Security researchers say one setting left on quietly broadcasts where your phone has been

A single toggle buried several menus deep in a smartphone’s settings can quietly build a detailed record of everywhere its owner has been. Most people never open that particular menu, and once a phone is set up out of the box, the setting is easy to forget entirely. Security researchers who study mobile privacy say the feature was not built with bad intent, but its default behavior leaves a running, searchable log of someone’s movements sitting on a device or synced across every gadget tied to the same account. Knowing what the setting actually does, and exactly where it lives on the two major mobile operating systems, is the first step toward deciding whether to leave it running.

Google’s Timeline Keeps a Running Map of Every Stop

On Android phones and any device signed into a Google account, the feature now called Timeline (it was previously branded Location History) periodically records a device’s precise coordinates and saves them to that device. Google’s own account help documentation states that Timeline is off by default, but once a person turns it on, it keeps working even when no Google app is open in the foreground, attaching a timestamp and GPS reading to every stop a phone makes over the course of a day. The same documentation notes that switching Timeline off does not disable other background location tools, including Google Location Services and Location Sharing with contacts, and that any data already saved while Timeline was active has to be deleted by hand rather than vanishing automatically once the setting is flipped off. The feature can be reviewed inside the Google Maps app under the profile menu’s Timeline section, where a person can scroll a dated map of visited places going back months or years and delete individual visits one at a time. Google’s documentation separately warns that Timeline sits apart from settings such as Search Services History and Web & App Activity: a person can turn Timeline off entirely and still have location information saved elsewhere in the account as a byproduct of ordinary search and app use, because those other settings track the general area tied to an IP address rather than a precise GPS point.

Apple’s Significant Locations Runs Under the Hood

iPhones carry a comparable feature called Significant Locations, tucked three menus deep under Settings, Privacy & Security, Location Services, and then System Services. Apple’s support documentation describes the tool as tracking places a person has recently visited, how often they return, and the routes taken to get there, so the device can learn patterns significant enough to power features such as predictive directions and better-organized photo Memories. Apple states the resulting log is synced between a person’s devices using end-to-end encryption that Apple itself cannot read, but the history still lives on the phone and on any other device signed into the same iCloud account, meaning anyone who unlocks that phone can scroll through a dated list of stops. A full reset is available through Settings, General, Transfer or Reset, and then Reset Location & Privacy, though that step also clears every other location permission a person has granted to individual apps. Apple’s documentation frames the feature as a convenience tool rather than a surveillance one, noting it feeds features such as predicted destinations and preferred-route suggestions, but the same underlying list of dated stops is what a forensic examiner, a curious family member, or anyone else who gains access to an unlocked phone would see if they opened that specific settings screen.

Location Data Feeds an Industry Far Beyond Maps

The underlying category of technology, known as location-based service, covers far more than turn-by-turn directions. It is the same infrastructure that powers location-based advertising, retail foot-traffic analytics, ride-hailing dispatch, insurance telematics, and dating apps that surface nearby matches. A stored history of visited places is valuable precisely because it reveals patterns rather than single points: where someone works, where they worship, which clinics they visit, and who they spend overnight hours near. That combination of specificity and duration is what separates a running location history from the one-off GPS pin a maps app uses for a single set of directions and then discards. Retailers use geofencing to trigger a coupon the moment a shopper’s phone crosses into a parking lot, insurers use driving-route data to price policies, and family-locator apps repurpose the same underlying signal to show a relative’s position on a map in real time. Each of those uses depends on the same category of stored, timestamped location data that Timeline and Significant Locations quietly accumulate on a phone.

What Actually Changes After the Setting Is Off

Turning off Timeline or Significant Locations does not disable location access altogether; it only stops that specific running log from growing. Per-app location permissions remain a separate layer, so a weather app or a rideshare app can still request access to a device’s current position even after the history feature is switched off. Photo apps that rely on visited-place data to group vacation albums, navigation apps that use past routes to predict a commute, and yearly travel summaries will all lose some of that personalization once the log stops updating. Deleting existing history is also a distinct action from turning the setting off going forward, since both companies require a separate step to erase what has already been recorded. That means a phone that has had the feature switched on since it left the box may still be holding years of stops even after someone finally finds the toggle and turns it off. A full audit takes only a few minutes: opening Google Maps’ Timeline view or an iPhone’s Significant Locations list directly shows exactly how much history has already accumulated, which is often the moment people realize the setting had been running quietly since the day they first activated their phone.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview