iOS 26.3 adds new feature to limit location data shared with your carrier

6 Likes

I’m aware it is counter privacy but your cellular signal with triangulation can be very crucial in case you got lost, kidnapped or got seriously hurt in the middle of nowhere. But of course, cons and pros are relative to one’s expectations of privacy.

In that case I think you would use your SOS function and send your GPS location that way, or rely on Find My tracking that you explicitly enabled to find you. This seems like it’s preventing unintended tracking from cell towers which is very nice and probably good for everyone, there’s much better ways to share your location if you really want to.

6 Likes

“The setting doesn’t impact signal quality or user experience,” Apple explains. It also doesn’t impact the accuracy of data location shared with emergency responders. It only affects the location data available to cellular networks.

2 Likes

I think it disables this feature when you make the emergency call, or at least I understood it that way.

This is really interesting. I wonder if it’s worth using a 16e over a regular 16 for this.

1 Like

How on earth could this work, technically?

Carriers dont need metadata or trackers to ping your location, they can triangulate from cell towers that read your signal. That isnt a feature that can be blocked, it’s a byproduct of basic cellular connectivity. Your phone pings all reachable towers to ensure seamless connectivity when moving between cells and/or suffering from poor signal quality or limited bandwidth on a given tower

I can’t fathom how you could eliminate this without instructing the phone NOT to ping towers, which would certainly impact cellular connectivity. Are they blocking some auxiliary location feature, and erroneously phrasing this as though your carriers can no longer triangulate?

Edit: here is a simple breakdown of triangulation. I do now believe my earlier suspicion: carriers collect some auxilliary location info, likely from GPS for higher precision, iOS will be blocking this, triangulation remains unaffected. The only alternative I can see is some really, really innovative method to manage cell connectivity with exclusively passive measurements

This is all speculation, the Apple doc provides no tech specs beyond “some information made available to cellular networks is limited”. Will have to wait & see

6 Likes

I think that makes sense, I’m guessing too that it’s just dropping some extra metadata from being transmitted. But if they can normalize it that’s a huge win in my book.

4 Likes

I wonder if GrapheneOS and Android will implement something similar or not. Anything that enhances privacy is worth it, IMO.

2 Likes

First reason I’ve ever had to consider Boost Mobile before:

iPhone Air, iPhone 16e, or iPad Pro (M5) Wi-Fi + Cellular
iOS 26.3 or later
A supported carrier:
    Germany: Telekom
    United Kingdom: EE, BT
    United States: Boost Mobile
    Thailand: AIS, True

Adding this resource to the discussion, found on the GrapheneOS forum

It details an existing protocol used by carriers to retrieve GNSS data from network devices. I suspect the new iOS feature disables this specific protocol - but ultimately still need more tech specs from Apple to confirm

I suspect it does not do this. But this is a good catch, because if this protocol remains functional then the efforts that I do suspect Apple is doing (described below) to hamper cell tower triangulation are somewhat moot.

I think that people need to recognize that the cellular modem in your phone is essentially its own dedicated black box computer which can surveil you like this, and the only way to avoid this is to enable Airplane Mode.


Anyways, I will be contrarian to everyone in this thread so far and give you a different theory. I personally think based on the keys the developers are using for this setting…

…that Apple will be randomizing the Timing Advance value. The very short version is that Apple can actually hinder cell tower triangulation somewhat.

If you think about it, this actually makes sense. Cell tower triangulation relies on also receiving data from your device, which obviously your device has a bit of control over. This is why GPS satellites can’t learn your location, since they’re one-way signals.

Now, thanks to this forum thread I have spent the better part of the evening reading LTE and 5G documentation :joy: - So if you bear with me I will also explain the long and detailed version of my theory here as best I can, because I think it’s interesting. You’ll have to understand two things:

  1. In cellular networks, the Timing Advance (TA) value is used to prevent intersymbol interference (ISI) by basically synchronizing all the phones that are connected to the tower so that the tower receives all the transmissions at the same time.

