AI Location Tracking Privacy — What Apps Know About Where You Go

How Location Data Flows From Your Phone to AI Systems

The pipeline starts at your phone’s GPS chip, which records precise coordinates — accurate to a few metres. Apps with location permission access those coordinates. This is the part most people understand: you gave the weather app permission to know your location, and it uses that to show you local weather. What’s less visible is what happens to the data after it’s served its stated purpose.

Most apps include advertising SDKs — software components from advertising networks, embedded in the app code, that collect data independently of the app’s own function. When you open a game and it has your location permission, the game may use location for nothing at all, but the advertising SDK embedded in the game collects your coordinates and transmits them to the advertising network’s servers alongside a device identifier that links your location to your profile across every other app that uses the same SDK. One SDK can be embedded in thousands of apps simultaneously. Location data from each of those apps feeds into the same profile.

Advertising networks and data brokers buy this aggregated location data. They apply AI to it. The AI doesn’t see raw coordinates — it sees a movement history, and it enriches that history into an understanding of who you are and how you live. Your home is where your phone is every night. Your workplace is where it is during working hours. The specialist clinic is a regular destination with a medical facility business category. The house you visit every Sunday evening is a relationship. The AI identifies all of this without knowing your name — the device identifier is enough to build a profile that’s sold and resold across the data broker ecosystem.

What AI Infers From Your Movement History

Raw GPS coordinates are not the product data brokers sell. The product is the inference layer — what AI analysis determines about you from patterns in those coordinates. This distinction matters because people often assume that location data is only sensitive if someone knows what the addresses mean. The AI knows what the addresses mean. It cross-references coordinates against business registries, healthcare facility databases, residential property records, and business category maps. It doesn’t need to know your name to know where you worship, receive medical care, or who you’re in a relationship with.

The inference is more revealing than the raw data in most cases. Knowing you were at coordinates 51.4975, -0.1357 on a Tuesday afternoon tells an attacker very little. Knowing that those coordinates are a fertility clinic in London, that you’ve been there four times in six weeks, and that before and after each visit you’re at a residential address in Clapham — that’s a detailed picture of a private medical situation, extracted from a weather app’s location permission, enriched by AI, and available for purchase.

The Documented Harms From Location Data Misuse

The clinic visitor dataset is the most widely reported case, but it’s not isolated. In 2021, a Catholic news publication purchased a commercial location dataset and used it to track the movements of a Catholic priest — identifying that his phone had been at a gay bar and at the home of another man. The priest resigned. The data that identified him had been collected through ordinary apps. The data broker sold it as a general commercial dataset with no specific intended use. The buyer applied their own analysis.

Law enforcement use of location data without warrants is documented and ongoing. The ACLU and EFF have both reported cases where police departments purchased location data from brokers to identify attendees at protests, immigration events, and other legally protected assemblies — data that would have required a warrant to obtain from a carrier or platform directly, but which is available commercially without legal process. Courts are still working through the constitutional questions this raises. The data collection that makes it possible is happening now regardless of how those legal questions resolve.

Google’s Sensorvault — a historical location database assembled from Android users’ location history — became a law enforcement tool through geofence warrants. A geofence warrant asks for the device identifiers of every phone that was within a specified geographic area during a specified time period. Everyone near a crime scene, a protest, or any other location of interest — not just suspects — potentially appears in the response. Google has received thousands of these warrants. Challenging them requires knowing they were issued, which the targets typically don’t.

Permission Types — What “While Using” vs “Always” Actually Means

The difference between “While Using” and “Always On” location access is the difference between a tap and a continuous stream. “While Using” provides location data only when you have the app open and in the foreground. The moment you switch to another app or lock your phone, location access stops. “Always On” provides location data continuously — in the background, while you sleep, while the app is closed. It’s active whenever your phone is active, not whenever you’re actively using that app.

Very few apps need “Always On” location access for their stated function. Maps and navigation need it during active navigation — not while the app is closed. Fitness tracking apps may need it during a workout. Family safety apps with specific consent-based tracking functions may need it. Beyond those categories, “Always On” location access is a data collection feature more than a functional requirement. An app that requests “Always On” access and has no plausible continuous-location function is asking for something it doesn’t need — which is a reasonable prompt to ask why.

Precise vs Approximate Location

iOS introduced a “Precise Location” toggle for each app — the ability to grant location access but limit it to an approximate area rather than GPS-level coordinates. The difference is significant. GPS-level precision places you at a specific address. Approximate location places you in a neighbourhood or postal code area — accurate to a kilometre or more. A weather app showing you the forecast for your city doesn’t need to know which street you’re on. A news app showing local stories doesn’t need your exact home address derivable from GPS coordinates.

The practical application: for any app where you grant “While Using” access, also check whether precise location is on or off. If the app’s function doesn’t require knowing your specific GPS coordinates — only your general area — turn precise location off. You’re still providing location access for the app’s stated purpose; you’re just not providing the GPS-level precision that makes the data useful for the kind of inference the previous section described.

How to Audit and Control Your Location Data

The permission audit in Exercise 1 reduces ongoing collection. But if you’ve had location permissions granted to many apps for months or years, there’s a historical record of your movements in Google’s systems and potentially in data broker databases. That historical data has already been processed and potentially already sold — you can’t recall it. But you can delete what’s still in Google’s account and stop future accumulation.