How do phones find their location without GPS?

A satellite fix needs a view of the sky. GPS.gov lists signal blockage by buildings, bridges and trees, indoor or underground use, and signals reflecting off walls as common causes of a wrong position, and notes that smartphone accuracy worsens near buildings. How GPS works explains why.

So phones do not rely on satellites alone. Apple’s Core Location documentation says the framework gathers data using all available components on the device, including the Wi-Fi, GPS, Bluetooth, magnetometer, barometer and cellular hardware. The W3C Geolocation specification lists common sources of location as GPS and location inferred from network signals such as IP address, RFID, Wi-Fi and Bluetooth MAC addresses, and GSM/CDMA cell IDs, as well as user input.

Every Wi-Fi access point, cell tower and Bluetooth device a phone can hear announces an identifier. If a location service knows where those transmitters are, the set of identifiers a phone hears says roughly where the phone is. This is what the W3C means by location inferred from network signals.

The approach has strengths and limits:

• It can work indoors, where satellite signals are blocked, as long as the phone hears transmitters whose positions are known.
• It is only as good as the knowledge of where each transmitter is. An access point that has moved since it was recorded points to the wrong place.
• An IP address is the loosest version. It identifies a network connection, which may be registered far from the phone.

Bluetooth beacons are a deliberate version of the same idea: small transmitters placed at known spots that apps can detect. Core Location supports beacon ranging to detect and locate nearby iBeacon devices; what is a BLE beacon explains how they advertise.

Inferring position from which radios are nearby gives an area. Measuring distance to them gives a point. Android’s Wi-Fi RTT (round-trip time) API does this with access points that support the IEEE 802.11-2016 fine timing measurement standard, and on newer devices the 802.11az standard.

The phone times a packet’s round trip to each access point and turns the time into distance. Android’s guide says that with distances to three or more access points, an app can use multilateration to estimate the position that best fits the measurements, and that the result is typically accurate within 1 to 2 metres. The phone does not need to connect to the access points, and only the phone learns the distances; the access points do not.

Wi-Fi RTT was introduced in Android 9 (API level 28), and Android 15 (API level 35) added 802.11az support. It also needs access points that implement the standard and, for a position rather than a set of distances, knowledge of where those access points are.

Between radio fixes, a phone still moves. Core Location lists the magnetometer and barometer among its inputs and reports heading changes from the onboard compass. Google’s Fused Location Provider can deliver location updates at set intervals, from which an app can derive direction and velocity.

Choosing among these sources is hard, and both platforms do it for the app. Google describes the Fused Location Provider as an API in Google Play services that combines signals from multiple sensors, manages the underlying technologies such as GPS and Wi-Fi, and lets the app state the quality of service it needs, from the most accurate data available to the best accuracy with no additional power use. Core Location does the same on Apple platforms.

The result comes with an uncertainty, and apps should read it:

• On Apple platforms, horizontalAccuracy is the radius of uncertainty in metres around the reported point; a negative value means the coordinates are invalid.
• On Android, getAccuracy() returns the estimated horizontal accuracy radius in metres at the 68th percentile confidence level, so the true position can fall outside that circle.

A fused location is an estimate from whatever sources were available at that moment, and its quality can change from one update to the next. Show the accuracy, do not treat a small radius as certain, and expect it to grow indoors or when satellites are blocked or jammed.

It is also an estimate the device makes about itself. Android notes that apps can submit mock locations and provides isMock() to identify them, so a location reported by a phone is a claim. Where a decision depends on where a device really is, it needs evidence from outside the device as well.