I think this trust might be misplaced.
> Example: Location history. It is turned off by default.
Displaying your location history to you is turned off by default. Google's own recording of your location, for their purposes, cannot be turned off.
Citation needed. Android even lets you turn off AGPS, which collects anonymous location data to update itself. As far as I know, this is not even possible on iOS.
That has nothing to do with the GPS setting of your phone.
"Android even lets you turn off AGPS, which collects anonymous location data to update itself. As far as I know, this is not even possible on iOS."
AGPS is GPS, assisted but still GPS.
That ggp prefixed that line on AGPS with "even"; they were asking for citation that Google persistently tracks location, and just used AGPS as one example.
The point being, saying Google allows you to disable GPS is a world away from saying Google allows you to disable location tracking. And I'm not talking about IP geolocation.
I don't even know if they do completely respect your choice to disable GPS (citation needed indeed here), but I do know that they persistently track you via WiPS/WFPS at the very least, if not other methods.
(Disclaimer: I'm an engineer at Google)
Either you have no clue about what is going on in your company or you are here as a PR guy.
I really hope that GDPR will hit you hard, as far as I am concerned you are far worse than Facebook, more harmfull than Monsanto, you have opened Pandoras box of user tracking and becoase of you now every single company is doing it. And just so you know, by writting this, my karma will fall for at least 10 points as your fanbase (which typically doesnt even understand what I have written) will downvote me a lot. I am telling you this just for you to understand how very pissed off on behaviour of your company some people are. The only thing that is into your favor was actually your biggest mistake - you have mistakenly made android open source which makes it far more feasible to silence it down to the point where it no longer communicates with your domains. This was maybe when you were still having the "don't be evil" attitude, at least as form of PR.
When you log in to a service (eg. Google), the device doesn't "silently" communicate with the servers, you asked it to. It sends a request with credentials, as it should. That request naturally comes with an IP address, which can be mapped to a rough location with no further information by the client.
On Android, I noted before that when I turned on and off location services, the GPS lock was near instantaneous (i.e. when I turned on location, Google Maps located me with GPS precision immediately. There could be other ways of how this happens, it was noted in another post of mine, but that had still had me a bit suspicious. I replaced Google Play Services with microG recently (https://lineage.microg.org/). I then saw that it was MicroG, NOT the OS, that had control over my location, and MicroG still tracks my location when Location is off(https://github.com/microg/android_packages_apps_GmsCore/wiki...).
While none of this conclusively points to Google Play Services tracking me when it is off, the way that Android is set up makes me very strongly suspect that's what they did.
Google maintains a database of wifi networks and their locations (I don't know the ways this data is acquired) to help triangulate the position: https://www.quora.com/How-does-android-use-WiFi-to-get-your-...
I welcome any alternative conclusions though.
Play Services has a lot of stuff in it because it's easy for Google to upgrade it without going through phone vendors or carriers. It was a way to counteract the effects of many phones being on old versions of Android.
It's been acquired from a range of sources. Most notably, Google Streetview cars collected a very large initial data set. Once you have that, it's quite easy to maintain an up-to-date dataset by verifying new routers picked up against nearby known routers (as well as verifying against GPS sensor data obviously).
This tech is not only in Android phones, but also every Chrome browser, so that's a lot of incoming data. The API used to be used by iOS and Safari (before Apple Maps) and Mozilla Firefox (before they launched their own WiFi and cell network database; theirs is released under CC0 though so I'm sure Google use their data too).
There are also other competitors to Google, Apple, Mozilla here with their own databases, like Skyhook, Navizon, AlterGeo.
I meant MicroG, it is documented on their site (see the link).
Do you want to turn Location History on?
Are you suuuuure you don't want to turn location history on?
To use maps effectively you need location history on. Turn on?
Location history may affect ____ you wanna turn it on?
How about now, location history is a great thing to turn on....
EDIT: for those of you who downmodded this, the point was that if you have location history off, Google spams you constantly with requests to turn it on. You'll get this request for opening up maps, using Google Now, or a dozen other things generated from many apps. There is also no option to temporarily turn on for app.
Not so nice uses of LocHis: https://www.androidauthority.com/google-android-location-his...
Explains how LocHis tendrils are everywhere: https://qz.com/1183559/if-youre-using-an-android-phone-googl...
Seemed like a low enough bar.
Firstly, I was pointing out one small example of Google's privacy settings being non-obvious, which the GP mentioned in their post. There are many, many others one could go into, but we'll stick with just user location privacy for now.
Also, minor disclaimer: What Google does or doesn't collect varies over time (as their policies and regulation changes, and in response to various court-cases). What they might have done according to one source a certain number of weeks/months ago they might have since stopped doing. But my point is that they cannot be trusted to follow the implied behaviour of high-level settings.
However, since you've refuted my statement, some examples:
1. Google's own terms at [0]
> some information (such as the association of your Google Account to your Google Wifi network) is stored by Google even if all privacy controls are turned off.
This is bundled with Google's tracking of the geographic location of each Wifi network to feed their WiPS/WFPS services.
2. As @lern_to_spell has alluded to, "Location Reporting" and "Location History" are separate settings; the former does allow you to turn off some (though not quite all) location recording for your Android device at least, but the latter setting is still very misleading, and the former setting comes with a sacrifice (some apps become unusable). See [1]
3. Even with all of the above granular settings and admissions in terms, Google still have demonstrated in the past that they cannot be trusted to follow even their own loose promises w.r.t. respecting user privacy. e.g. [2] [3] [4] - note these articles are spread over 3 years, and are about events from 6 years previous; not exactly a promising sign of Google's policies being corrected by the court actions.
- [0] https://support.google.com/wifi/answer/6246642?hl=en
- [1] https://www.howtogeek.com/195647/googles-location-history-is...
- [2] https://www.theguardian.com/technology/2010/may/15/google-ad...
- [3] https://www.wired.com/2012/05/google-wifi-fcc-investigation/