You’ve probably seen those cop shows where suspects are tracked down by their cell’s proximity to cellular towers (or through GPS data on GPS-equipped devices). But geolocation technology doesn’t stop there. In his testimony, Soltani identified two additional means of pinpointing a mobile device’s whereabouts both of which depend on databases maintained by little-known entities that also store information transmitted by the device.

The first relies on location providers services that use sophisticated databases to correlate cell-tower, GPS, Wi-Fi–hotspot, and IP-address information with physical locations. By querying these services, mobile devices can determine their own whereabouts faster and/or more accurately than if they had to rely on GPS and cellular triangulation. Although this can improve and speed up location-based services (such as finding the nearest coffee shop), it also allows the location providers to track and record a mobile device’s current location at any given moment.

Not surprisingly, the developers of mobile-device operating systems Apple, Google, Microsoft, and their competitors are the most prominent location providers. Operating systems installed on their devices are frequently querying provider databases. That information is maintained on the device, but it’s also kept on the companies’ servers and sometimes elsewhere, as we all learned recently. News reports disclosed that the iPhone operating system had been caching up to a year’s worth of geolocation data (including time stamps) in an insecure file, which was copied to the user’s computer when the phone was synched with iTunes.

Apple stated that it collected the information only to help improve location-based services. But it also released an iOS update that reduces the amount of data retained, stops the iTunes copy, and deletes the file completely when users opt out of location-based services. (The fix doesn’t apply to older 2G and 3G iPhones.)

Mobile devices typically let you opt out of location-based services, but Soltani questions whether consumers are all that well informed. Also, by default, mobile devices often collect location data anyway even if their users never authorized any installed app to use it. You have to turn off location support at the device level.

The second geolocation tool, Soltani said, uses a location provider he calls location aggregators. Aggregators get geolocation information directly from wireless carriers; they don’t need an app running on your phone (with location-services enabled) to track your whereabouts. These services typically sell their data to third parties, who can in turn cross-reference it against other databases for a variety of marketing uses.