How Cellular Networks Locate Your Phone: What Your Carrier Can See

You switch off Location Services, deny apps access to coordinates and turn on a VPN. The GPS icon disappears. Does that mean your mobile operator no longer knows where your phone is?

No. While a device remains registered to a cellular network, the operator needs information about the area in which to reach it for calls, data and mobility management. But this does not mean every network record contains a pinpoint map coordinate.

This guide follows LTE and 5G registration, SIM/eSIM identifiers, cell coverage, Timing Advance, positioning systems, signaling threats, fake base stations and the privacy boundary of 5G SUCI. We then examine a documented US case involving unauthorized commercial access to carrier location data.

This is for ordinary smartphone owners, with real protocol detail and defensible evidence standards rather than mythology about instantly locating anybody from a phone number.

A telephone number such as an international +country-code number is typically called an MSISDN. It is used to route calls and messages. A handset does not need to broadcast this familiar number as its radio identity when registering with the cellular network.

Instead, network systems associate a subscription, its permanent identifier, temporary identifiers and allowed services. Different generations use IMSI, GUTI, 5G-GUTI and related values. The associations reside in operator systems.

Knowing only a phone number does not automatically grant an outsider access to the serving cell, IMSI, IMEI or GPS position. That would require additional data, infrastructure access or some other mechanism not contained in the number itself.

IMSI identifies a mobile subscription and is traditionally held in the USIM. IMEI identifies equipment rather than the legal holder of a telephone number. MSISDN is the familiar phone number. TMSI/GUTI are temporary identities intended to reduce exposure of a permanent subscription identifier.

5G introduces a permanent SUPI and, under applicable privacy protection, a concealed SUCI for relevant radio procedures. A network can also assign a temporary 5G-GUTI.

These are different entities. One phone may have two subscriptions, an eSIM can move between devices, numbers can be reassigned, and IMEI is a device property. Phone number = SIM = handset = person is an unreliable identification model.

A handset reads relevant USIM information, scans radio bands and selects a suitable network and serving cell. In LTE, registration involves the Evolved Packet Core, with the MME handling key mobility functions. In 5G Standalone, the 5G Core uses an AMF, with subscription and authentication services involving AUSF/UDM.

The network must determine whether the subscription is authorized and set up secure contexts. That involves authentication between the device and home network as well as temporary identifiers.

5G Non-Standalone and Standalone are not equivalent. NSA may use LTE as its anchor and the EPC, whereas SA uses a 5G Core. Seeing a "5G" icon is not proof that all 5G SA identity privacy mechanisms are active.

A base station can serve several antenna sectors with distinct directions and coverage. A serving cell identifier points to a radio resource, not a guaranteed geographic coordinate for the handset.

When a device is not actively transferring user data, the network may know its whereabouts primarily at a Tracking Area level or within an allowed registration-area set. To deliver an incoming event, the network uses paging and the handset may then establish a radio connection.

During an active session the network performs handovers as the device moves. Registration-area changes trigger updates. These procedures generate operational telemetry, but their granularity and retention depend on device state, configuration and operator policy.

Imagine a record showing that a handset used Cell ID 123 at 18:42. It identifies a radio resource at a moment in time. It does not prove the handset was beside the mast, in the center of the sector or inside the closest building.

Coverage depends on antenna height and azimuth, terrain, buildings, frequency, power, congestion, reflections and handover configuration. Devices do not always connect to the geographically nearest tower.

Historical cell-site location information (CSLI) can support estimates about possible coverage areas but often cannot pinpoint position. The UK's Forensic Science Regulator explicitly requires uncertainty to be expressed rather than claiming that basic cell-site analysis proves an exact location.

Cell ID tells you which radio cell was involved. Timing Advance (TA) adjusts uplink timing so handset transmissions arrive in the expected intervals. TA can contain coarse distance-related information, but it is not a ready-made "meters to the subscriber" field.

Multipath propagation, quantization, radio technology and network state affect precision. You cannot multiply an arbitrary TA by a constant and claim to know an apartment's coordinates.

