Imagine someone knows everywhere you've been – from your doctor's office to your place of worship, your grocery store, and even your holiday destinations. Sounds like a spy movie, right? Well, it's likely happening right now, and your phone is the informant. Shockingly, government agencies like U.S. Immigration and Customs Enforcement (ICE) are among those buying this data.
The real kicker? The government often doesn't even need to directly spy on you. Your mobile phone is already diligently tracking and transmitting your location. While some location tracking is obvious (like when using a maps app), and this is the part most people miss, a lot of it happens silently in the background.
As a privacy researcher, I spend my time studying how people understand and react to this constant data collection, and I'm always looking for ways to help people regain control. Unfortunately, once you grant an app or website permission to access your location, you essentially lose control over where that data goes and who gets to see it. It can be shared, sold, and used in ways you never imagined.
So, why is your phone so chatty about your whereabouts? There are two main reasons: it’s a byproduct of how phones work and, believe it or not, it's sometimes legally required.
First, your phone is constantly searching for nearby cell towers. Think of it like a digital game of Marco Polo, but instead of shouting, your phone is quietly pinging towers to ensure you can make calls and send texts seamlessly. To make sure your call doesn't drop, your phone might connect to several towers simultaneously. By triangulating the signals from these towers – imagining each tower's signal as a bubble and your phone being located where those bubbles intersect – your location can be pinpointed.
But here's where it gets controversial... Since 2001, mobile phone carriers have been legally obligated to provide your latitude and longitude when you call 911. This law was enacted to speed up emergency response times, which is undoubtedly a good thing. But, it also means your location data is being actively collected and stored, even when you're not making emergency calls.
Now, let's talk about how your location data becomes a commodity. When you give apps or websites permission to access your location, those companies can share that data widely without needing your explicit consent each time. Sometimes, they do this directly through partnerships with data brokers.
More frequently, though, location data is shared through a process called "real-time bidding," which is how ads are targeted to you. Essentially, when you visit a website or use an app, an auction takes place in milliseconds to determine which ads you'll see. To identify the best ad for you, the app or website shares information about you, including your location, with third-party bidders. These bidders, who are hired by advertisers, then place automated bids for the ad space.
Here's the catch: even if a bidder doesn't win the auction, they still get to keep your data. And they can do whatever they want with it, including selling it to location data brokers. This means your location data is being passed around like a hot potato, even if you only intended to share it with one app.
So, what happens to your data once it falls into the hands of location data brokers? They sell it far and wide to location-based service providers, who repackage it and sell access to tools that track people's movements. Some of these tools are used for legitimate purposes, like providing roadside assistance. But others are used by law enforcement, government agencies, and even private individuals to track down people without a warrant.
For example, in October 2025, reports surfaced that ICE purchased a location surveillance tool called Penlink, which can track the movements of specific mobile devices over time. This tool allows them to access location data from hundreds of millions of phones without needing a warrant.
Why is all of this a problem? Because location data is incredibly sensitive and, despite what some companies claim, it cannot be truly anonymized. Your home and work addresses are usually the easiest locations to identify. With just those two pieces of information, it's often trivial to determine your identity and link it to all the other location data that has been collected about you.
But, the most concerning thing is that most people simply don't realize the extent to which their location data is being collected and shared. They might allow an app to access their location for navigation or weather updates, but they don't think about how that data could be used to infer sensitive personal information. For example, in one of my research studies, we found that people who used fitness trackers to record their running routes often didn't realize that this data could be used to determine their home address.
This lack of awareness means that people aren't able to make informed decisions about their privacy. They can't anticipate that the data collected through the normal use of their mobile phones might end up in the hands of government agencies or other entities they wouldn't want to share it with.
What can be done? Stricter regulations on how mobile phone carriers and apps are allowed to collect and share location data are crucial. We also need better laws governing how the government can obtain and use location information about people. While the Federal Trade Commission has made some attempts to curb carriers' data sales, their efforts have had mixed results in court. And only a handful of states are currently trying to pass legislation to address this issue.
Ultimately, protecting your privacy in the age of location tracking requires a multi-pronged approach, including stronger regulations, increased awareness, and more control over how your data is collected and used. But here's the big question: are we willing to give up some convenience and functionality in exchange for greater privacy? Are the current laws enough, or do you think we need stronger regulations to protect our location data? Let me know your thoughts in the comments below.
