The data that follows you for advertising is the data that can find you at a real address.
Location is not a privacy nuisance. It is targeting data. Turning off a setting no longer turns off the exposure, because the record was built, sold, and resold long before you reached for the switch. Getting location safe means doing two things at once: stop leaking your position, and clean up the trail you have already spilled. Work the tiers from low to high until you reach your own threat level.
Why this matters in 2026.
Two things happened this year that settle the argument about whether commercial location data is a real-world threat.
In May, a bipartisan group of lawmakers disclosed that U.S. Central Command had reported adversaries exploiting commercial location data to surveil American personnel in theater, the first time the Defense Department confirmed that kind of targeting in an active war zone. The government-issued phones still carried the advertising identifiers that brokers key on, and the command conceded that turning off location settings does not always stop a device from generating trackable data. If that is true of a military phone, it is true of yours.
In June, the Supreme Court decided Chatrie v. United States, holding that when police acquire your Google Location History they conduct a Fourth Amendment search, because you keep a reasonable expectation of privacy in records of your own movements even when a company holds them. It extended Carpenter and rejected the argument that agreeing to a permission prompt is the same as surrendering the data. Be precise about what that gives you. It governs government access. It says nothing about brokers, creates no right to sue one, and does not stop collection. It is leverage when you demand deletion, not an off switch.
The durable risk is not that you are tracked today. It is that your movement pattern is already an asset someone else owns.
Where your location leaks from.
Most people think of location as one thing controlled by one switch. It is nine things, and the switch controls one of them. Every row below is a separate emitter with its own control, and most of them keep working when Location Services is off.
| Emitter | How it leaks | Who ends up with it |
|---|---|---|
| App permissions | Apps with "Always" or "While Using" access log precise position. Large platforms and utility apps are the heaviest collectors. | The app, its ad partners, its data partners. |
| Advertising ID and the bidstream | Every ad request carries your ad ID and approximate location to every bidder in the auction. Losing bidders keep the data. You cannot toggle this off. | Hundreds of ad-tech intermediaries and the brokers that buy from them. |
| Operating-system history | Google Timeline and Apple Significant Locations record where you go and how often. | Held by the platform; reachable by lawful process. |
| The network itself | Cell towers, Wi-Fi probes, Bluetooth beacons, cell-site simulators. Present whenever the radios are on. | Carriers, venue analytics firms, law enforcement. |
| Web traffic | IP address geolocation, browser fingerprinting, cross-site tracking. | Ad networks, analytics, anyone reading the logs. |
| Your vehicle | Built-in telematics reports position automatically. License plate readers record every pass; no setting turns them off. | Automakers and their data partners; plate-reader networks and their customers. |
| Your face | Facial recognition in public spaces, transit hubs, border crossings; CCTV mined for facial data. | Operators of the cameras and the matching services behind them. |
| Assistants and devices at home | Smart watches, speakers, TVs, thermostats hold location and voice history clustered around one address. | The device makers and whatever they share with. |
| Photos and posts | Photo metadata, background clues, and text that says where you are. | Anyone who can see the post, and anyone who scrapes it. |
Baseline hygiene everyone should run.
Each tier has two columns and you work both. The left column stops the leak going forward. The right column cleans up what has already spilled. Read down the tiers until you reach your own exposure, then do everything above it too.
Stop leaking location data
Stop invasive apps from tracking you. Start with the large platforms: Facebook, Instagram, Messenger, TikTok, YouTube, Google Maps, Uber, Amazon, LinkedIn, X, Snapchat. Set location to "Never" for anything that is not a map, and to "While Using" for maps.
Clean up what you have spilled
Set platform location history to delete automatically after a set period, typically 3, 18, or 36 months, so it stops accumulating indefinitely.
You want the movement record cut, not just slowed.
Stop leaking location data
The mobile ad ID is the key that joins your movements across unrelated apps. Reset or delete it on every phone and tablet. This limits how far your movements can be linked across apps. It does not stop the bidstream broadcast itself.
Cuts cellular. On current phones you must also switch Wi-Fi and Bluetooth fully off in settings, since the quick toggle can leave them on or let them re-enable. GPS hardware still works and the phone keeps logging locally. This is a temporary go-dark measure, not a fix for data already flowing.
Clean up what you have spilled
Maps and Timeline hold enormous location history. Delete it. Google moved Timeline to on-device storage in late 2024, so check the current app settings. Other suspects: social media, weather, and fitness apps.
Purge the history stored across the Google and Apple ecosystems. It usually lives in more than one place; check both.
Deletion is a routine, not a one-time cleanup. The pattern is the vulnerability, and the pattern rebuilds. To be location safe against someone who is actually looking for you, you need to go farther.
You are, or could be, individually targeted.
This tier is for clients who are, or could become, a specific target: public figures, executives, people with a hostile ex-partner or a known adversary, anyone whose home address in the wrong hands is a safety problem rather than an annoyance.
