5G, Location Data and the Law's Targeting Error

Tue, 18 Aug 2026 00:00:00 +0000

In 2011, Detroit police asked a mobile operator for the cell site records of Timothy Carpenter’s phone. They obtained 12,898 location points spread over 127 days, around a hundred a day. Seven years later, the Supreme Court of the United States held that the request amounted to a search and required a warrant.

Those 12,898 points came from fourth-generation towers, each covering a radius of several kilometres. The same request, addressed today to an urban 5G network, would not return a hundred points a day accurate to a few kilometres. It would return a far larger volume, accurate to a few dozen metres.

The technology has changed scale. The legal reasoning has stayed at the same point in the chain.

A legal interest that judges recognise on both sides of the Atlantic

There is an interest almost everyone accepts and almost no legal text protects effectively: the right to be somewhere without that fact being recorded.

European case law established it unambiguously. In Digital Rights Ireland (joined cases C-293/12 and C-594/12, 8 April 2014), and then in Tele2 Sverige and Watson (joined cases C-203/15 and C-698/15, Grand Chamber, 21 December 2016), the Court of Justice of the European Union held that such data, taken as a whole, allow very precise conclusions to be drawn concerning people’s private lives: daily habits, places of residence, movements, activities carried out and social relationships.

The Supreme Court of the United States reached a comparable conclusion in Carpenter v. United States , 585 U.S. 296 (2018). It stressed a point American scholarship has commented on at length: the inescapable and automatic nature of that collection. Nobody consents to being attached to a cell tower; you are attached because you own a phone that is switched on.

The legal interest therefore exists, and it is recognised by the two courts that matter in this field. The problem lies elsewhere.

What 5G actually changed

A common confusion treats location as data the phone transmits, in the same way as a message or a photograph. It is not. Location is a physical consequence of how the network works. The operator knows which tower the device is attached to because it has to know in order to route a call. There is no key with which to encrypt that information, because it is not content but a property of the connection itself.

That is precisely what makes 5G significant in legal terms rather than technical ones.

Earlier architectures relied on wide cells. A 4G tower commonly serves a radius of several kilometres, and the position inferred from attachment alone was measured in hundreds of metres in cities, sometimes in tens of kilometres in rural areas. 5G rests on massive densification: urban cells typically cover a few hundred metres, and the engineering literature works with densities on the order of forty to fifty base stations per square kilometre, against four or five in the 3G era.

The consequence is mechanical. According to Ericsson’s white paper on 5G positioning , infrastructure deployed for connectivity alone reaches an accuracy of twenty to fifty metres outdoors and one to three metres indoors, dropping below a metre in favourable urban conditions. This is not a location feature switched on somewhere, but what the network knows by construction, with no application installed and no permission granted. We set out all of these mechanisms, along with the countermeasures that actually work, in our article on how your phone tracks your location .

The intrusion has therefore grown by several orders of magnitude. The applicable legal framework remains the one designed for 2G and 3G. No normative adjustment has accompanied that change of scale.

The law protects access, not generation

European law carefully regulates who may access location data, on what conditions and under what supervision. Directive 2002/58/EC lays down the principle of confidentiality of communications, and the Court of Justice held, in La Quadrature du Net (joined cases C-511/18, C-512/18 and C-520/18, Grand Chamber, 6 October 2020), that Article 15(1) of that directive, read in the light of Articles 7, 8, 11 and 52(1) of the Charter, precludes the general and indiscriminate retention of traffic and location data on a preventive basis. The Court nonetheless allowed framed derogations where a Member State faces a serious threat to national security that is genuine and present or foreseeable, subject to effective review.

These are real protections, and it would be absurd to play them down. But they all come into play after the fact. They presuppose that the data exists and is retained, and then organise the conditions of its use.

Yet if location is an unavoidable by-product of how the network operates, the relevant point of intervention is not confidentiality. It is persistence.

An instantaneous position, needed to route a communication and erased immediately afterwards, is not an instrument of surveillance. A history of positions kept for months is one, whatever access safeguards surround it.

The difference between the two is not legal, it is architectural. And the European timetable makes the question urgent rather than theoretical. The Commission withdrew the proposed ePrivacy Regulation in 2025, for lack of agreement between the co-legislators. It has since been working on a separate instrument on data retention for criminal purposes, announced for 2026 and intended to harmonise national regimes that have grown disparate since the 2006 directive was annulled. In other words, the text that will set the regime for location metadata for a decade is being written right now, on the basis of reasoning conceived in the era of kilometre-wide cells.

The precedent 5G created for itself

The most interesting aspect of the file is that the right answer is already in the technical standard, but applied to a different object.

Up to 4G, the subscriber’s permanent identifier, the IMSI, travelled in the clear over the radio interface during attachment. That is what made IMSI catchers possible, those fake base stations which, according to the Electronic Frontier Foundation’s reference description , transmit more strongly than legitimate towers in order to attract handsets and capture their identifier.

Since Release 15 of the 3GPP specifications, published in 2019, 5G has offered an elegant answer. The permanent identifier, now called the SUPI, can be replaced on the radio interface by the SUCI, a concealed identifier obtained by encrypting the subscriber-specific part using elliptic curve cryptography, with the home operator’s public key. Only the home network, which holds the corresponding private key, can decrypt it. The result is unique on each computation, which prevents correlation from one session to the next.

The logic adopted deserves to be underlined, because it is exactly the logic that should guide lawmakers: you do not encrypt the position, which would be technically impossible, you encrypt the identity. A position with no attachable identity has very limited value for individualised surveillance.

The flaw: an optional protection

There is, however, a considerable caveat, and in our view it is the most concrete point of intervention in the whole file.

