Phones using Google’s operating system, Android, have been collecting their users’ location data, even when a user has turned off the device’s location services, Quartz reported on Tuesday.
The company has been collecting such data on Android users since the start of 2017, according to the report.
A Google spokesperson confirmed to the outlet that it had been collecting the addresses of cell towers near Android users, and therefore could roughly track the movements of users with such phones.
{mosads}
The data was never used or stored, the Google spokesperson told Quartz. The company also said that Google plans to stop collecting such data by the end of November.
The discovery raises significant privacy concerns about Google’s data collection practices. Google and other firms’ software typically lets users know up front if their information is being collected and give them the chance to opt out, or to not use the product if they’re uncomfortable with the terms.
In this case, even users who disabled location services were not given clear warning that their data would still be collected by Google regardless.
“It has pretty concerning implications,” Bill Budington, a security engineer at tech advocacy group Electronic Frontier Foundation, told Quartz. “You can kind of envision any number of circumstances where that could be extremely sensitive information that puts a person at risk.”