Methods based on arrival time, signal angles and multiple reference points rely on a different measurement model. They require relevant radio measurements, known infrastructure positions and algorithms not available from a lone Cell ID record.

LTE specifies several positioning families. E-CID combines serving and neighboring cell information with available measurements. OTDOA compares observed time differences for signals from multiple base stations. A-GNSS uses satellite positioning assisted by network information.

These are distinct procedures with different accuracy and availability. A-GNSS may involve a device reporting accurate coordinates, but a protocol supporting it does not prove every carrier continuously collects GPS fixes from all phones.

Historical call records, a current Cell ID and a dedicated positioning request are different types of evidence. Accuracy statements require the method, conditions and uncertainty to be specified.

The 5G Standalone architecture includes a Location Management Function (LMF) to process positioning tasks. The AMF participates in access management and can route requests to LMF, while GMLC appears in the authorized Location Services architecture.

Methods include DL-TDOA, UL-TDOA, Multi-RTT, angle measurements and Positioning Reference Signals (PRS). Availability depends on handset, network features, infrastructure density and synchronization.

3GPP TS 38.305 describes this architecture. But the existence of an LMF specification does not mean every operator always knows every subscriber's position to within a meter. Deployment, authorization, measurements and radio conditions matter.

"Tower tracking always locates you within 50 meters" is not a defensible general claim. Knowing a serving cell may correspond to a large geographic area. Dedicated multi-signal positioning can be far more precise in favorable conditions, but not always.

Ask which method was used, what radio observations existed, sector configuration, network state, propagation conditions and uncertainty bounds. Even a latitude/longitude point is misleading without an uncertainty estimate.

A forensic analyst must distinguish plausible presence within a service area from proof that the device occupied a particular room. A correct handset position also does not establish who was holding it.

Phones can remain idle to conserve battery. The network maintains the registration area needed to reach a device, but does not necessarily receive a continuous stream of exact coordinates while it moves inside that area.

An incoming call, a data session or a registration-area crossing can trigger further signaling and new records.

An important distinction follows: the network's ability to reach a handset today is not identical to the historical records preserved for months. Retention differs across providers, and an absent record does not prove that a handset was absent.

Operators maintain several technical record families, including Call/Charging Detail Records (CDRs), session records and sometimes serving-cell or sector data. Investigators may use historical CSLI to study which radio resources were used during relevant events.

But these should not be imagined as one universal table accessible to anyone for any duration. Fields, retention and access vary by country, system, provider and service. Some high-precision fixes occur only through separate procedures and may not be stored as ordinary call records.

An analyst needs field definitions, timezone handling, network maps relevant to the incident date and information about infrastructure changes. Correct raw records can still be interpreted incorrectly.

In 5G, the permanent subscription identity is the SUPI. A SUCI can conceal it over the radio using a protection scheme and the home network's public key during applicable procedures.

Not every SUCI field is concealed: information needed to route toward the home network, such as MCC/MNC, remains visible. The standard also includes a null-scheme, and actual protection depends on operator and USIM provisioning.

SUCI reduces direct exposure of a permanent identity but cannot hide the handset from the network serving it. Temporary identities can also associate activities during their lifetime.

An eSIM changes how a subscription profile is stored and provisioned; it does not make the radio protocol anonymous. Depending on registration procedures and policy, an operator can associate a subscription with an equipment identifier observed on the network.

IMEI/PEI relates to equipment, while IMSI/SUPI relates to a subscription. Switching SIMs can change subscriber identifiers without necessarily changing all equipment-related evidence. Still, a matching IMEI does not prove which person was physically using the phone.

Professional attribution requires corroborated registration records, lawfully available contextual evidence and consideration of alternative explanations, not just a single IMEI string.

A cell-site simulator, often called a Stingray or IMSI catcher, mimics cellular infrastructure to interact with or observe nearby devices. Capabilities depend heavily on the equipment, network generation and handset configuration.

