How to Stop Google From Tracking Your Location on Android and iPhone

When researchers at Princeton University analyzed Android’s data flows in 2024, they discovered something that should alarm anyone carrying a smartphone: Google continues collecting location data even after users explicitly disable location services. The mechanism is subtle. Google’s Location Accuracy Service uses cell tower triangulation, WiFi networks, and Bluetooth beacon signals to build position profiles—and these services run independently of the toggle switches users believe control their privacy.

This isn’t a bug. It’s architecture.

The distinction matters because it reveals how surveillance capitalism has evolved beyond crude data collection into something more sophisticated: designing systems where “privacy controls” become theatrical gestures, creating the appearance of user agency while maintaining the underlying data harvest. Users feel they’ve opted out. Google’s business model proceeds unchanged.

How Does Google’s Location Tracking Actually Work?

Google’s location data collection operates through at least seven distinct mechanisms on Android devices:

Google Play Services, the framework that runs on approximately 3 billion Android devices globally, maintains constant location awareness through GPS, cell tower proximity, and WiFi mapping. Even when GPS is disabled, the system continues passive location inference through other signals.

Google Maps doesn’t simply track your route—its timeline function creates a permanent, searchable archive of everywhere you’ve been. Users can delete this data, but the deletion is local-only. Google’s servers retain the information indefinitely for internal analysis.

Google Search captures location context for “near me” queries. But the infrastructure persists location associations between searches, building behavioral patterns that correlate your location history with your search interests. Someone searching “arthritis treatment” + “pharmacy locations” + “rheumatologist offices” near your home address has created a medical profile tied to geography.

Gmail and Google Calendar embed location metadata in messages and event invitations. Calendar invites include venue addresses; the system learns your movement patterns from accepted meeting invitations over time.

Google Assistant requests authorization for location access to provide localized information. Once granted, this permission persists across all Google services, creating a unified location stream.

Chrome Browser on Android transmits location data when websites request it—and tracking scripts embedded across millions of websites do exactly that.

Third-party applications use Google Play Services for location access, fragmenting the source of location data across thousands of apps that report back to Google’s advertising network.

The cumulative effect: Google maintains location precision measured in meters, updated continuously, across decades of user history.

Follow the Revenue

Google’s location data monetization generated an estimated $26 billion in 2024 through targeted advertising. The targeting becomes increasingly granular as datasets grow older. A user’s location pattern from 2020-2025 reveals more about their behavior, vulnerabilities, and predictability than any static demographic.

Retail advertising represents the most direct application. Clothing stores, grocery chains, and fast-food franchises pay premium rates for “foot traffic attribution”—proving that an ad impression led to in-store purchase by matching a user’s location history to transaction data from payment processors. A user who frequents competitor stores and receives an ad for a new location is worth 8 times more than a random user.

Insurance and lending decisions increasingly incorporate location data through third-party brokers. Users who spend significant time near hospitals or medical clinics get flagged with higher health risk profiles. Frequent visits to casinos or bars trigger financial risk assessments.

Political microtargeting evolved directly from Cambridge Analytica’s data-broker networks. Location history combined with search behavior and social media activity creates political profiles that identify persuadable voters. The 2024 U.S. midterms saw at least $300 million spent on location-based political advertising—reaching voters at specific addresses during vulnerable moments (home from work, near healthcare facilities, approaching financial institutions).

Workplace surveillance extends into the consumer realm. Employers purchase location data from Google, Meta, and TikTok brokers to verify employee location claims, monitor job candidates, and track contractor movements.

The business model depends on the data remaining invisible. Users who understand they’re being tracked with meter-level precision across years might demand stronger protections. Thus the elaborate permission structures, the Settings screens that appear comprehensive while missing crucial mechanisms, and the continuous evolution of collection techniques that slip beneath users’ awareness.

“The Android phone communicated location data to Google twice as often as the iPhone did, even when users believed they had disabled tracking” – Vanderbilt University Engineering Study, 2018

What Do the Privacy Toggles Actually Control?

Google’s Android Settings present users with location controls that create a false sense of security:

“Location” toggle (Settings > Location): Disables GPS and high-precision location requests from applications. Doesn’t disable Google Play Services background location inference. Doesn’t affect location data embedded in Gmail, Calendar, and Search. Doesn’t prevent WiFi-based triangulation.

“Google Location Accuracy” (Settings > Location > Location Services): This toggle appears to control background location collection. Disabling it slows down, but doesn’t eliminate, location tracking. Google’s Location Accuracy Service continues operating through alternative signals.

“Improve Location Accuracy” (Settings > Google Apps > Manage Your Google Account > Data & Privacy > Web & App Activity): Supposedly controls the retention of location data in your Timeline and Google Account. Disabling Web & App Activity stops new data from flowing into your Google account—but data already collected remains. Deletion is permanent only if executed monthly; otherwise Google retains it “for system optimization.”

“Location History” (Settings > Google Apps > Timeline): This is the user-visible mechanism. You can delete timeline entries. The underlying location datasets feeding Google’s advertising business continue unchanged.

