Main content
Internet safety
Course: Internet safety > Unit 1
Lesson 5: Going deeper with safe browsingGeolocation
The Internet is global, yet it can help us find the services, products, and events near us. Where's the nearest bank? What restaurants will deliver to me? Which of my friends live in the area? What bus will get me to my destination?
To answer those questions, a program needs to know a user's geolocation: an approximate latitude and longitude describing their geographic location.
Let's review the ways that geolocation can be determined and consider the many ways it can be used.
Device positioning systems
The geolocation of a user is actually the position of a user's device, whether that's a home computer, laptop, smartphone, or fitness tracker.
There are multiple ways for a device to determine its own position in the world, ranging from the most precise (GPS) to the least precise (IP-based geolocation).
Global positioning system (GPS)
The US government started the GPS project in the 1970s and now controls around 30 GPS satellites orbiting the earth.
GPS receivers are tiny sensors with antennas that receive radio signals from the GPS satellites orbiting in the sky above. In most cases, if a sensor can receive signals from at least four satellites, the receiver can calculate its position using a technique called trilateration.
GPS works best in an outdoor environment with a clear view of the sky. A smartphone can typically record a geolocation that is accurate to within 4.9 m (16 feet) in open sky. GPS doesn't work as well indoors or near buildings due to the interference caused by roofs, walls, and other objects, but it is still the most precise source of geolocation data.
Wi-Fi positioning system
Wi-Fi positioning is a strategy that works well in dense, urban areas filled with Wi-Fi networks (nearly the opposite of where GPS works well).
First, a device with a Wi-Fi antenna can scan for Wi-Fi access points and measure the signal strength to each network.
That results in information like the table below. Note that signal strength is always negative, so the number closest to zero is strongest.
| BSSID | MAC address | Signal strength (RSSI) |
|---|---|---|
| NETGEAR09 | A3:F3:5D:2A:A3:1B | -59 |
| NETGEAR09-5G | A3:F3:5D:2A:A3:1B | -72 |
| Sonic-b346 | 53:19:DA:E0:57:3A | -79 |
| Emdutos | E3:84:14:BC:BC:FF | -84 |
| Baskind Bunch | 52:8D:5E:29:E7:5A | -85 |
| Sonic-9472-5G | 4C:4C:DB:91:1A:1A | -88 |
| xfinitywifi | F8:59:F4:FC:C5:F1 | -93 |
Once the device has that information, it can use trilateration. The device determines the location of each access point by looking it up in a Wi-Fi location database or in their own (smaller) cache of locations. It then estimates its own location based on the found locations and their signal strength.
A more accurate technique is fingerprinting, but it's only possible if a fingerprint map has been made ahead of time. To make the map, a portable device computes the fingerprint for many reference points within a particular area. Each fingerprint is the list of nearby networks and their signal strength, like the table above, plus a pair of geographic coordinates.
When a mobile device enters the area and needs to know its location, it can send its fingerprint to the machine with the radio map, and the machine uses an algorithm to compute the closest fingerprint and estimate the coordinates accordingly.
This technique can be very accurate indoors, especially with a dense fingerprint map, but it's not yet in common use, since it depends on the existence of that fingerprint map.
Cell tower trilateration
In the US, cellular phones are legally required to report their approximate location in the case of 911 calls, to help emergency services get to the callers quickly. If a cell phone is unable to use GPS to report its location, it can instead use cell tower trilateration.
Cell towers are what makes cellular networks possible. Each cell tower includes three sets of directional antenna arrays in a triangular shape:
The cell tower can estimate the distance between the tower and a phone by measuring the round-trip delivery time and signal strength. It can improve that estimate by knowing which of the three antenna arrays sent the signal. A single tower is enough to calculate a wide area, but if multiple towers are available, the location can be narrowed down to a smaller area.
IP-based geolocation
Whenever a device sends data over the Internet, it also sends along an IP address. Even though an IP address isn't like a mailing address that describes an unmoving place in the world, it is often possible to map IP addresses to a geographic area.
