You’ve seen the toggle a thousand times. Under your phone’s privacy settings, there is a switch for "Location Services." You flip it to "Off," confident that you’ve just pulled the digital curtains shut. But while your apps might stop seeing where you are, your cellular carrier hasn’t blinked.
Behind the sleek interface of iOS and Android lies a parallel world of hardware-level tracking. This infrastructure doesn't care about your OS settings because it doesn't live in your OS. It lives in the baseband processor—the "phone within your phone"—and communicates via a protocol known as SUPL (Secure User Plane Location).
The Question: Can your carrier track your precise GPS location even when you’ve disabled location services in your phone’s settings?
The short answer is yes. While you can stop Instagram or Google Maps from seeing your coordinates, the cellular network maintains a "backdoor" to your GPS hardware to ensure emergency services work and to maintain network optimization. This process happens at the modem level, often bypassing the main operating system entirely.
The Simple Explanation (ELI5)
Imagine your smartphone is a house. The "Location Services" toggle is like closing the blinds on your windows so neighbors (apps) can't see in. However, the house was built with a hidden security camera system integrated directly into the walls (the modem) by the landlord (the carrier). Even if you close every blind and turn off every light in the rooms, the landlord can still ping those cameras to see exactly where the house is sitting on the map. They don't need your permission to look because the camera system has its own power supply and its own secret phone line to the landlord’s office.
How It Actually Works: The Baseband and SUPL
To understand how this happens, we have to look at the Baseband Processor. Your phone actually has two main "brains." The Application Processor (AP) runs your OS and apps. The Baseband Processor (BP) is a proprietary, closed-source chip that handles all radio communications. Modern modems, like the Qualcomm Snapdragon X80, handle GNSS (GPS), Cell-ID, and Wi-Fi positioning independently of the main CPU.
1. Assisted GPS (A-GPS) and the Need for Speed
Standard GPS is slow. A "cold start" can take several minutes to find satellites. To fix this, carriers use Assisted GPS (A-GPS). According to Qualcomm 2024 data, A-GPS reduces the Time-To-First-Fix (TTFF) from several minutes to under 10 seconds. It does this by sending satellite data (ephemeris) to your phone over the cellular network.
2. The SUPL Protocol: The Invisible Ping
The SUPL (Secure User Plane Location) protocol is the bridge. When a carrier wants your location, the SUPL Location Platform (SLP) server sends a "SUPL INIT" message to your phone. This isn't a standard data packet your OS sees; it’s a signaling message that goes straight to the modem. The modem then wakes up the GPS hardware, calculates the position, and sends it back to the carrier—all without the "Location" icon ever appearing in your status bar.
3. RRLP Signaling
The Radio Resource Location Protocol (RRLP) is the language used over these signaling channels. It allows the network to request measurements from your device. Even if GPS is totally blocked, the network uses Cellular Triangulation. While accuracy varies from 50m in dense urban areas to over 2km in rural zones, it ensures you are never truly "off the grid."
Real-World Example: The E911 Mandate
Why does this "backdoor" exist? In the United States, the FCC Phase II E911 rules are a primary driver. These laws require carriers to provide a horizontal location within 50 meters for 67% of all wireless 911 calls. To meet these strict requirements, carriers must have the ability to "force" a GPS fix via the hardware, regardless of whether the user has "Location Services" enabled for their apps.
Why It Matters: The Privacy Gap
The distinction between OS-level privacy and modem-level requirements is a massive blind spot for most users.
- Data Monetization: While E911 is for safety, reports from Privacy International highlight that this "invisible" data is often harvested and sold to data brokers.
- Zero User Control: Because the baseband is a "black box" with proprietary firmware, there is currently no way for a standard user to audit or block SUPL requests without putting the phone in Airplane Mode (and even then, some chips are designed to cache location).
- Security Risks: Since SUPL often communicates with carrier servers via IP, researchers have demonstrated that malicious actors could potentially spoof these servers to trigger location fixes on target devices.
As we move into 2025, the integration of 5G and more advanced positioning like OTDOA (Observed Time Difference of Arrival) will only make this tracking more precise. Your phone is a beacon that never truly sleeps; the "Invisible Ping" is just the price of being connected to the modern grid.