A woman in Rajasthan fled her husband. Changed cities, changed her number, stayed off social media. Six weeks later, he found her. The investigator he hired didn’t need to follow her — he just bought her location history from a data broker that had purchased it from apps on her old phone. She’d uninstalled them. Didn’t matter. The data was already sold.
This isn’t a hypothetical. Documented cases like this have been reported across the US and Europe. In India, the data infrastructure that enables it is largely the same — and the legal guardrails are thinner.
Your phone’s location data is not private. It’s a commodity. Multiple companies are harvesting it right now, from multiple angles, and selling it to buyers you will never know about. Here is every method they use, who buys the output, and what you can actually do about it.
The short answer: Your phone leaks your location through seven channels: GPS, cell towers, Wi-Fi, Bluetooth beacons, your IP address, your advertising ID, and hidden SDKs inside ordinary apps. Data brokers, advertisers, hedge funds, and government agencies buy the output. You can’t opt out of your carrier’s tracking. But about 20 minutes of settings changes cuts most commercial harvesting. Audit location permissions, downgrade apps to approximate location, disable Wi-Fi scanning, reset your advertising ID, and use a VPN.
Jump to: The seven tracking methods · Who buys location data · The India carrier picture · The permission you give away · How to reduce your exposure · Location data and the DPDPA
How your phone tracks you — all seven methods
GPS
The one everyone knows. GPS pulls your precise coordinates from satellites, accurate to a few meters when the signal is clean. It’s the most accurate method and the most battery-intensive. It also requires explicit app permission on both Android and iOS.
When you grant an app “precise location,” it can pull GPS coordinates. The problem isn’t GPS itself. It’s that many apps request this permission with no legitimate need for it. A news aggregator. A shopping app. A weather app that could function fine on approximate location. Each one that gets your GPS data is a potential vector for selling it.
Cell tower triangulation
This one requires no app permission and no action from you. Every moment your phone has a SIM card in it, your carrier knows which cell towers it’s connecting to. In cities, where towers are dense, this triangulation puts your location accurate to a few hundred meters. In rural areas, it’s rougher, but it’s never completely absent.
Jio, Airtel, and Vi (Vodafone Idea) hold this data on every Indian subscriber, constantly. TRAI regulations require telecom operators to maintain call detail records, or CDRs, which include location data. Law enforcement can access these through court orders. What the regulations do not clearly define is the scope of commercial sharing with third parties. The silence on that question is itself significant.
Your carrier’s location data is the one you cannot opt out of without removing your SIM card.
Wi-Fi positioning
Google and Apple have both built global databases that map Wi-Fi network names and MAC addresses to physical locations. Your phone detects nearby Wi-Fi networks even when you’re not connected to them. It can then look up those networks in these databases and pinpoint your location faster and more accurately than GPS alone.
Android has a setting called “Wi-Fi scanning” under Location settings that allows this to happen even when you’ve turned Wi-Fi off. Most people have never heard of it. It’s on by default.
Bluetooth beacons
Walk into a Reliance Smart, an Inorbit Mall, or any large retail space with modern infrastructure. There’s a reasonable chance Bluetooth beacons are tracking how long you spent in each section, how often you visit, and which displays you lingered near. Retailers use this data for layout optimization and advertising. The dwell-time profiles don’t necessarily link to your identity directly, but they link to your device. Combined with other signals, that’s enough. Our guide to in-store Bluetooth and Wi-Fi tracking covers this in depth.
IP geolocation
Crude, but zero permission required. Every website you visit sees your IP address, which maps to a rough geographic location. This is typically accurate to the city or neighborhood level. It’s why a travel booking site knows you’re in Bengaluru without you telling it. Advertisers and analytics platforms use IP geolocation as a fallback when more precise signals aren’t available.
A VPN masks this by replacing your IP address with the VPN server’s address. It’s the one method where a single tool provides complete protection.
Advertising ID tracking
Android assigns every device an Advertising ID, the AdID. iOS assigns an Identifier for Advertisers, the IDFA. These are persistent identifiers that allow advertisers to track your behavior across different apps on the same device.
