The NSA is again urging every phone owner to switch off one location setting

The National Security Agency, best known for signals intelligence rather than consumer advice, has spent several years quietly telling the public a simple thing: the location data a smartphone constantly generates is a security problem, and most of it can be switched off. The agency’s guidance treats a phone’s position not as a convenience feature but as a stream of sensitive information that advertisers, data brokers, and hostile actors can all buy or intercept.

The single setting the NSA keeps returning to is location services itself, the master switch that lets apps and the operating system record where a device is at any moment. Turning it off does not make a phone invisible, and the agency is careful to say so. What it does is shut the easiest and most abundant tap, the one that feeds the marketplace in movement histories that has grown up around modern mobile devices.

Why a phone is a continuous location beacon

A smartphone establishes its position through several independent channels, and each one leaves a trail. Satellite navigation chips read signals from GPS and similar constellations to fix a location to within a few meters. Wi-Fi and Bluetooth radios note the identifiers of nearby networks and devices, which map neatly onto known physical addresses. Cellular radios must register with towers to place and receive calls, producing a rougher but constant record of which cell a phone is using. According to the NSA’s published cybersecurity guidance, these channels operate whether or not a person is actively using navigation, and several of them cannot be fully silenced without disabling the radios that make a phone a phone.

That layered design is the reason the agency frames the problem as one of exposure reduction rather than elimination. Even a device with location services switched off still talks to cell towers, and airplane mode, which quiets the radios, defeats the purpose of carrying a connected phone. The realistic goal, in the agency’s framing, is to cut the volume of precise, app-level location data that accumulates during ordinary use.

The market that turns movement into a product

The reason the setting matters is economic as much as technical. Many free apps embed advertising and analytics code that collects location in the background and forwards it to third parties. Those third parties aggregate feeds from thousands of apps into detailed movement profiles, which are then sold to advertisers, analytics firms, and in some cases government buyers. A single anonymous-looking string of coordinates becomes identifying once it shows where a device sleeps at night and where it spends the workday.

Intelligence and security officials have warned that this commercial pipeline is not hypothetical. Location records assembled from ordinary apps have been used to track the routines of military personnel, expose visits to sensitive sites, and identify individuals who assumed they were anonymous. The Federal Trade Commission has taken enforcement action against data brokers accused of selling precise location histories without meaningful consent, underscoring that the trade is large enough to draw regulators. The NSA’s contribution is to point out that the raw material for that trade comes straight from settings most owners never examine.

What switching the setting actually changes

Disabling location services stops apps from reading the device’s precise position and prevents the operating system from logging a continuous location history for features such as saved travel timelines. It does not stop a carrier from knowing which tower a phone is connected to, and it does not erase data already collected. A person who turns the setting back on to use a map hands access to whichever apps have permission at that moment, which is why the agency also recommends granting location only to apps that genuinely need it and only while they are open.

The guidance extends beyond the master switch to a set of related habits. Advertising identifiers can be reset or disabled to make cross-app tracking harder. Bluetooth and Wi-Fi can be turned off when not in use, since both broadcast signals that help pin down a location. App permissions can be reviewed periodically to revoke access that was granted once and forgotten. None of these steps is dramatic on its own, but together they shrink the surface area a phone exposes.

Guidance aimed first at people with the most to lose

The NSA’s original audience was not the general public but the military and intelligence workforce, whose movements can carry national-security consequences. That origin explains the cautious tone. The advice is written for people who cannot afford to assume that anonymized data stays anonymous, and it has since been repackaged for anyone who owns a phone because the underlying exposure is identical regardless of who carries the device.

Security researchers outside the government generally echo the recommendations while noting their limits. Location privacy on a modern phone is a matter of degree, not a switch that guarantees invisibility. A determined adversary with access to carrier records or a court order can still reconstruct a device’s path. What the setting addresses is the far larger and less controlled world of commercial data collection, where the barrier to obtaining someone’s movements is often nothing more than a purchase.

A recurring message rather than a new alarm

Because the advice reappears periodically, it can read like a fresh warning each time, but the substance has been consistent. The technology that makes phones useful also makes them trackable, the data has commercial value, and the individual owner holds a meaningful amount of control through settings that ship switched on by default. The agency’s repetition reflects how rarely those defaults get changed rather than any sudden new threat.

For most people the practical takeaway is modest. Reviewing which apps hold location permission, limiting access to active use, and turning the master setting off when it is not needed will not make a device untraceable, but it removes the phone from the easiest and most heavily trafficked lanes of the location-data economy. That, in the NSA’s view, is the point.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview