Google has been collecting location data even when location services are disabled, report says

User data can be relayed back to Google even your device doesn’t have a SIM card

Google search bar

According to a report from Quartz, Google has been collecting location data from Android users, even if they disabled location services and even if their devices didn’t have a SIM card.

A Google spokesperson told Quartz that the company has been collecting location data from Android devices transmitting to nearby cell towers.

Android devices have been storing the addressed of nearby cell towers and transmitting that data back to Google, since January 2017.

Google said that the goal was to “improve the speed and performance of message delivery.”

“However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID,” said a Google spokesperson in an exchange with Quartz.

This means that the cell tower data was never stored or used; the data was was also encrypted. Malicious actors would therefore have been unable to easily access the device information sent to Google.

Google also clarified that Android devices will no longer transmit cell tower information to Google, by the end of November 2017.

The cell tower data collected by Google is also distinct from the location services data accessed by apps like Google Maps.

In an official statement to MobileSyrup sent via email, Google clarified that Google began collecting Cell ID data as an “additional factor” to improve Android’s Firebase Cloud Messaging (FCM) service.

“…This information was never incorporated into our heartbeat system, and as a result, this information was never used or stored, and was discarded after every request,” reads an excerpt from Google’s exchange with MobileSyrup.

FCM is responsible for ensuring that apps and users are made aware of notifications and updates to client apps.

“Firebase Cloud Messaging has been updated to stop requesting Cell ID from Android devices,” reads another excerpt from Google’s exchange with MobileSyrup. “This information will no longer be sent to our heartbeat system by the end of this month when the rollout completes.”

Source: Quartz

Update 21/11/17: This story has been updated with information taken from an official Google statement to MobileSyrup.