Your phone knows where it is without using GPS at all

Everything here earned its place by changing an outcome. Nothing about location tracking is included to round the number up.

Satellite positioning is only one input

A receiver calculates position from the timing of signals from several satellites, which requires a clear view of the sky. A cold start needs to download orbital data and can take tens of seconds, which is unacceptable for a map application. Indoors the signals are attenuated to the point of uselessness in most buildings.

So phones combine satellite data with several other sources and present a single position with an uncertainty radius.

Wireless networks as landmarks

Every access point broadcasts a unique hardware identifier, and vehicles and phones have mapped enormous numbers of these to physical locations. A phone that can see several known access points can be located within metres by consulting that database, indoors and within a second. It never needs to connect to any of them, and scanning is passive, so the network owner is unaware.

Mechanically, this is the mechanism behind most indoor positioning and behind the speed with which maps find you.

Cell towers and sensors fill the gaps

Identifiers of nearby cellular base stations give a coarser position, typically hundreds of metres, and work almost everywhere. Bluetooth beacons give very precise positioning in shops and venues, which is used for retail analytics. Accelerometers, gyroscopes and barometers extend a known position through tunnels and buildings by dead reckoning, including estimating which floor you are on.

The short version: the reported accuracy figure is the combined estimate from all of these rather than a property of any one.

Turning off location does less than expected

Disabling the setting stops applications receiving a computed position through the platform interface. Your mobile operator still knows which cells your phone is registered to, which is a network function and not a setting.

Under load, the address a site sees, the wireless networks visible around you, and the timing of your activity all support inference independently. Photographs, posts and payments carry location implicitly whether or not any coordinate is attached.

Why location data is unusually sensitive

A trail of positions reveals home, workplace, place of worship, medical appointments and personal relationships without any content at all. Research has repeatedly shown that a handful of location points is enough to identify a specific individual in a supposedly anonymous dataset. Location data has been bought and resold commercially at scale, and several regulators have taken enforcement action over it.

At the protocol level, this is why it is treated as a special category in several data protection regimes.

Reducing the trail

Grant approximate location where the app only needs a region, and while-in-use rather than always. Turn off wireless and Bluetooth scanning when not in use, since some platforms scan for positioning even when the radios appear off. Strip location metadata from photographs before sharing, which most platforms do on upload and few messaging apps do.

Mechanically, check advertising identifier settings, since that identifier is the key that joins location data to everything else about you.

Everything above, in order of what to do first

1. Satellite positioning is only one input. A receiver calculates position from the timing of signals from several satellites, which requires a clear view of the sky.
2. Wireless networks as landmarks. Every access point broadcasts a unique hardware identifier, and vehicles and phones have mapped enormous numbers of these to physical locations.
3. Cell towers and sensors fill the gaps. Identifiers of nearby cellular base stations give a coarser position, typically hundreds of metres, and work almost everywhere.
4. Turning off location does less than expected. Disabling the setting stops applications receiving a computed position through the platform interface.
5. Why location data is unusually sensitive. A trail of positions reveals home, workplace, place of worship, medical appointments and personal relationships without any content at all.
6. Reducing the trail. Grant approximate location where the app only needs a region, and while-in-use rather than always.

The takeaway

The satellites are the backup. The wireless networks around you are what actually place you on the map.

The constraint is almost always physical, and marketing rarely mentions which one.