Stop leaking location data
Halts most GPS-based tracking. Maps and similar apps will not work. Even then, the phone can still be tracked through cell towers, public Wi-Fi, cell-site simulators, Bluetooth, IP addresses, and malware.
Every time an app loads an ad, it auctions the slot in milliseconds and shares your data, including approximate location, with every bidder. One wins; all of them keep it. You cannot toggle this off, which is why killing the ad ID and cutting permissions matters so much.
Your location leaks by IP address, browser fingerprint, and cross-site tracking. Use a reputable paid VPN, a privacy-focused browser, and a privacy-focused search engine.
Replace Google and Apple Maps, which log and monetize your routes, with an offline no-tracking option. CoMaps, the community fork of Organic Maps, and OsmAnd are the current picks. Download routes in advance so you can navigate with data off.
Turn off location in each app, disable camera location tagging, strip photo metadata, and do not post photos with geographic clues or text that reveals where you are.
Smart watches, speakers, TVs, and thermostats use and reveal your location, clustered around your home. Review and restrict each one.
Set a carrier port-out or number-lock PIN so an attacker cannot hijack your number, and move two-factor codes off SMS to an authenticator app. A device SIM PIN alone does not stop a carrier-side swap. A hijacked number is mainly an account-takeover risk, but it also aids tracking and social engineering.
Nearly every new car has GPS and telematics that share data automatically. License plate readers are now everywhere and no setting turns them off. One vendor alone operates an estimated 100,000+ cameras used by more than 5,000 agencies.
Facial recognition in public spaces, transit hubs, and border crossings can place you without any device at all. Plate-reader networks increasingly add facial recognition, and CCTV feeds are mined for facial data.
Clean up what you have spilled
Deleting history from your phone does not delete it from the hundreds of brokers who already collected it and are selling it. Removal requests have to go to each one. The only alternative we know of that purges location history specifically, rather than just people-search listings, is an Obscurity engagement.
Remove your personal information from people-search engines, usually as part of Exposure Reduction. Current-address deletion is the hard case; talk to us about what is achievable for your situation.
Do not install extra apps and remove anything unfamiliar. Install operating-system, browser, and app updates promptly, scan for spyware, and protect email, banking, and healthcare accounts with strong passwords and two-factor authentication.
Go through your accounts and remove photos that reveal location history or patterns, and posts with text that reveals where you were.
Review and clear stored location and voice history on each assistant and device.
Scan your VIN in a vehicle privacy report to see what your car collects and sells. Wipe personal data before selling a car and after returning a rental, and sever prior remote access. Connecting your phone to a rental copies your data into it.
Low-tech: know where cameras are and avoid the scan; hats and sunglasses reduce casual matching. High-tech countermeasures, including anti-recognition clothing and infrared glasses, confuse some systems and not others. Treat none of it as dependable.
A spoofer feeds a fake coordinate to apps that read the GPS interface and do not detect mock locations. It is often detectable, can break apps or trigger bans, and does nothing against tower, Wi-Fi, carrier, bidstream, or plate-reader tracking. Niche, not a substitute for the controls above.
What the switches actually do.
Every control in this guide does something specific and leaves something untouched. The table is the honest version of the settings screen.
| Switch | What it stops | What it does not stop |
|---|---|---|
| Location Services off | GPS-based position reporting to apps and the OS. | Tower, Wi-Fi, and Bluetooth positioning; IP geolocation; the bidstream; plate readers; anything already collected. |
| App permission set to Never | That app's access to precise location. | Its access to your IP address and ad ID; every other app; the OS. |
| Advertising ID reset or deleted | The key that joins your pings across apps and brokers. | The pings themselves; the next ID being joined to you by other means over time. |
| Airplane mode | Cellular reporting while on; Wi-Fi and Bluetooth only if you also switch them off in settings. | Local logging; the record before and after; anything upstream. |
| Auto-delete history | Indefinite accumulation on the platform. | Copies already exported, sold, or subpoenaed; broker holdings. |
| A VPN | IP-based geolocation of your web traffic. | GPS, radios, ad ID, apps that report position directly, and the VPN provider's own view of you. |
| Broker opt-outs | Listings and, with the right requests, held location records. | Re-seeding from new feeds within weeks. This is why it is a cadence. |
Eight things people believe about location privacy.
"Location Services is off, so I am not being tracked."
One switch, one emitter. Towers, Wi-Fi, Bluetooth, IP address, the ad auction, your car, and your face all keep working. U.S. Central Command said as much about its own phones this year.
"I deleted my history, so it is gone."
Gone from your phone. The brokers who bought it from the auction, and the agencies who bought it from the brokers, still have it. Deletion on the device is step one of a much longer process.
"I never gave that app my location."
You gave it an ad request. Approximate location rides along with the advertising ID in every one, and every bidder in the auction keeps it, including the ones that lost.