Open a food delivery app, then a news app, then a game. Each app reports your behavior to ad networks. Those reports are linked by your AdID. Over time, the cross-app profile built from this data is detailed: what you browse, when you’re active, what you buy, where you are when you do all of this. The AdID ties every data point together into a single profile without using your name.
You can reset your AdID. Few people do.
SDK-level location harvesting
This is the mechanism most people are unaware of, and it’s the one responsible for the most commercial location data in circulation.
App developers build apps using third-party software development kits — SDKs — for analytics, advertising, and attribution. These SDKs, embedded invisibly inside apps, often request location permission and harvest that data in the background, independent of what the app’s stated purpose is. The developer may not even have full visibility into what the SDK is collecting.
When you grant location permission to an app, you’re also granting it to every SDK embedded in that app. Those SDKs report back to their parent companies — ad networks, data aggregators — who compile, package, and sell the result.
Who buys location data
The buyers are more diverse than most people expect.
SafeGraph and Veraset are American location data brokers. They purchase raw location pings, millions of them from millions of devices, sourced from apps via SDK-level harvesting. They clean, structure, and resell this data to a broad range of customers. Retailers buy it to understand foot traffic patterns near their stores and competitors’. Hedge funds buy it to analyze consumer behavior before quarterly earnings. If parking lot visits at a retail chain are down, that’s an investment signal. Urban planners and academic researchers buy it for movement studies.
Government agencies also buy it. In documented cases that includes US federal law enforcement and intelligence agencies. The appeal is clear: commercial purchase of location data sidesteps the warrant requirements that would otherwise apply to accessing it directly from carriers. Multiple congressional investigations and court filings have documented this practice. The Supreme Court’s 2018 decision in Carpenter v. United States established that extended cell tower location data requires a warrant. But it left significant gaps, and commercial data broker purchases sit in murky territory.
Outlogic, formerly X-Mode Social, was removed from the Apple App Store and Google Play Store in December 2020. Motherboard/Vice reporting had revealed it sold location data to US military contractors and brokers working with defense clients. X-Mode rebranded as Outlogic. The underlying business continued: buying location data from apps, selling to intelligence and government contractors.
InMobi is a Bengaluru-based mobile advertising network, one of the largest in Asia. Location data is central to how mobile advertising targeting works, and InMobi operates at significant scale in India. Advertising networks use location data for targeting (served ads based on where you’ve been), measurement (did this ad drive a store visit), and audience segmentation.
Advertisers use location data for retargeting. If you visited a competitor’s showroom last Thursday, a car brand can target you with ads today. If you visited a hospital, health insurance advertisers may reach you next week. The connection between physical movement and ad targeting is direct, well-documented, and legal under current Indian law.
Hedge funds and institutional investors buying location data as investment signals is a practice that has grown substantially over the past decade. It is a normal and legal commercial transaction. The ethical question around it is mostly unasked: do app users understand that their location data funds Wall Street trading?
The India-specific carrier picture
Every Indian subscriber on Jio, Airtel, or Vi generates continuous location data through cell tower connections. In dense urban areas such as Delhi, Mumbai, Bengaluru, and Hyderabad, this data is accurate enough to place you in a specific neighborhood, sometimes a specific block.
TRAI’s licensing framework requires operators to maintain CDRs for specified periods. Law enforcement access to this data is available through the legal process: court orders, or executive directions in national security contexts. What isn’t publicly defined is the scope and nature of commercial arrangements between telecoms and third-party data buyers. Unlike the US, where some of this has been litigated and investigated by Congress, the Indian picture remains largely opaque.
The prudent assumption: your carrier knows where your phone is, always, and the legal constraints on what happens with that data are not fully specified.
The “precise location” permission you’re probably giving away
When an app requests location permission, Android 12 and later and iOS 14 and later offer a meaningful choice that most users skip past.
Precise location gives the app your GPS-level coordinates, accurate to a few meters. Approximate location gives a roughly 3-kilometer radius instead. For a food delivery app that needs to place a pin on your building, precise location is justified. For a weather app, a news app, or a shopping app, approximate location is plenty.
