is transmitted to a backend service.
- Inference and enrichment: trackers may combine location estimates with other identifiers (account history, cookies, device attributes) to build a more complete profile.
Common accuracy modes
When location is exposed, accuracy often depends on what’s used:
- GPS-based estimates can be more precise outdoors but may still vary with conditions.
- Wi‑Fi/cellular-based estimates are commonly less precise, but can still pinpoint an area.
- “Permission-level” exposure matters: some systems can access location “while using” an app, while others can access it in the background.
Because exact behavior varies by device, operating system, and app, you should treat any location setting as a “control that changes exposure,” not as a guarantee.
Differences and limits: what you can and can’t stop
It’s tempting to think you can fully prevent tracking, but in practice there are constraints.
1) Permissions limit access, but don’t erase history
Tightening location permissions can reduce future sharing, but it usually cannot instantly remove data already collected by an app or service.
2) “Approximate location” is still location
Even when a setting is labeled “approximate,” the result can still reveal meaningful patterns such as commuting routines or city-level movement.
3) Indirect identifiers can continue to enable inference
Even if you reduce direct location access, tracking may still be possible through indirect signals, such as:
- account-based activity across services,
- persistent web identifiers (e.g., cookies),
- device-related fingerprints.
This doesn’t mean you are exposing an exact GPS coordinate every time—rather, it means location-related insights can persist without explicit GPS access.
4) Location services can have multiple entry points
Location can be requested by different components: operating system services, individual apps, browser APIs, and sometimes third-party content. If only one entry point remains permissive, tracking can still happen through that path.
Practical checks you can do today
Use these checks to understand what is being shared in practice.
Check 1: Audit location permissions on your device
Review each app’s location permission and look specifically for:
- apps allowed in the background,
- apps with access set to always rather than while using,
- apps you don’t actively need location for.
Then test: use the app for its normal purpose and see whether location access is shown while it runs (the exact UI differs by OS, but the concept is the same).
Check 2: Verify browser geolocation prompts and settings
On websites that use geolocation, the browser can request location via geolocation APIs. Confirm:
- which sites you previously allowed,
- whether location access is set to “ask” or “deny,”
- whether a site can request location without clear user action.
If location is not necessary, denying geolocation requests reduces direct exposure.
Check 3: Compare “location enabled” vs “location disabled” behavior
Perform a controlled test:
- note what features break or change when you disable location access,
- observe whether the same website or app still behaves as if it knows your location.
If behavior continues, it suggests the system may rely on indirect signals (e.g., saved preferences, network-based approximations, or identifiers).
Check 4: Look for consistent patterns across apps
If many unrelated apps can “know” where you are, it may indicate broad permission scopes, sign-in context, or shared identifiers. Narrowing permissions and using separate browser contexts can help you see what changes.
Limitations to keep in mind (so expectations stay realistic)
Even with careful settings, you may not be able to eliminate all location-related inference. The most realistic goal is to:
- reduce how precisely location is determined,
- reduce how often it is shared,
- limit which services can request it.
If your threat model includes high sensitivity, focus on the chain of permissions and data flows rather than a single setting. Also remember that app behavior can change with updates, so re-check permissions periodically.