How your phone is used to track you, and what you can do about it

As researchers and journalists try to understand how the coronavirus pandemic is affecting people’s behavior, they have repeatedly relied on location information from smartphones. The data allows for an expansive look at the movements of millions of people, but it raises troublesome questions about privacy.

In several articles, The New York Times has used location data provided by a company called Cuebiq, which analyzes data for advertisers and marketers. This data comes from smartphone users who have agreed to share their locations with certain apps, such as ones that provide weather alerts or information on local gas stations. Cuebiq helps app makers use technology like GPS to determine the location of people’s phones, and in turn some of the app makers provide data to Cuebiq for it to analyze.

The data obtained by The Times is anonymized and aggregated, meaning that the journalists see broad statistics compiled by geographic area – such as the median distance moved per day by devices in a census tract. The Times did not receive information about individual phones and did not see the path any particular phone took.

About 15 million people in the United States use the relevant apps daily and allow them to track their location regularly. The aggregate data provides a representative sample of the population, according to academic papers that studied Cuebiq’s data in different metro areas.

What are the dangers of this data?

Although the data excludes names, phone numbers and other identifying information, even anonymous location information can be revealing. The Times has reported on the intrusiveness of such data, which can show intimate details like trips to doctor’s offices and outings with romantic partners.

The fact that companies are collecting, storing and selling location information about individuals at all presents risks. Hackers or people with access to raw location data could identify or follow a person without consent, by pinpointing, for example, which phone regularly spent time at that person’s home address.

Different companies have widely varying approaches to handling the information, including deleting large portions of it for privacy reasons or selling the raw data with no protections. Location data on individuals is used for purposes like marketing and analysis for hedge funds and law enforcement. There is no federal law in the United States that limits the use of location information in this way, although some have been proposed. Cuebiq said it collects and stores raw location data but does not sell it.

What are the benefits of this data?

Location data from smartphones is used for several purposes, most frequently for targeted advertising. For example, companies may show ads for sneakers to people who often go to a gym. Companies such as Apple and Google use similar information for mapping and traffic monitoring, or to tell people when stores are likely to be busy.

Makers of apps that sell the data say it allows them to give users their services without charging them money.

During the coronavirus pandemic, location information has shown where people are following social distancing rules, and where they have traveled – enabling analysis of potential hot spots. The Times has used this data to show that people from low-income areas were less likely to be able to shelter at home than people from high-income locations and to demonstrate how the virus may have spiraled out of control in the United States.

How would I know if my data is collected?

It can be difficult for people to keep track of whether and how their data is being gathered. Android-based devices and iPhones both require apps to ask users to enable location services before collecting the information, but the explanations people see when prompted to give permission are often incomplete or misleading. An app may tell users that granting access to their location will help them get weather alerts, but not mention that the data will be sold. That disclosure is often buried in a densely worded privacy policy.

In a recent test of five apps that provide information for Cuebiq’s data set, the disclosures indicated that the data would be shared for advertising and analysis, and users were directed to information on limiting that sharing. But some apps made it easier than others to stop the data collection. And in a test last year by New York Times opinion journalists of an app that sent data to Cuebiq, the initial prompt for the user to allow access to location information did not mention all the ways it would be used. That app later changed its messaging.

Even with such disclosures, it may not be clear to users how frequently someone’s information is collected and what it can show. In Europe and California, users can request their data. Elsewhere, policies vary by company.

You can request your data from Cuebiq or ask the company to delete your data regardless of where you live. Cuebiq ties your data to your phone’s so-called advertising ID, which is used by marketers and others to differentiate phones from each other, and will send you the information associated with that ID. To prevent people from getting data on others’ IDs, the company requires you to download an app that verifies the number and then makes the request. You can then delete the app without affecting your request. The app is available for both Android and iOS.

How can I opt out?

If you want to prevent Cuebiq from collecting your data, the easiest way is to disable the advertising ID on your phone. If you disable it, Cuebiq will no longer keep track of your device.

Cuebiq also provides several other ways to opt out of location tracking, outlined if you click “Control” on the company’s privacy page.

However, opting out of Cuebiq’s database will not prevent your information from being collected by a variety of other companies that gather and store precise location information. Some provide similar options, but not all do, and it is difficult to keep track of the myriad firms in the location-tracking industry.

If you want to avoid collection of your location data altogether, your best bet is to evaluate the individual apps on your phone to see whether they are collecting more about you than you would like. Prevent all but your most important apps from gaining access to the data, and allow them to get it only when you are using the app.