It's even better: the location can be enabled through a network initiated request. This is because A-GPS works "both ways". See https://en.wikipedia.org/wiki/Assisted_GNSS#SUPL : SUPL Position Calculation Function (SPCF) lets the client or the server ask for the client’s location.
As part of the FCC’s updated 911 requirements, where cell phones (with no set location) are required to be routed to the correct 911 center, aGPS was developed to not only help GPS get a faster TTFF (time to first fix), but to transmit location data to the carrier (and to anyone else who can intercept the data)
> If all of this bothers you, contact your state legislators
If you don't like that and want a quick fix, on android devices check /data/vendor/agps_supl/agps_profiles_conf2.xml for ni_request="true": this is the Network-Induced Location Request functionality, where the network asks for the GPS position. Change that to false.
Personally, I believe 911 AGPS is of limited use: if I'm unconscious and can't dial, the phone 911 AGPS working won't do me any good. If I'm conscious and I can dial, I can also open a map app.
Still, if you want to keep the 911 stuff, just change reject_non911_nilr_enable="false" to true (because yes, by default, everything goes - 911 or not)
There's also lpp_enable="true" (LTE Positioning Protocol, yet another method by which cellular providers can pinpoint your location via aGP S), imsi_enable="true" (which transmit a unique identifier along with the AGPS request!)
Check also /data/vendor/agps_supl/agps_profiles_conf2_prv.xml
It's everywhere in mobile devices. It's better not to use them.
If you must use one, you must at least have root to disable AGPS + add stringent iptable rules to disable any outgoing communication by default: you should only enable connections per app, or per IP/domain for what you need.
Still, that'll be of a limited help since the baseband manages connections (3GPP profiles etc) and does the equivalent of NAT to your device.
For all I know, the baseband could tell android "location disabled? sure thing!" while still getting GPS fixes + sending the position by UDP packets processed by the baseband OS: Android won't even see it! Yet by virtue of sharing the same IP (or being "enriched" with your IMSI as you can see above), you will be totally trackable.
Doing anything more requires running free software on the baseband: there're now free-software firmwares like https://github.com/the-modem-distro/pinephone_modem_sdk (I'll submit that for discussion)
It started from initiatives like https://www.reddit.com/r/PINE64official/comments/hflat0/pine... but now you even have a free software bootloader for the modem (see https://github.com/Biktorgj/quectel_lk)
If you want, you can also recover the stock firmware (https://github.com/Biktorgj/quectel_eg25_recovery), but the ability to audit from top to bottom to disable data exfiltration requires a 100% free software solution.
For what it's worth, new phones can detect car crashes and initiate a 911 call if you don't actively stop that.
Hoping this is a joke because in no world will that have any effect at all.
If all of this bothers you, contact your state legislators. Most state privacy laws don't protect against ISPs selling your location & browsing info, even though that would be the common expectation. Maine's law is simple and does a good job[1][2].
0: https://www.wired.com/story/locationsmart-securus-location-d...
1: https://www.natlawreview.com/article/maine-s-new-internet-pr...
2: Maine's law survived a federal challenge, and ISPs have dropped their appeals: https://www.mediapost.com/publications/article/377285/broadb...