Can Your Phone’s GPS See You? IIT Delhi Professor Uncovers A Hidden Privacy Threat

By Surabhi Gupta

New Delhi: When you use Google Maps or track a delivery, GPS seems like a basic and beneficial technology that tells you your location. However, in a recent study done by the Indian Institute of Technology (IIT) Delhi, your smartphone’s GPS may be revealing far more than just your current location, even if you believe it is offline.

A study conducted by Soham Nag, M.Tech student at IIT Delhi’s Centre of Excellence in Cyber Systems and Information Assurance, and Dr. Smruti R. Sarangi, Professor in the Department of Computer Science and Engineering, has found that GPS signals contain a wealth of unwanted data. Their work, “AndroCon: An Android Phone-based Sensor for Ambient, Human Activity and Layout Sensing using Fine-Grained GPS Information,” was published in the peer-reviewed journal ACM Transactions on Sensor Networks.

By analyzing subtle variations in GPS signals such as frequency change, signal strength, and a multipath effect, an app could determine whether or not a person was sitting, walking, or lying down, whether the person was in a crowded metro or an empty, quiet room, and even map the approximate layout of an indoor space.

“We were reading a lot of international media reports suggesting that even when cameras, microphones, and internet connections are turned off, phones continue to collect and exfiltrate private information,” Dr Sarangi told ETV Bharat. “Our study shows that GPS data, which a phone continuously receives even in airplane mode, can be a significant carrier of private information. Even in environments where GPS signals are feeble, it is possible to find the mobile users’ immediate environment (small room, big room, underground, overground, on a flight, etc.), layout of the building and nature of human activity.”

GPS technology was designed to calculate location using signals from at least four satellites. However, in practice, smartphones interact with many more satellites than that, receiving vast streams of data to refine precision and correct for atmospheric effects. It’s this extra, ‘fine-grained’ information that can be exploited to infer much more than just coordinates.

The research team developed AndroCon, a framework that turns these overlooked GPS signals into a kind of “covert sensor.” Using nine low-level GPS parameters, combined with signal processing and machine learning, AndroCon can classify human activity and surroundings with remarkable precision.

“Across a year-long study covering nearly 40,000 square kilometres and multiple smartphone models, AndroCon achieved up to 99% accuracy in detecting environments and over 87% accuracy in recognising human activities, even subtle ones like hand-waving near the phone,” said Dr Sarangi.

Perhaps most astonishingly, the system could reconstruct indoor layouts, identifying walls, staircases, and elevators, with a margin of error under four meters, all without using the camera or motion sensors.

While the breakthrough opens the door for innovations in context-aware smart services, such as intelligent assistants that adapt to your activity or location, it also raises major privacy concerns. Any Android app that has “precise location” permission could, in theory, collect and process this same GPS data to infer intimate details about users’ lives.

“This study reveals an unseen side of GPS: a powerful but silent channel that can sense the world around us,” Dr Sarangi warned. “It’s a reminder that even familiar technologies can hide capabilities that, in the wrong hands, could be misused.”

The researchers emphasize that users can take several steps to safeguard their privacy:

• Download apps only from verified sources with high security ratings.
• Avoid granting precise location access unless absolutely necessary.
• If permission is required, restrict it to ‘while in use’ rather than background access.
• Uninstall unused apps and prevent unnecessary ones from running in the background.

Dr Sarangi cautions that if users notice data leaks or privacy breaches despite having other sensors turned off, GPS-based data exfiltration could be the cause. “In such cases, it’s a clear instance of cybercrime,” he said.