IP geolocation databases contain millions of rows mapping IP addresses to locations. Companies create those databases based on a variety of sources such as regional IP address registries, user-submitted locations on websites, data from ISPs, and estimates based on network routes.
To give you an idea for the accuracy, I looked up my own IP address in three different IP geolocation databases. The results:
| Country | State | City | Latitude | Longitude |
|---|---|---|---|---|
| USA | California | Corona | 33.8753 | -117.5664 |
| USA | California | Richmond | 37.9358 | -122.3478 |
| USA | California | Santa Clara | 37.3541 | -121.955 |
The databases all got the country and state correct, and for some purposes, that might be all that's needed. However, the coordinates span a range of 475 miles! 😬
IP-based geolocation is typically the last resort, since it is the most inaccurate of all the techniques. Plus, if a user is accessing the Internet through a VPN (Virtual Private Network), their true IP will be hidden and the VPN's IP could be geolocated in an entirely different continent.
Program access to geolocation
Even when a device has a way to determine its geolocation, it doesn't necessarily expose that information to the software running on it.
Let's look at the various ways that websites and mobile applications can find out the user's location.
Request access
Webpages can use the browser's built-in geolocation API to request the current geolocation. The browser calculates the geolocation using many of the strategies mentioned above and returns the most accurate one.
The browser will first ask the user for permission, however.
Here's what that request looks like in the Chrome browser:
Mobile apps also typically must ask for permission for the current geolocation, although that depends on the mobile platform (i.e. Android vs. iPhone). Some apps will even request permission to continually collect the user's geolocation, even while they're not actively using the app.
Here's a request from an app on an Android phone:
IP-based geolocation
When a user visits a website, their browser sends an HTTP request to the web server. The HTTP request is wrapped in an IP packet, so it always includes the sender's IP address.
As we described above, the web server can use an IP geolocation service to turn the user's IP address into an approximate location.
IP-based geolocation isn't terribly accurate, but it can at least give a website a clue as to where their users are coming from. The website can use the approximate location to personalize the experience, serve targeted advertisements, or simply understand their user demographics better.
User input
Websites and apps can also simply ask the user for their location.
For example, the user can type in an address and the website can use a geocoding service to convert that into a latitude and longitude.
Here's a store locator that shows the nearest stores for a user's zip code:
Websites can also detect the geolocation of user uploaded photos by looking at the metadata of each photo file, since many phones automatically record location inside photo files. Users don't always realize that, so online photo galleries have become a treasure trove of publicly available user locations.
Benefits and risks
Thanks to geolocation, we can find our lost phone, discover a local café to satisfy our craving for a quiche, or document an epic cross-country bike ride. Law enforcement agencies can locate violent offenders, and ambulances can rush to a caller's location.
But geolocation is also private information, and public access to private information always has its risks:
- There have been multiple cases of people using publicly accessible geolocation data to stalk a former partner or a stranger.
- Law enforcement agencies have been accused of using an inaccurate geolocation to wrongly accuse someone of a crime.
- Websites can choose to censor information based on where they think a user lives.
🤔 What are other negative consequences of allowing our geolocation to be tracked by devices, networks, and programs?
🙋🏽🙋🏻♀️🙋🏿♂️Do you have any questions about this topic? We'd love to answer—just ask in the questions area below!
Want to join the conversation?
Can websites sell your location to other companies or websites?(15 votes)
companies or websites, but it depends on various factors, including the website's privacy policy, user consent, and legal regulations.
Here's how it works:
User Consent: Some websites request permission to access your location for specific purposes, such as providing localized content or services. When you grant permission, the website may collect and use your location data. However, reputable websites typically use this data for their intended purpose and do not sell it without your explicit consent.
Third-Party Services: Some websites incorporate third-party services, such as advertising networks or analytics providers. These third parties might have access to your location data if the website shares it with them. In some cases, these third parties could use the data for targeted advertising or other purposes.
Privacy Policies: Reputable websites have privacy policies that explain how they collect, use, and share your data, including location information. Before using a website, it's a good practice to review its privacy policy to understand how your data is handled.