The NIST CSWP 36A white paper , published in March 2026 by the National Institute of Standards and Technology, states it bluntly. Handsets and network functions compliant with Release 15 or later are required to support the SUCI, but enabling it remains optional for the operator. Three conditions must be met: the equipment vendor must support it, the operator must enable it on its network, and the SIM card must carry the elements needed for the computation.

A configuration trap comes on top of that. The standard provides for a null protection scheme, in which the SUCI format is formally used but without effective encryption, so that the identifier travels in the clear. NIST writes that operators need to configure their networks with a non-null protection scheme, and recalls that a report by CSRIC, the advisory body of the Federal Communications Commission, recommended as early as 2021 that the null scheme be reserved for emergency calls placed by a handset unknown to the network.

The formulation is worth stating plainly. The best available protection against mobile device tracking has existed in the technical standard since 2019. It rests on a configuration choice left to the operator’s discretion. An American federal agency finds it useful to publish a document in 2026 to remind everyone that it ought to be switched on. And no European legal instrument requires it.

It should be added that the SUCI does not close the subject. The work presented under the title 5G SUCI-catchers: still catching them all? documents linkability attacks that allow sessions to be recorrelated despite the encryption, and the protection falls entirely if the attacker forces the handset to downgrade to an earlier generation. A legal obligation would therefore not settle everything. It would nonetheless remove a gap with no defensible justification: the one between what the standard allows and what commercial networks do.

Three coherent interventions

If we take seriously the idea that location should be minimised by design rather than protected after the fact, three measures follow logically.

Make effective concealment of the identifier mandatory. Require the SUCI to be enabled and prohibit null protection schemes on commercial networks, apart from the residual case of emergency calls. This is not about prescribing a new technology, or funding a rollout, but about requiring the activation of a function standardised seven years ago and already present in the equipment.
Treat retention as the exception, not the default. The position needed to route a communication should be erased as soon as that function is fulfilled. Building a history should call for specific justification. That is the difference between a network that knows where you are and a network that remembers where you have been.
Make custody of the key the relevant connecting factor. Locating servers in the Union does not mean much if the keys that make the data intelligible are held elsewhere. The legally significant criterion should be effective control of the means of decryption, a question we examined in detail in relation to the conflict between the Data Act and the CLOUD Act .

The angle Arpokrat follows

This reasoning is not specific to telecommunications law. It is the one we apply to our own architectural choices, and it fits in a sentence: what has not been produced does not need to be protected.

That is why ArpokratOS removes GPS, Bluetooth and NFC at kernel level rather than disabling them in a menu. A switch is a policy: it can be bypassed by a privileged component, re-enabled by an update, ignored by a compromised system. Removing the code path removes the question. It is the transposition, at device scale, of the same shift we are calling for at the scale of the law: intervening on generation rather than on access.

It must be said straight away what this does not do. No operating system removes a handset from the geometry of the network. As long as a SIM card is active, the operator knows the serving cell, and routing all traffic through Tor changes nothing, since it protects content and destination, not the radio layer. That is precisely why the subject is a legal one. There is a category of risks that no individual configuration reduces, and for which the only available variable is the rule applicable to the operator.

The same concern governs the rest of our work. Data that does not exist cannot be requisitioned, resold, exfiltrated, or decrypted ten years from now by a machine nobody has today, a question we addressed from the angle of encryption harvested now and broken later .

Conclusion

Public debate on mobile surveillance focuses almost exclusively on access: who can consult the data, on what basis, with what authorisation. That debate is legitimate, and the rulings handed down by the Court of Justice since 2014 have had tangible effects. But it comes too late in the chain.

The prior and more decisive question is whether the history should exist at all. A database built today for a legitimate purpose remains available tomorrow for another, and the safeguards around it depend on later political decisions that nobody controls at the moment of collection. It is a bet on the stability of institutions, made for a period nobody sets.

5G has multiplied the resolution of this information without any normative adjustment. It has simultaneously shown, through the SUCI mechanism, that the workable path is to dissociate position from identity rather than attempt to encrypt a physical property of the network. The technical standard supplied the answer seven years before the law asked the question.

The European text on data retention is being written now. It will deal with metadata, therefore with location, therefore with what 5G now produces at a granularity its drafters never knew. Whether it will settle for organising access to a history taken for granted, or dare to question the necessity of that history, is probably the most important privacy question of the coming years in Europe. And it is a question the technical sector, for once, has already settled the right way.

Sources

Court of Justice of the European Union, Digital Rights Ireland , joined cases C-293/12 and C-594/12, 8 April 2014
Court of Justice of the European Union, Tele2 Sverige and Watson , joined cases C-203/15 and C-698/15, Grand Chamber, 21 December 2016
Court of Justice of the European Union, La Quadrature du Net and Others , joined cases C-511/18, C-512/18 and C-520/18, Grand Chamber, 6 October 2020
Supreme Court of the United States, Carpenter v. United States , 585 U.S. 296, 2018
National Institute of Standards and Technology, Protecting Subscriber Identifiers with Subscription Concealed Identifier (SUCI) , NIST CSWP 36A, March 2026
Ericsson, 5G positioning: Locating devices anywhere
Merlin Chlosta et al., 5G SUCI-catchers: still catching them all? , ACM WiSec, 2021
Electronic Frontier Foundation, Gotta Catch ‘Em All: Understanding How IMSI-Catchers Exploit Cell Networks
European Digital Rights, The ePrivacy Regulation proposal has been withdrawn, but the fight for your privacy is far from over
heise online, Data Retention: Commission to present proposal by mid-2026

Data Retention on ARPOKRAT