Why is Apple’s iOS logging location information? [Updated]

Today, a pair of researchers in Santa Clara, Calif., reported that Apple’s iPhone and 3G iPads maintain a log file with location data. The file, which is in unencrypted form and stored both on the device and in the iTunes backup on a user’s computer, contains both location and time information.

The researchers, Alasdair Allan and Pete Warden, also created a Macintosh application that will read the data in the file and plot the locations found on a map. I’ve downloaded and run the program, and it indeed works.

The logging process has been around since iOS 4.0 was released, the researchers said, and the file is generated when that version or later of Apple’s mobile OS is installed on any phone. Through the syncing process, the file is passed on to upgraded phones. For example, I first installed iOS 4.0 on an iPhone 3G, and the tracking information gathered on that phone was carried over to the iPhone 4 I bought last year.

Using the iPhone Tracker program, I grabbed this screen shot that shows my movements around South Texas:


And here you can see my tracked locations around Houston:


The location information is not precise – it’s drawn from cell tower triangulation, rather than GPS data. A cell phone is constantly talking to the cell towers around it, but a phone’s GPS is not always on.

The researchers stress that there’s no indication this data ever leaves the phone or the iTunes backup file, but they rightly express concern that it’s maintained in an insecure format that anyone could read. The iPhone Tracker application is meant to show how easily the data could be grabbed from iTunes on a user’s computer.

The file can be secured on a computer by encrypting the iPhone backup. Connect your iPhone or 3G iPad to the computer and launch iTunes. Click on the name of your device as it appears in the left column, then click the Summary tab. Check the box that says "Encrypt iPhone backup", and apply a password.

However, the file remains in an unsecure format on the iPhone or 3G iPad. Someone with access to the device could, in theory, gain access to the file.

Apple is actually doing this with its users’ consent. Permission to gather information based on location appears deep within Apple’s privacy policy, something most users never read. The relevant section is found under "Collection and Use of Non-Personal Information":


While this is an obscure provision, Todd Bishop at GeekWire notes that a Microsoft employee called out its inclusion in a blog post written after the launch of iOS 4.0.

So why would Apple keep this kind of data? Andy Ihnatko, tech columnist at the Chicago Sun-Times, has a theory:


That makes sense, though if Apple is using it in this way, why isn’t the data leaving the phone? Or maybe the data is being used for this purpose, but reporting signal quality back in a different way.

Finally, I would not be surprised if other smartphones don’t also keep location data, for a variety of reasons. Google’s privacy policy for Android includes these provisions: [See Update 4.0]




  • Protect the rights or property of Google or our users.

I’ve e-mailed Apple asking for an explanation. So far, I’ve not gotten an answer.

Update: The data in the log file clearly shows not where an iPhone user was, but what cell towers were accessed. If you zoom in to street level in the iPhone Tracker app, you can see the area’s cell tower grid. [Update: And maybe not. See below.]


Update 2.0: Commenter John makes a good point. The grid is too evenly spaced to be precise cell tower locations, and there are dots where I know there are no towers. John suggests:

Its quite possible that the grid is where the tower triangulation rounds its numbers to. If it always rounds to a certain precision and you drive through an area it will look like that.

Still, looking at the resulting grid can give you a feel for cell tower placement. For example, there’s a notorious dead spot for AT&T users on Memorial Drive, around Glenwood Cemetery and the police officers’ memorial. I drive by there every day, but if you zoom in on the iPhone Tracker’s map, you’ll see there are no data points around that location.


Update 3.0 | 4.21.2011: An expert in iOS forensics says the location log file is not new, is routinely used as part of the iPhone/iPad’s location-based services and wasn’t just "discovered." Alex Levinson says he wrote about it in an e-book published last year.

Levinson’s key points:

• Apple isn’t "collecting" the data, as the original researchers allege, because the data never leaves the phone.

• It’s used "all the time" by other software programs on the iPhone, such as the Maps and Camera apps.

• It was in earlier versions of iOS, but in a different format and location. It was changed in iOS 4 because of the Multitasking and Background Location Services feature in that version of the operating system. The operating system lets you disallow location-services access to specific applications when you run them, but the phone is always generating the file for use by those apps that do have access.

• Levinson first noted the existence of the file shortly after iOS was released last year, and details about it were published in iOS Forensic Analysis.

Read Levinson’s entire entry. It’s very enlightening.

Update 4.0: It turns out that, as I suspected, the Android mobile OS also collects similar data. See this Github entry from Magnus Erickson. From his readme:

Following the latest days internet outrage/overreaction to the revelation that iPhone has a cache for its location service, I decided to have look what my Android devices caches for the same function.

This is a quick dumper I threw together to parse the files from the Android location provider.

The files are named cache.cell & cache.wifi and is located in /data/data/com.google.android.location/files on the Android device.

A sample of the data:

key                     accuracy  conf.   latitude    longitude  time

240:5:15:983885             1186     75   57.704031   11.910801  04/11/11 20:03:14 +0200

240:5:15:983882              883     75   57.706322   11.911692  04/13/11 01:41:29 +0200

240:5:75:4915956             678     75   57.700175   11.976824  04/13/11 11:52:16 +0200

Update 4.1: The Android source code shows only the last 50 cell towers and last 200 Wi-Fi connections are logged.

 // Cache sizes

private static final int MAX_CELL_RECORDS = 50;

private static final int MAX_WIFI_RECORDS = 200;
Dwight Silverman | Techblogger, social media manager