【1993 Archives】

Google993 Archives your friendly Internet tech giant that totally doesn'tknow everything about you, has reportedly been secretly tracking Android users' locations even when they've opted out of location service tracking.

Quartzfirst discovered the suspect "location" collection on several Android devices and Google reportedly confirmed to the website it was only doing so to "further improve the speed and performance of message delivery." Google says it will discontinue the practice by the end of this month.

Mashablereached out to Google for clarification on this seemingly alarming tracking, and the company claims it's not actually collecting location-based data after all. Quartz, for what it's worth, stands by the story it published.

SEE ALSO: The OnePlus 5T would've been one of the year's best phones if not for its bad cameras

According to the Quartz report, Android phones have been recording cellular addresses (or "Cell ID codes" as Google calls them) from cellular towers even if users have disabled the "Location Services" setting that accesses the GPS to pinpoint where the device has been.

Google confirmed to Mashableit started requesting Cell ID codes earlier this year:

In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery.

Cell ID data is different from Location Services, which activates the GPS to identify where the phone's been.

In comparison, Cell ID doesn't access the GPS and therefore doesn't and can't log any location coordinates.

A person familiar with how Cell ID works and how it's implemented on Android told us it's merely a "message routing protocol" that's used to better direct messages.

For example, if you're on the north side of a park and connected to Tower A, your Android phone will send a Cell ID code to it that essentially says "Yes, route messages through Tower A for the quickest and most reliable delivery."

This Cell ID code is encrypted and "immediately discarded" a Google spokesperson told Mashable.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Google also sent Mashablethe following statement in response to the Quartzstory:

To ensure messages and notifications are received quickly, modern Android phones use a network sync system that requires the use of Mobile Country Codes (MCC) and Mobile Network Codes (MNC). In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery. However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID. MCC and MNC provide necessary network information for message and notification delivery and are distinctly separate from Location Services, which provide a device’s location to apps.

Here's what all this means: Quartzis essentially conflating Cell ID codes with Mobile Country Codes (MCC) and Mobile Network Codes (MNC). These two codes are part of Google's Firebase Cloud Messaging network sync system and are used for message and notification delivery, according to the Google. The company says they are distinctly separate from Location Services, which provide a device’s location to apps.

MCCs and MNCs only provide a country code and network code, which are not precise locations, and are used by all phones that connect to the Wi-Fi and cellular networks. So, for example, if I'm on Verizon and in the U.S., my Android phone would send this data back to Google.

While MCCs and MNCs aren't specific enough data for device triangulation, there's concern that Cell IDs, which basically record the tower for which your messages are sent through, could be triangulated.

Though Google made a change to the Firebase Cloud Messaging system in January to also request Cell ID codes that it planned to use to further beef it up, it never fully integrated them.

Had Google properly included Cell ID codes as part of the Firebase core, it would have sent the data to Google's servers after each request. MCCs and MNCs are the only codes that are recorded and sent to Google.

But because Cell ID codes weren't fully integrated, and therefore were immediately discarded after each request, there's simply no way for this triangulation to ever occur.

It's unclear if Google would have moved towards discontinuing this Cell ID code requests if Quartzhad not found it out and contacted them.

More transparency is needed

Regardless, the company has updated Firebase to remove Cell ID requests on all Android devices. Which is the right thing to do.

Despite the company's privacy policy claiming that it uses "various technologies to determine location, including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points and cell towers," the company could have been more transparent on the specific data it was collecting.

This isn't the first time Google's run into issues where it's failed to clearly inform users on what kind of data it's collecting and how it's doing so, and it definitely won't be the last. Google's entire business is built on extensive amounts of data.

While some companies like Apple are incorporating ways to leverage mass amounts of data to improve their services while simultaneously promising to protect users' privacy, Google still essentially relies on its users opting in to its wide-ranging terms, even when they have no idea what they're giving up. Because who really reads privacy policies and terms of services? Maybe what we really need is a rethinking of how these terms of services are presented -- less legalese and more plain English.

Correction: November 21, 2017An earlier version of this article misstated the meaning and use of Cell ID. The article has been updated to clarify both.

---

Featured Video For You

---

Google's Pixel 2 and 2 XL are perfect if you don't want to spend $1,000 on a new phone

---

Topics Android Cybersecurity Google Privacy