Google has been collecting the location of Android phones even when location services are turned off, a Quartz investigation has revealed.
Quartz observed Android phones collecting the addresses of nearby cellular towers and sending them back to Google. The details were collected even when location services were turned off on the phones, no mobile applications had been installed and there was no SIM card in the phone.
"The result is that Google, the unit of Alphabet behind Android, has access to data about individuals' locations and their movements that go far beyond a reasonable consumer expectation of privacy," Quartz reporter Keith Collins writes.
A Google spokesperson told Quartz that the cellular tower addresses were included in information sent to the system Google uses to manage push notifications and messages on Android phones for the past 11 months. They were never used or stored and the company is taking steps to end the practice, the spokesperson said.
"In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery," the spokesperson told Quartz. "However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID."
Collins writes that even though the data sent to Google is encrypted, "it could potentially be sent to a third party if the phone had been compromised with spyware or other methods of hacking. Each phone has a unique ID number, with which the location data can be associated."
It's no secret that Google keeps track of your phone's location -- many of the apps we use regularly wouldn't work as well without location services turned on. If you're concerned about your privacy, you can tell your Android phone to remove your location history from your Google Maps Timeline and stop keeping screenshots of your old searches.
Google did not immediately respond to CNET's request for comment.
This article originally appeared on CNET.