In 2024, two researchers at the University of Maryland repeatedly queried Apple’s Wi-Fi positioning service, with no special privilege and no specialised hardware, and in a single year reconstructed the precise location of more than two billion Wi-Fi access points worldwide. Their paper, Surveilling the Masses with Wi-Fi-Based Positioning Systems , shows what that map makes possible: tracking equipment moving in and out of Ukraine, observing population displacement after the Maui wildfires, following an individual through their home internet router.
None of those devices had GPS switched on. The position came from somewhere else.
This is the most widespread blind spot in mobile privacy: the belief that there is a location switch, and that once it is off, the phone stops knowing where it is. That belief is wrong on seven separate levels.
Location is not a feature your phone turns on. It is a property of what your phone is.
GPS, the least troubling vector of all
The one mechanism everybody can name is also the one that should worry you least.
GNSS, the umbrella term covering American GPS, Galileo, GLONASS and BeiDou, works by listening. Satellites continuously broadcast timestamped signals, the receiver picks up several of them and computes its position from the differences in propagation time. Typical accuracy in the open: three to five metres, often several tens of metres in a city, where building façades reflect the signals.
The decisive point is that this calculation is passive. The phone transmits nothing towards the satellites, and no satellite operator knows you exist. If GNSS were the only thing in play, turning off GPS would be enough.
There is a caveat, however. To speed up the first fix, phones use A-GPS: they download satellite ephemeris data from a server, over the SUPL protocol. To receive the right data, the phone sends that server the identifier of the network cell it is attached to. Pure GNSS does not betray you, but the accelerator bolted onto it does.
The mobile network: what the operator knows by design
For a call to reach you, the network has to know roughly where you are. This is not an option you can enable, it is the precondition for the service existing at all. Your phone announces itself continuously to the nearest tower, and that registration leaves a record on the operator’s side. No installed app, no permission granted: an active SIM card is enough.
Accuracy depends on the method:
- Cell ID alone: from 200 metres in a dense urban area to more than 30 kilometres in the countryside, where a single tower covers a very wide radius.
- Enhanced Cell ID, which adds the antenna sector (most sites are split into three 120-degree sectors) and signal strength: from 100 metres to a few kilometres.
- Timing advance, which measures the round-trip delay between phone and tower: on the order of 550 metres on GSM, around 78 metres on LTE.
- Multilateration across three or more towers: 50 to 300 metres in urban LTE.
5G changes the scale for two cumulative reasons. Density first: 5G cells cover much shorter radii, so simple attachment is already fine-grained information. Standardisation second: since Release 16, 3GPP has built in native positioning signals. Commercial targets aim for under 3 metres indoors and under 10 metres outdoors for 80% of devices, and Release 18 goes down to centimetre level for certain industrial use cases.
The infrastructure that connects you therefore becomes a positioning system of a quality comparable to GPS, without you having enabled anything. That data is retained under national rules and made available to authorities through procedures that vary widely. It is the same underlying debate as the one covered in our piece on the jurisdiction applicable to hosted data : technical protection and legal protection do not overlap.
Wi-Fi: a map of the world made of hardware addresses
Every Wi-Fi access point continuously broadcasts a unique hardware identifier, the BSSID. These identifiers are fixed and geographically stable: a home router stays in the same place for years.
Apple, Google and a handful of specialised players maintain databases mapping each BSSID to coordinates, built by their own users’ phones, which report the list of visible access points together with a GNSS fix. The operation is then reversed: a phone that can see four known access points no longer needs a single satellite. In a dense urban area, accuracy routinely reaches a few tens of metres, and drops below that indoors.
Two properties make this mechanism hard to neutralise. First, the phone scans even when Wi-Fi appears to be off: since Android 4.3, the system keeps a periodic scan running to improve location accuracy, independently of the quick-settings toggle. This behaviour depends on a separate setting, buried in the location services, that almost no user has ever opened.
Second, the database can be queried from outside. That is the flaw Rye and Levin exploited: the positioning interfaces return not only the requested location but also that of nearby access points, which makes it possible to harvest the map without ever going near the places involved.
Bluetooth and BLE: located by other people’s phones
Bluetooth Low Energy adds a proximity layer, with a range of a few metres to a few tens of metres, making it far more fine-grained than the mobile network. Two uses coexist. Commercial beacons, deployed in shops, airports and shopping centres, broadcast an identifier that apps on the phone recognise, revealing which aisle you stopped in front of and for how long. And crowd-sourced location networks, of which Apple’s Find My is the model, since copied by Google and Samsung.
This second mechanism inverts an implicit assumption. The reference analysis, Who Can Find My Devices? , published in the PETS 2021 proceedings by researchers at the Technical University of Darmstadt, reverse-engineered Apple’s protocol. An offline device emits a BLE signal, any nearby Apple device picks it up, attaches its own position and sends it encrypted to Apple’s servers, without the knowledge of either its owner or the owner of the device being located.