The data quality difference matters enormously for harvesters. A precise location ping can identify your home address, your workplace, the hospital you visited, the mosque or temple you attend. A 3-kilometer radius can confirm you’re roughly in Bandra, and that’s it. Same app, same SDK, same data broker pipeline. But with approximate location, the harvested data is commercially much less valuable.
Android also gives you three options for when an app can access location. The choices are “Allow all the time,” “Only while using the app,” and “Don’t allow.” Background access (“Allow all the time”) means the app can check your location when it’s not open. It runs even when the app is not in use. That is how SDK-level harvesting in the background works. Most apps have no legitimate reason to need background location access.
How to actually reduce your location exposure
None of this requires leaving your phone at home. It requires about 20 minutes of settings changes and one habit adjustment.
Audit your location permissions. On Android, go to Settings > Location > App permissions. Look at every app with “Allow all the time” access. Ask whether it genuinely needs your location when you’re not using it. For most: change to “Only while using the app” or “Don’t allow.” On iOS, go to Settings > Privacy & Security > Location Services. Same audit, same question. Use the “Precise Location” toggle per app to downgrade to approximate for apps that don’t need exact coordinates.
Disable Wi-Fi scanning. Android only: Settings > Location > Wi-Fi scanning, and turn it off. This stops your phone from using Wi-Fi networks to determine your location when Wi-Fi is off.
Reset your Advertising ID regularly. On Android: Settings > Google > Ads > Reset advertising ID (newer Android: Settings > Privacy > Ads). This breaks the continuity of cross-app tracking. Advertisers can still build a new profile on your reset ID, but the historical profile tied to your old ID becomes less useful. On iOS: Settings > Privacy & Security > Tracking, and set “Allow Apps to Request to Track” to off. This tells apps they cannot access your IDFA and prevents most cross-app tracking.
Use a VPN for IP geolocation protection. A VPN replaces your visible IP address with the VPN server’s address, preventing IP-based location profiling. It’s the one category where a VPN directly helps with location tracking. It doesn’t protect against GPS, cell towers, or SDK harvesting, so don’t mistake it for a complete solution.
For sensitive trips: airplane mode. Say you’re visiting a place you don’t want in any database. A clinic, a lawyer, a political meeting, a religious gathering outside your mainstream. Airplane mode prevents all network-based tracking. Cached GPS can still be accessed by apps you open, but with no network connection, nothing can be reported back in real time.
Location data and India’s DPDPA 2023
The Digital Personal Data Protection Act 2023 is India’s primary data privacy legislation. It establishes three things. Consent requirements for collecting and processing personal data. Rights for data principals to access and erase their data. And obligations on data fiduciaries, the entities that collect and process data.
Location data is personal data under the DPDPA. Its collection requires consent that is free, specific, informed, and unconditional. The right to erasure applies to it. The consent withdrawal mechanism applies.
What the DPDPA does not do is create a tiered “sensitive personal data” category. The final act applies a unified personal data framework. Heightened obligations attach to Significant Data Fiduciaries designated by the central government, rather than to particular data types. This is a meaningful gap for location data specifically. Precise location can directly reveal where you live, where you worship, what healthcare facilities you visit, and your daily routine. In most privacy frameworks internationally, this sensitivity is explicitly recognized. DPDPA 2023 handles it only through the general consent and purpose-limitation requirements that apply to all personal data.
How this plays out in enforcement is untested. The Data Protection Board is the enforcement body established by the DPDPA, and it has not yet adjudicated location data cases. The practical protections on offer are still uncertain, which is exactly why the settings-level measures above matter more in the near term than the legal framework.
The business model running underneath all of this is simple. Location is valuable, collection is cheap, and there are buyers at every point in the chain: app developers, SDK vendors, data brokers, advertisers, hedge funds, and government contractors. The surveillance doesn’t require malice. It requires only that each party in the chain treats your movement through the world as inventory.
The protections that exist are mostly self-administered. Settings audits, permission downgrades, ID resets. They don’t eliminate the exposure, because your carrier always knows where you are. But they significantly reduce what commercial actors can harvest and sell.
Twenty minutes of changes now will meaningfully limit what flows into that pipeline going forward.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.