"Airplane mode makes me invisible."
It cuts the cellular radio. Wi-Fi and Bluetooth may stay on unless you switch them off in settings, GPS still logs locally, and the records before and after still place you.
"The Supreme Court just fixed this."
It fixed one thing. Chatrie means police need a warrant for your Google Location History. It does not touch brokers, does not let you sue one, and does not stop a single ad auction.
"A VPN hides my location."
It hides your IP address. Everything your phone reports by GPS, radio, and ad ID is unaffected, and the VPN provider now knows what your ISP used to.
"I opted out of the data brokers last year."
Your profile re-seeded within weeks. New feeds rebuild it from new pings. Opt-outs are quarterly maintenance, not a one-time cleanup.
"If I leave the phone at home, I am location safe."
Your car and your face are not at home. Plate readers log every pass and cannot be turned off. Facial recognition places you without any device at all. Leaving the phone handles one of nine emitters.
The 15-minute routine, and the cadence that keeps it working.
Today, 15 minutes
- Kill the advertising ID on every phone and tablet.
- Audit location permissions: "Never" for anything that is not a map, "While Using" for maps.
- Turn on auto-delete for platform location history.
- Scan your VIN in a vehicle privacy report to see what your car collects.
- Use your deletion rights. In California one request reaches every registered broker; elsewhere, opt out of the major brokers or use an authorized agent.
Monthly
- Reset the advertising ID again.
- Re-audit permissions on any app installed since last time.
- Check that Wi-Fi and Bluetooth are off in settings when not in use, not just in the quick panel.
- Review new photos and posts for location clues before they accumulate.
Quarterly and on events
- Re-run broker opt-outs. Your profile re-seeds within weeks.
- Wipe a car before you sell it and after every rental return; sever prior remote access.
- Clear assistant and home-device history.
- After any move, new job, new relationship, or new threat: re-run the high tier.
The standard
Stop the leak and clean the spill, at the same time, at the tier your threat requires, on a schedule. Deletion is a routine, not a one-time cleanup. The pattern is the vulnerability.
What this guide stands on.
Confidence is high that location data is collected, brokered, and resold at scale, and that device-level toggles do not stop downstream flows. Confidence is moderate on any single vendor figure, each of which depends on the disclosure it came from. Method: public regulatory findings, court filings, and vendor disclosures, cross-read against ObscureIQ suppression practice. Map-app recommendations were validated in July 2026 and change; the 750+ broker count is an industry estimate and is not independently confirmed.
Law and government
- Chatrie v. United States, No. 25-112, decided June 29, 2026. Acquisition of Google Location History is a Fourth Amendment search; warrant validity remanded. Governs government access only.
- Carpenter v. United States (2018). The cell-site location decision Chatrie extends.
- Congressional letter to the Department of Defense disclosing U.S. Central Command reporting on adversary use of commercial location data (May 28, 2026).
- California Delete Act and the Delete Request and Opt-out Platform. The one-request mechanism referenced in the routine.
Regulatory findings
- FTC v. Mobilewalla (complaint 2024, final order January 2025). The roughly 60 percent lost-bid figure and the bidstream mechanics.
- FTC actions against location brokers including Gravy Analytics, Venntel, and X-Mode / Outlogic (2024). Sale of sensitive location data and the sensitive-location categories.
Civil society and independent research
- Electronic Frontier Foundation and Sen. Ron Wyden's office on Near Intelligence and the one-billion-device figure.
- EFF, Surveillance Self-Defense. The plain-language account of how a phone announces its position.
Vendor and platform statements
- Google, Timeline on-device migration (late 2024) and current deletion controls.
- Apple, Significant Locations and location privacy documentation.
- Flock Safety deployment figures (2026). Vendor-stated camera and agency counts.
ObscureIQ research
- OG-100, Be Location Safe (July 2026), which this edition supersedes.
- Location Data Broker Atlas and CODEX. Record coverage and invasiveness ratings for the brokers the high tier targets.
- License Plate Surveillance content hub. The commercial plate-reader stack from capture to consumer lookup.
Where this guide opens into the work.
Program
Obscurity
Not sure where your location is leaking from? Exposure Discovery maps the full surface: brokers, vehicles, devices. Exposure Reduction suppresses it, including the location history most services leave alone.
Content hub
License Plate Surveillance
The emitter you cannot switch off. The commercial ALPR stack from camera to consumer lookup.
Field Guide 03
Choosing a Private Phone
There is no untrackable phone. Four axes, four postures, and what full anonymity actually costs.
Field Guide 01
Privacy in Public
Visible is not the same as identified. Your face, your car, and your phone at a single event.
Not sure where your location is leaking from? We map the full surface, then suppress it.
An exposure assessment shows what brokers, vehicles, and devices are still emitting your movement pattern, and what can be clawed back. For clients in the high tier, we run the routine as an engagement, with the location-history purge that most deletion services do not attempt.