Legislation and Regulations: Laws like the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the United States place restrictions on how websites can collect, use, and share personal data, including location information. Websites must comply with these regulations and provide options for users to control their data.
Opt-Out Options: Some websites offer users the ability to opt out of location tracking or data sharing. This allows users to make informed choices about whether they want their location data to be collected and shared.
Invasive Practices: Unfortunately, there have been cases of less reputable websites or data brokers that collect and sell users' location data without their explicit consent. These practices are considered invasive and raise serious privacy concerns.
To protect your privacy:
Check Permissions: Review the permissions you grant to websites and apps when they request access to your location. Consider whether the requested access aligns with the purpose of the website or app.
Use Browser Settings: Modern web browsers allow you to control website access to your location. You can choose to allow or block location access for individual websites through browser settings.
Review Privacy Settings: If a website provides user accounts, check your account settings for privacy options. Many platforms offer settings to control data sharing and ad personalization.
Stay Informed: Keep up to date with privacy regulations and practices, as they can vary based on your location.
It's important to be cautious about the websites you use and to make informed decisions about sharing your location data online.(7 votes)
Why on earth would phones automatically record location inside photo files?(6 votes)
It's helpful if you're looking through your pictures, and perhaps you wonder exactly where that picture was taken. It can be helpful if you're at a store and see a product that you like. Or you can just use it to bookmark a location.(8 votes)
Does geolocation have security protocols?(6 votes)
Yes, there are some security protocols. For example, the article mentions that browsers and mobile devices ask the user for permission before sharing your geolocation with a website or mobile app. However, before sharing your geolocation with a service, you must trust that they will handle that data responsibly.(5 votes)
- its bad because someone could rob you or kidnap you.(8 votes)
- Why can they track your Geo location and coordinates of where you live, isn't that private information you are not supposed to tell or show anyone...?(7 votes)
- Geolocation is dangerous in many ways. But we could turn off our GPS on apps. What will happen if in a few years we can't do that?(3 votes)
- I'd say that if you can't turn off GPS, use an older operating system/model, or if this is an app-specific issue, simply use a different app. Your geolocation is likely not worth whatever service the app provides.(8 votes)
If you call the police, where does your phone send your information(IP address, WiFi address, Geolocation etc)? Can the information get hijacked along the way to its destination? Does it send the information immediately, if at all? Or does the police station have to look for your information?(5 votes)
The police have access to "Enhanced Called ID" which is used to identify where you are using your phones built in GPS/Geolocation software.
Happy Browsing!(2 votes)
when someone is at sea do GPS satilites connect with the ship you are on, or do they communicate with the nearest land conneting point and then the land conecting points communicate with the ships?(3 votes)
both. On a ship, the GPS satellites are primarily used (directly to the ship), but sometimes land points are used (directly to the ship) to give a more precise reading.(6 votes)
- Why does it always ask for our location(4 votes)
Well it depends on the app but there is many reasons why a website or app might ask you for your location.
Here are some apps/websites and why they ask for your location.
Weather: With your location, weather apps can accurately give you the forecast for your area.
Maps & Travel: Navigation apps require your location for turn-by-turn directions, and use your location to help you find cool places nearby. Ride-sharing apps (like Uber and Lyft) also use your location, so drivers know where to pick you up.
Social Media: Social media apps ask for your location if you want to tag yourself at a cool place.
Smart Home: Your location is used for geofencing so that devices in your house automatically turn on and off when you leave or get home.
Shopping: Many retail store apps will ask for your location for simple things, like easily finding a location nearest you.
Camera: Camera apps can use your location data too, mostly to insert the location into the EXIF data in photos!
Games: Few games require your location, but some (like Pokémon Go) rely heavily on it.
Some apps don't even need your location at all but instead use your location to track you and show you targeted ads based on your location history.
In the end, remember to think about who you want to give your location too. And if an app/website really needs your location or not.(2 votes)
Can all websites track you 🤣🤩(2 votes)
Yea...
They can, so stay of shady websites!(4 votes)