News

Publish Date: October 30, 2025

Mobile Apps on Android Devices Requiring Precise Location Permissions Can Reveal a Significant Amount of Private Information About Users: Shows IIT Delhi Study

Share this on

(Representational Image)

· Study says that even in environments where GPS signals are feeble, it is possible to find the mobile users’ immediate environment (small room, big room, underground, overground, on a flight, etc.), layout of the building and nature of human activity

New Delhi: When we think of GPS, we imagine Google Maps guiding us to a café or an online app tracking a delivery. But in reality, every modern smartphone receives dozens of subtle GPS signals—filled with tiny fluctuations in frequency, noise, and strength—that most users never notice and GPS software does not require.

Pathbreaking research conducted by Soham Nag, M. Tech. student, Center of Excellence in Cyber Systems and Information Assurance, IIT Delhi, and Dr. Smruti R. Sarangi, Professor in the Computer Science and Engineering Dept., IIT Delhi, shows that these hidden clues can reveal far more than just the location: they can quietly expose a person’s activity, environment, and even the layout of the room or floor they are in.

The study titled, “AndroCon: An Android Phone-based Sensor for Ambient, Human Activity and Layout Sensing using Fine-Grained GPS Information” has been published in ACM Transactions on Sensor Networks, a top journal in the field of privacy-aware sensing.

(Link to the study- https://www.cse.iitd.ac.in/~srsarangi/files/papers/acm_tosn_GPS.pdf)

The researchers proposed AndroCon, the first system to demonstrate that the “fine-grained” GPS data already accessible to Android apps with precise location permissions can act as a covert sensor. Without using the camera, microphone, or motion sensors, AndroCon interprets nine low-level GPS parameters—such as the Doppler shift, signal power, and multipath interference—to infer whether someone is sitting, standing, lying down, inside a metro, on a flight, in a park, or in a crowded outdoor space. They can also infer if the room is crowded or empty.

To turn this noisy raw data into clear insights, they combined classical signal processing with modern machine learning. “Across a year-long study spanning 40,000 sq. km and a lot of different phones, AndroCon achieved up to 99% accuracy in detecting surroundings and over 87% accuracy in recognizing human activities—even subtle ones like hand-waving near the phone”, said Prof. Smruti R. Sarangi, Computer Science and Engineering Dept., IIT Delhi.

 The same framework can also sketch indoor floor maps—identifying rooms, staircases, and elevators—with a margin of error under 4 meters, using only GPS patterns and user trajectories.

While AndroCon opens exciting possibilities for context-aware, privacy-respecting smart services, it also exposes a critical security gap. Any Android app with precise location permissions could potentially infer sensitive contextual information without explicit user consent.

“This study reveals an unseen side of GPS: a powerful but silent channel that can sense the world around us. AndroCon turns the everyday smartphone into an unexpectedly precise scientific instrument—and a reminder that even the most familiar technologies still hold hidden secrets that can be misused by malicious entities,” Prof. Sarangi added.

******

Researcher’s contact- Prof. Smruti R. Sarangi - srsarangi@cse.iitd.ac.in