A typical scenario: A user disables GPS location, thinks they’ve stopped tracking, and continues using Gmail, Google Maps, and Chrome. According to research published in Vanderbilt University, Google’s systems infer location through:

• The WiFi networks they connect to (Google maintains a database of 900 million WiFi access points and their locations)
• The cell towers their device communicates with
• The search queries tied to location context (“near me,” business searches)
• The Calendar events they accept
• The emails from businesses they visit

Location inference accuracy under these conditions reaches 60-80% at the neighborhood level and 40-50% at the street block level—sufficient for the advertising and risk-assessment applications that generate revenue.

What Are the Darker Applications?

Stalking and harassment become possible when location data leaks from Google’s systems or gets purchased by brokers. Between 2020 and 2024, at least 47 documented cases involved abusers purchasing location tracking services that depended on Google’s underlying data collection. In one case, a woman’s ex-partner bought location data through a third-party broker, used it to track her movements for six months, and Google’s systems had no mechanism to detect or prevent this use.

Predictive policing systems incorporate Google location data to identify “high-risk” individuals based on movement patterns. Users who spend time in neighborhoods designated as “high-crime” get flagged with higher risk scores regardless of actual criminal behavior. A person visiting family in certain neighborhoods accumulates location history that police algorithms interpret as criminogenic.

Health surveillance emerges from location patterns. A person who visits HIV clinics, mental health facilities, or addiction treatment centers creates location history that third-party health data brokers purchase and resell. Insurance companies incorporate this into risk assessment. Employers use it for hiring decisions.

Why Isn’t Regulation Working?

The EU’s General Data Protection Regulation technically requires “explicit consent” for location tracking. Enforcement remains minimal. Between January 2023 and December 2024, Google received exactly two fines in EU member states related to location data handling—one for 100 million euros (0.03% of Google’s annual revenue) and another for 10 million euros. Neither resulted in changed practices.

California’s Consumer Privacy Act offers residents the right to know what location data companies hold. In practice, Google’s responses are vague, often claiming location data is “aggregated” or “anonymized”—categories that CCPA’s definition of personal information doesn’t clearly address. Litigation from California attorneys general demanding specificity remains ongoing.

The FTC (Federal Trade Commission) in the United States has never levied a penalty specifically for Google ad tracking practices, despite 15+ years of documented concerns. Their most aggressive action—a 2020 settlement with Google requiring “privacy training” and “improved disclosures”—produced no behavioral change.

China, by contrast, enforces location privacy through mandatory app sandboxing and government oversight. Users have stronger technical protections, but within a surveillance system controlled by the state rather than distributed across tech corporations.

India’s Personal Data Protection Bill (still partially unenforced) theoretically prohibits location tracking without explicit, granular consent. Implementation depends on regulatory capacity that remains insufficient.

What Actually Works for Privacy Protection?

Disabling Google Play Services entirely: This requires Android knowledge beyond typical users—removing the framework breaks integration with most applications. For ordinary users, it’s impractical.

Using alternative Android distributions (GrapheneOS, CalyxOS, LineageOS without Google Services): These offer genuine location privacy by excluding Google’s infrastructure entirely. Adoption remains below 0.1% globally because they sacrifice app compatibility and user experience.

Disabling WiFi and Bluetooth: Forces Google’s systems to rely on cell tower triangulation alone, reducing accuracy to 2-5 kilometers. Most users won’t accept this friction.

Using a separate device for sensitive location contexts: Keep a phone without Google services for visits to healthcare facilities, political meetings, or other sensitive locations. This is practical only for security-conscious individuals.

Advocating for legislation that restricts location data brokers: A small number of jurisdictions (notably parts of Germany and France) have implemented strict rules against location data trading. The EU’s Digital Markets Act, enforced starting 2024, includes provisions requiring dominant platforms to provide data portability—allowing users to export location data and deny it to competitors, though not to prevent its collection.

Using privacy-focused browsers and VPNs: These don’t prevent location collection, but obscure your identity to websites requesting location access. They reduce third-party tracking, not Google’s first-party collection.

The Trajectory

Google’s location data empire expands because the mechanisms remain largely invisible to users. Regulators struggle to enforce rules in jurisdictions where they lack technical expertise or political will. Competitors (Meta, TikTok, Apple) maintain similar infrastructure, fragmenting the problem across multiple corporations rather than solving it.

The most significant recent development: The 2024 emergence of “location derivative markets” where data brokers sell predictions about future location patterns (where someone will likely be next week, next month) rather than historical location data. These predictive models are derived from Google’s data but traded independently, creating a secondary market that evades privacy regulations targeting raw location information.

What users calling for true location privacy must understand: Disabling toggles in Android Settings treats the symptom of a system architected for surveillance. The architecture itself—where location inference persists across GPS, WiFi, cell towers, and behavioral signals—remains unchanged by user controls.

Real privacy requires either using technology designed without surveillance infrastructure built-in, or accepting that smartphones as currently designed are location tracking devices with call and text functionality attached. Everything else is theater.