The consequence is structural: a device with no SIM card, no Wi-Fi and no network connection of any kind remains locatable, as long as a stranger walks past with a phone in their pocket. Your isolation no longer depends on your settings, but on those of passers-by.
Inertial sensors: locating you without location permission
A phone contains an accelerometer, a gyroscope, a magnetometer and often a barometer. These sensors fall under a permission category separate from location: an app can read them without ever having asked where you are.
Researchers at Princeton demonstrated this with PinMe . Their app starts from the IP address and time zone for a coarse position, then reads the sensors: the accelerometer gives the acceleration and braking profile, the gyroscope the sequence of turns, the magnetometer the heading, the barometer the changes in altitude. A neural network identifies the mode of transport, walking, car, train or plane, and the route is matched against public mapping, elevation and weather data. The result: a trajectory of accuracy comparable to GPS, with no location permission. The method has limits, which the authors document, since it fails in areas without roads and degrades on uniform grid layouts, where many routes produce the same signature. It remains the demonstration that a denied permission is not a closed door.
The barometer additionally supplies the dimension GNSS handles poorly, the vertical one. US requirements for emergency calls mandate floor-level accuracy of plus or minus 3 metres for 80% of indoor calls. Knowing which floor someone is on is a different kind of knowledge from knowing which city block they are in.
The data market: the most mundane vector
The mechanisms above describe how a position is computed. What remains is where it goes, and that is where most of the everyday risk lies.
Thousands of apps integrate advertising SDKs, third-party software components a developer adds to monetise their work or measure their audience. These components inherit the host app’s permissions: a weather app that legitimately needs your location passes it to companies whose names you have never read. To this are added advertising bid streams, where your approximate position is broadcast to dozens of potential buyers every time a banner is displayed, including to those who buy nothing and simply listen.
This raw material feeds an industry. The Electronic Frontier Foundation documented the case of Fog Data Science , which claimed billions of data points on more than 250 million devices, sold to local US police forces. Brian Krebs described Locate X , a product that lets you draw a polygon on a map and view the history of devices that entered and left that area.
This vector requires no technical feat, only that somebody is willing to pay. The price is modest.
IMSI catchers: active location
The mechanisms described so far exploit normal operation. There is also active location, carried out by a third party intervening on the network.
An IMSI catcher, or cell-site simulator, is a piece of equipment that impersonates a legitimate tower. Phones within range attach to it, revealing their subscriber identifier and their presence within a limited perimeter.
5G was supposed to close that door by replacing the permanent cleartext identifier with an encrypted one, the SUCI. The closure is partial. The work presented under the title 5G SUCI-catchers: still catching them all? documents linkage attacks that make it possible to re-correlate sessions despite the encryption. More importantly, the protection collapses entirely if the attacker forces the device to fall back to an earlier generation, 2G in particular, whose authentication is one-way. A 5G phone remains vulnerable to an attack designed for a 1990s network, because it still agrees to go down there.
Countermeasures, and how effective they really are
Every measure below does something. None of them does everything, and the gap between what they do and what people credit them with is what produces bad decisions.
Airplane mode
Airplane mode cuts transmission from the cellular modem, Wi-Fi and Bluetooth. That is real, and it is the best result available for such little effort.
What it does not do: it does not stop the inertial sensors, it does not delete already cached positions, which will be sent on reconnection, and on most devices it allows Wi-Fi or Bluetooth to be switched back on separately without leaving the mode. Finally, it is a software state, not a power cut: its reliability depends on the integrity of the system enforcing it.
An underrated detail: detaching from and re-attaching to the network are themselves timestamped events on the operator’s side. A phone that vanishes at 9 pm in one cell and reappears at 11 pm in another has produced information, not silence.
MAC address randomisation
Mobile systems today emit random MAC addresses when scanning, to prevent tracking from one place to another. The intent is good, the result incomplete. The reference work, including Why MAC Address Randomization is not Enough , shows that the content of discovery frames is often enough to re-identify the device: the number of information elements, their values and their order form a fingerprint. Add to that sequence numbers, which are incremental and therefore chainable, and the timing signature specific to each model. Some studies report successfully tracking half of all devices for at least twenty minutes.
Finally, a conceptual limit: randomisation only applies to the discovery phase. As soon as you connect to a network, the address used is stable for that network, by design, so that the connection works. The café you go to every morning recognises you.
Actually turning off scanning
This is the most cost-effective and most overlooked setting. On Android, Wi-Fi scanning and Bluetooth scanning are two separate options, located in the location services, independent of the quick-settings toggles. As long as they are active, turning Wi-Fi off from the panel is not enough: the scanning continues.
Disabling them removes an entire layer of collection, at no cost other than a slightly slower first position fix. For most readers, this is the best ratio between effort spent and result obtained.
App permissions
Revoking location permission from apps that manifestly do not need it remains useful, and recent systems offer three gradations: one-off authorisation, authorisation limited to active use, and approximate location, which only transmits an area on the order of a kilometre.
This does not, however, protect against SDKs hosted inside an app that has a legitimate reason to access your location, nor against inertial sensors, nor against the network layers, which go through no permission at all.
