The satellites are basically constantly yelling at the earth, and your device is just listening to their yelling. The satellites don’t know who may be listing.

GPS itself is a one-way technology. On a basic level, the GPS satellites broadcast their precise location in space, and a very accurate timestamp from an onboard atomic clock. By comparing the difference in timestamps from a few satellites, you can determine how far away you are from each, thus deducing your own position. User devices only receive broadcasts from the GPS constellation; they don't transmit. This is by design; GPS originated with the US military who wanted a navigation system usable anywhere in the world passively. You can use GPS without giving away your position by transmitting radio waves.

The privacy nightmare is when you mix a GPS receiver in with all the other sensors, storage and radios found in a smart phone. How many apps on your phone have GPS privileges? Why does it want that?

It's not as clear-cut as most people here are saying.

In short, GPS itself is just listening to satellites, and nothing is leaked that way, but most modern phones use "Assisted GPS" of some sort. The most common (I believe) AGPS is SUPL, which seems to be used by most phones. This involves sending your approximate location to an Internet server, which returns satellite data based on that approximate location.

To nobody's surprise, in Android this is a Google server. I'm pretty sure most Android distros don't give you any control over when it's used, or which servers it uses. Anecdotally, my phone without Google Play services has a horrible time obtaining a GPS fix, so I suspect without GPlay it's only using raw GPS, but I've not bothered to actually dig into it.

As I understand it, SUPL means even if you're in aeroplane mode, if you have an Internet connection over WiFi you might still be leaking (approximate) location data when using GPS.

I learned about this from this excellent series of blog posts, which is a very thorough comparison of various Android ROMs' privacy. It has a background section (search for "Assisted GPS") in each of the ROM-specific posts which explains it better than I can.

Yes, it is private by technology:

GPS and other systems working the same way are passive, similar to receiving a radio signal. You're receiving the signal of several satellites at the same time and your device calculates your position based on those signals. You're basically getting "I'm satellite cool boy and at the next beep it's exactly five past nine" all the time - only with a bit more precision. Your device does rhen the actusl position calculation locally.

Fun fact! Geo positioning is one off the few things where we need to apply both general and special relativity for real world effects: the effects due to the satellites speed and high distance to earth (and therefore the reduced effect of gravity) cause a significant shift in the speed in which clocks run on those satellites compare to Earth. As we use the exact time to calculate distance and with that position this would cause a huge drift otherwise!

GPS is not bidirectional communication, so the systems themselves (ie GNSS) aren’t tracking you just because you receive the signal. But…

• In addition to GPS, airplane mode also doesn’t shut off the Wifi or bluetooth radios; it’s usually just the cell radio.
• Your phone OS has several ways of tracking and recording your location, activities, and movements, and it generally does this at all times. For example, Find My even works when the battery on an iPhone is “dead.”
• Phones may fallback to BTLE mesh networks (like AirTags), or do background WIFI location scanning to track and record your phone’s location. Turning these off does prevent you and 3rd party apps from using the features, just not the OS.

GPS itself is receive only but if you're really paranoid, don't trust your phone to not store the location data and upload it someplace afterwards.

In theory, yes. But never fully trust your phone to do what you asked it to do.

I’m not an expert but I do not believe GPS transmits much data by itself. It would be what your service provider, apps, websites do with that GPS derived location data.

Depends on the system. Typically, the older systems do not work like this. The GPS satellites only transmit a signal that contains their location information and the time. The device must collect several of these signals and then use trigonometry to calculate your real location in time and position. Yes there are relativistic effects due to the distance to the satellites and gravity.

For instance, in home lab electrical engineering, if a person wants a really good reference clock but cannot afford a cesium atomic reference, they can use a relatively cheap GPS system to build a referenced oscillator that is disciplined by the reference clock on these satellites. I think they are cesium too, but it has been awhile since Dave Jones made YT uploads on the eevblog about it. A Garmin bicycle computer is another example. It is triangulating the signals and plotting periodic waypoints with some basic averaging.

That said, WiFi routers and cellular towers are possible to use for similar triangulation. Maybe check out Hak5 if they are still around. It has been awhile since I looked them up, but they used to make pen testing red team stuff that will infer much about vulnerabilities.

The only issue is your phone collecting location data and then relaying it to somewhere in the internet.

The privacy risk is when things have location access AND internet access.

I'm fairly certain my phone is not accessing my location unless I ask it to (I have GrapheneOS). But it's absolutely pinging my location when I open a map or upload a photo to the internet. I do those things sparingly.

AFAIK, the answer to this is yes: GPS is private because the device seeking a lock is not transmitting anything.

Satellites transmit continuous signals which are received by your device. These signals contain data about the position of the satellite and precise timekeeping metadata. Figuring out your location is a matter of comparing time of receipt to the time reported in the signal (and other similar stuff, still all reception based).

This is also why it doesn't shut off for airplane mode. Nothing is being transmitted by your device to perform the lock; it must only receive enough data.

Afaik GPS is receiving only. You simply don’t emit any signals.

It can he spoofed and jammed, but doesn’t by design give away your location.