Turning off GPS feels like flipping a privacy switch. In practice, it closes one door while leaving several others open. A modern phone can estimate its location — often to within a few meters — without ever touching the GPS radio, using signals it was already collecting for other reasons.

Wi-Fi positioning

Every Wi-Fi router constantly broadcasts a unique identifier (its BSSID). Companies like Google and Apple have spent over a decade building enormous databases that map these identifiers to physical locations, gathered from phones that had location services on at some point and from dedicated mapping vehicles. When your phone sees a handful of nearby Wi-Fi networks, it can check them against that database and triangulate a position — no GPS satellite required, and often faster and more accurate indoors, where GPS struggles anyway.

Cell tower triangulation

Any phone with a SIM card is constantly negotiating with nearby cell towers to maintain service. Your carrier can estimate your position from which towers you're connected to and the signal timing between them. This isn't optional or app-dependent — it's a basic requirement of how cellular networks route calls and data, and it works whether or not any location permission has been granted to a single app.

Bluetooth beacons

Retail stores, airports, and transit systems increasingly use low-power Bluetooth beacons for indoor positioning. A phone with Bluetooth enabled (which is most phones, most of the time, for headphones and smartwatches) can pick up these beacons and, combined with an app that knows the beacon map, resolve a location without GPS.

IP-based geolocation

Every request your phone makes over the internet carries an IP address, and IP addresses map to approximate geographic regions — usually city-level, sometimes tighter. Websites and apps use this constantly for things like currency defaults and language settings. It's coarse, but it's also silent: no permission prompt, no toggle.

Disabling GPS turns off one sensor. It doesn't turn off the phone's relationship with the network around it.

Why this matters

The practical risk isn't usually a single data point — it's aggregation. An app that combines coarse IP location, occasional Wi-Fi scans, and background network activity over weeks can reconstruct a surprisingly precise picture of where someone lives, works, and travels, even if that same app was never granted the "Precise Location" permission a phone's settings screen asks about.

What actually reduces exposure

• Review app permissions by category (Location, but also Nearby Devices/Bluetooth) rather than assuming GPS is the only lever.
• Use your OS's per-app "While Using" or "Ask Every Time" setting instead of blanket Always-Allow.
• Turn off Wi-Fi and Bluetooth scanning when not in use, not just the radios themselves — most phones scan for networks even while Wi-Fi is "off" unless scanning is separately disabled.
• Treat a VPN as help for your IP address, not a substitute for the permission review above — it does nothing about Wi-Fi or Bluetooth positioning.
• Assume any always-on messaging or social app has more visibility into your movement patterns than its icon suggests, and check its permissions accordingly.

None of this means location services are inherently malicious — most of it exists to make maps, ride-hailing, and find-my-device features work well. The point is narrower: a single GPS toggle was never a complete privacy control, and treating it as one leaves the more persistent tracking paths untouched.