What a VPN does not protect
A point worth clarifying, because the opposite belief is very widespread: a VPN does not hide your location. It hides your public IP address, so it falsifies IP-based geolocation, which is in any case the crudest mechanism on this list.
A VPN touches neither the GNSS receiver, nor Wi-Fi scanning, nor Bluetooth, nor the sensors. It changes nothing about what your operator knows, since the encrypted tunnel travels through its towers and cellular attachment remains visible to it. It does not stop an app holding location permission from transmitting exact coordinates inside the tunnel. A VPN protects the content and destination of your communications on an untrusted network, and that is already a lot. Location is not within its scope.
Physical limits
A Faraday pouch works in the literal sense: it blocks transmission and reception. So does removing the battery, where that is still possible. A dedicated device, or simply leaving your phone elsewhere, remains the most robust measure.
These solutions share a flaw that has to be faced head-on: they produce an anomaly. A phone that goes quiet for two hours every Tuesday evening is saying something. Against an adversary who analyses patterns rather than instantaneous positions, absence is data.
Three adversaries, three strategies
This is the most important distinction in this article, and the one you read least often.
Against an advertiser or a data broker, the fight is winnable. Permission discipline, disabling scanning, a system without proprietary location services, resetting the advertising identifier: together these sharply reduce the volume collected. This adversary is after cheap volume, not your particular case.
Against your operator, no configuration is enough. Cellular location is the precondition for the service. The only real variables are legal, what the law permits to be retained and disclosed, and material: which device, which SIM card, in whose name, switched on where.
Against a targeted state adversary, the reasoning changes again, since it combines legal access to operator data, active location via cell-site simulator, requisitions to platforms and, where applicable, compromise of the device itself. Software countermeasures reduce the surface, but the realistic goal is not disappearance: it is knowing precisely what remains exposed.
The ArpokratOS approach
ArpokratOS answers this landscape with a choice that follows from the distinction above: what needs to be neutralised is neutralised at system level, not in a menu.
On GNSS, the hardware driver is removed. The device behaves as if the chip did not exist, both for applications and for the system itself. The difference from a settings toggle is not cosmetic. A toggle is a policy: it is enforced by a layer that can be bypassed by a sufficiently privileged component, re-enabled by an update, or ignored by a compromised system. Removing the code path removes the question, since there is no longer anything to enable.
Bluetooth is handled at the Core level, on the same logic. Bluetooth switched off in the settings in practice leaves the software stack alive on many devices, to feed proximity services and crowd-sourced location networks. Absent at system level, it cannot talk to a shop beacon, take part in a Find My-style network, or serve as a zero-interaction attack surface.
It has to be said plainly what this does not do. ArpokratOS does not make a phone undetectable. As long as a SIM card is active, the operator knows the cell you are attached to, and no operating system changes that, not even with all traffic routed over Tor. Routing protects the content and the destination, not the radio geometry. Anyone promising invisibility is selling a story.
What such an architecture provides is more modest: the removal of the application and proximity layers, through which the vast majority of real-world collection passes, and an explicit threat model for what remains. It is the same reasoning applied to choosing a desktop system, detailed in our operating system comparison : the useful question is not whether a tool protects, but what it protects against and at what price.
Conclusion
This article does not provide a method for disappearing. That method does not exist, and texts claiming otherwise mostly produce false confidence, which is more dangerous than no protection at all because it makes people take risks.
The aim was to replace a binary question, am I locatable or not, with a useful one: by whom, with what accuracy, at what cost to them, and does it matter to me. The answer differs for a journalist protecting a source, an executive travelling in a sensitive jurisdiction, a lawyer whose appointments reveal a strategy, or a private individual annoyed that an advertiser knows their habits.
What deserves attention, in fact, is not the performance of each of these mechanisms taken in isolation, but the fact that they overlap. A position accurate to fifty metres is not very interesting. A position accurate to fifty metres, every fifteen minutes, for two years, draws a home, a workplace, a religion, a health condition, an affair, a source. Location data is the metadata that makes all the others legible, and that is why it is worth so much.
Sources
- Erik Rye, Dave Levin, Surveilling the Masses with Wi-Fi-Based Positioning Systems , IEEE Symposium on Security and Privacy, 2024
- Alexander Heinrich et al., Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System , PoPETs, 2021
- Arsalan Mosenia et al., PinMe: Tracking a Smartphone User around the World , IEEE Transactions on Multi-Scale Computing Systems
- Mathy Vanhoef et al., Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms , AsiaCCS, 2016
- Merlin Chlosta et al., 5G SUCI-catchers: still catching them all? , ACM WiSec, 2021
- 5G NR Positioning Enhancements in 3GPP Release-18
- Electronic Frontier Foundation, Inside Fog Data Science, the Secretive Company Selling Mass Surveillance to Local Police , 2022
- Krebs on Security, The Global Surveillance Free-for-All in Mobile Ad Data , 2024
- Electronic Frontier Foundation, Mobile Phones: Location Tracking , Surveillance Self-Defense