Legacy 2G lacks some critical mutual-authentication protections, making fake-base-station and downgrade risks particularly important. 4G and 5G have stronger cryptographic and procedural defenses, but are not absolutely immune to every form of radio surveillance.

Active and passive approaches differ, while "IMSI catcher" is often used loosely for several technologies. It is misleading to claim every such device can decrypt modern 5G sessions or read end-to-end encrypted Signal messages.

Cellular networks include more than radio towers. SS7/MAP historically supported subscription service and routing across telecom operators. LTE also uses Diameter interfaces, and packet-session control can involve GTP.

Insufficiently controlled access to trusted signaling networks can permit unauthorized queries for subscriber or location information. ENISA and ITU document these threat classes. That does not mean any random internet user can send an "SS7 command" and instantly obtain coordinates.

5G introduces different security boundaries, network-function authorization and inter-operator mechanisms such as SEPP. But roaming, migration and backward compatibility keep the security of older interfaces relevant.

A VPN establishes a tunnel for selected IP traffic. But the phone must first attach to a cellular network, authenticate and obtain service before it can send VPN packets.

The carrier providing radio access still serves a particular subscription and cell. A VPN does not replace IMSI/SUPI or stop paging, handovers and relevant network telemetry.

A VPN can hide parts of ordinary IP traffic from local infrastructure and alter the public IP seen by websites. That is useful but a different protection layer. Tor and proxies likewise do not eliminate radio-network registration.

Denying app location permissions usually restricts access to Location Services APIs. System-level positioning may combine GNSS, Wi-Fi, Bluetooth and cellular signals.

App-level controls matter: they reduce coordinates leaked to advertising SDKs, websites and applications. But the carrier still needs to manage radio service for the handset. These are separate mechanisms and data owners.

Similarly, turning off Wi-Fi or Bluetooth limits particular observation channels but cannot delete prior cell registration data. A website's GPS permission is not the same thing as cellular subscription registration.

With Wi-Fi Calling, voice services may traverse Wi-Fi into the carrier's IMS infrastructure. Serving-cell information, Wi-Fi details and public network exits depend on actual radio and connection state, not merely a service label.

In roaming, a visited network handles portions of registration while the home carrier remains involved in authentication and service. MVNOs can have different commercial and operational divisions of data depending on host-network arrangements.

Wi-Fi Calling does not necessarily "erase all radio traces," and every provider does not hold an identical dataset. Implementation and recorded evidence matter.

On April 29, 2024, the FCC announced nearly $200 million in fines against AT&T, Sprint, T-Mobile and Verizon over unauthorized sharing of access to customers' location data and inadequate safeguards.

This was not a GPS-chip exploit. It concerned a commercial chain of access to sensitive carrier-side information. It demonstrates why careful app permissions cannot control all data-sharing agreements between carriers and intermediaries.

The regulator's decision should not be exaggerated into "every carrier currently sells anyone's coordinates to anybody." Policies, legal proceedings and industry practices can change, and the carriers disputed aspects of the actions.

Suppose authorized investigators obtain records indicating subscription X used sector S of cell site B at 21:10. They know the UTC timestamp, event type, network identifier and the sector's configuration at the relevant date.

Step 1: validate the source. What do the fields mean? How are timestamps recorded? Does the record refer to a subscription, device or carrier account? Step 2: assess coverage. Review site position, antenna direction, height and radio environment without drawing arbitrary circles as if they were measured distance.

Step 3: evaluate alternatives. Other cells could have served the handset; the nearest tower may not have been selected. Step 4: seek independent corroboration. Surveillance video, travel records or other lawfully acquired facts can test the hypothesis.

Conclusion: the record may support compatibility with presence in a service area, but it does not prove an exact address or identify who physically held the handset. That is digital forensic discipline, not magical triangulation.

Professional analysis is more than a screenshot of a map. Preserve provenance, acquisition process, field definitions, timezone, retention period, relevant network configuration and precision limits.

Exported files can be integrity-checked with digests; record who obtained them, when, how custody changed and which elements are raw data versus analyst annotations. A SHA-256 file digest verifies file integrity, not positioning accuracy.

At every stage distinguish evidence relating to a subscription, physical device or human user. Even a verified IMSI does not automatically identify the person holding the phone at the relevant moment.

An ordinary person holding an MSISDN gains no administrative access to the carrier's infrastructure. Websites promising "enter a number to view its exact live location" should be treated skeptically: some are scams, phishing tools or personal-data harvesting operations.

A phone number can still identify online accounts, lead to publicly exposed profile information or be targeted through SIM-swap fraud. Those are different problems from reading radio mobility records.

The correct question is who has access to which records and through what legal authority? A carrier, application, advertising intermediary, call recipient and random web visitor have very different capabilities.

On iPhone: review app location permissions, keep iOS updated and secure the Apple account. Users with elevated threat models may consider Lockdown Mode, which among other restrictions disables 2G/3G support, but can limit functionality. It does not erase normal cellular registration in supported modern networks.

On Android: where supported, consider disabling 2G and reviewing Mobile network security. Android 16 offers additional cellular security notifications on compatible devices. Labels and availability vary by manufacturer, modem and operating system.

On any phone: secure carrier accounts against SIM swaps, use end-to-end encrypted messaging, apply system updates and minimize excess app permissions. These steps reduce risk but do not remove the need for radio registration.

Airplane mode normally disables the cellular modem for ordinary service, though Wi-Fi, Bluetooth and emergency behavior can vary by device and OS. Check actual radio state rather than assuming the airplane icon proves everything.

Without an active SIM/eSIM a device generally cannot complete ordinary subscriber registration, but emergency services may still involve specialized cellular procedures. A powered-off phone is not normally conducting active cellular registration, although certain devices have additional location-finding capabilities using other radios, which should not be confused with carrier tracking.

Importantly, stopping new radio activity does not erase historical records held by carriers, apps or other services.

"Turning off GPS hides me from my carrier." No; radio registration operates independently of app GPS permissions.

"Every cell record is a map pin." No; coverage assessment and uncertainty matter.

"A VPN hides my SIM from the tower." No; the tunnel runs over established radio service.

"5G cannot be tracked at all." No; SUCI protects particular identity procedures, not mobility management itself.

"Every IMSI catcher can read Signal." No; radio interception and end-to-end encryption are distinct layers.

"Carriers always know the exact apartment." No; precision depends on the method and context.

"Having a number lets me buy exact live location." No; a number is not permission to access carrier systems.

Think about smartphone privacy as four distinct layers. The radio network knows how to serve the subscription and where to page the handset. The positioning system may calculate coordinates with a measurable uncertainty when relevant methods and observations are available. The OS and apps access location through their own mechanisms and permissions. Commercial recipients of data may create further links and risks.

These layers can exchange information, but they are not one universal database. Switching off GPS does not remove registration records. A VPN does not erase the serving cell. Historical claims require trustworthy records, a validated method and a clear uncertainty assessment.

Good privacy is not a myth about an invisible phone. It is knowing which data is needed for connectivity, which exposure you can reduce and who is trusted with the rest.

EFF - Mobile Phones: Location Tracking
EFF - Understanding IMSI Catchers
3GPP / ETSI TS 33.501 - 5G Security Architecture
3GPP / ETSI TS 38.305 - 5G NR Positioning
ENISA - Signalling Security in Telecom (SS7, Diameter, 5G)
ITU-T Q.3066 - Signalling attack detection and mitigation (2026)
Canadian Centre for Cyber Security - IMSI catcher protections
Android Open Source - Mobile Network Security
Android Open Source - Disable 2G
Apple - Lockdown Mode security restrictions
FCC - Carrier location data enforcement (April 2024)
UK Forensic Science Regulator - Cell-site analysis code
University of New Hampshire - Historical CSLI reliability
Microsoft - 5G NSA and SA technical terminology
Google Security Blog - Android cellular security protections