    Importantly, your TA value is a variable the cell network needs to know, in addition to other variables, to triangulate your location.

    In LTE, each TA interval represents a multiple of ~78 meters. Whereas in 5G there are 7 different types of numerology (SCS), pretty much all of which are even more granular, like in 30 kHz SCS then the TA would represent a multiple of ~40 meters[1], or in 120 kHz SCS a multiple of ~10 meters. So… clearly when it comes to 5G, location privacy is more of a concern as it allows for more precision.

  2. There is a second timing factor called the Cyclic Prefix, which is basically a guard interval that is added to the start of each symbol, which also combats ISI, but ISI which is caused by delay spread due to multipath propagation of radio signals.

    The cyclic prefix is much larger than the TA unit, think like it can absorb a delay of around 5 microseconds, while each TA unit represents around 0.5 microseconds or less.

This discrepancy means that an iPhone has some wiggle-room to adjust its TA value around a few units, and if the signal with an incorrect TA still arrives at the tower within the same cyclic prefix, the tower should still be able to successfully decode the data.

The tower would see the TA is wrong, and send a command to the phone to fix the TA. Meanwhile, the iPhone would choose a new random offset for the TA of the next transmission and the process would repeat. I think (?) the tower would always know the TA value it’s seeing is wrong somehow, but the wrong values would be randomly distributed so that the right distance couldn’t be accurately determined.

I think this explains why only Boost Mobile supports this in the USA. The cellular network is going to see a lot of deviations, which it would typically interpret as hardware or signal failures. Boost Mobile uses exclusively 5G hardware since they have no legacy towers, and their whole network stack is software-defined, so they could add support for Apple’s changes across the whole network very easily. Legacy carriers will probably have to fully replace their old hardware to support this (which they’re doing, so maybe we’ll see this eventually).

Also, given that the article says the level of precision will only change from street address level to neighborhood level, and the Timing Advance value is kind of important for latency and preventing interference, the randomization must be fairly small, so this theory makes sense to me.

If all this is true then it’s actually a neat privacy trick on the Layer 1/2 level to prevent cell tower triangulation. I suspect it will have a performance impact but maybe a 10% difference on modern networks will not be super noticeable.

The problem with my theory is that I cannot find a single academic or standards paper which describes any sort of “TA randomization,” which seems strange to me. If all of this were true, I would think there would be public research surrounding it before Apple just decides to throw it in iOS 26.3. However, I did find a lot of papers (linked above) which demonstrate that TA values are a significant privacy problem in general, so it seems to make sense to try to tackle.

It’s very possible that TA_RANDOMIZATION_ refers to something else entirely with the initials TA, or TA are just random letters Apple is using. I couldn’t find anything else that TA could likely mean though, and my theory makes sense to me, so I’m sticking with it.

However, if cell networks can indeed routinely just ask your phone for GPS data, I’m not quite sure how much of an advantage all of this grants you :slight_smile:

P.S. Another thing I learned in this process is that in LTE, your TA value is transmitted unencrypted. So literally anyone in the middle who can sniff your wireless traffic could find your TA value, gather your IMSI, and determine/track your location. I think this remains true for 5G, but don’t quote me on that.

TA randomization would fix this problem too though, so Apple adding this is actually a nice protection against IMSI catchers :+1:


I would not switch to Boost Mobile because of this feature. They are getting rid of most of their spectrum, decommissioning much of their core network, and becoming a hybrid carrier reliant on AT&T and T-Mobile. It’s almost certain that this only applies to connections to their core network and towers they own, which will be fewer and fewer as they make this switch.

Hopefully real national carriers add support for this instead.


  1. https://apps.dtic.mil/sti/trecms/pdf/AD1150773.pdf page 12 ↩︎

8 Likes

Tim Apple

1 Like

This really shows the power of Apple’s integration. I guess any phone manufacturer could do that, but it would require

  1. They would need to collaborate with the MODEM manufacturer ( except for some Pixels and Samsung)
  2. They would need to make sure to not interfere with Android’s network stack
  3. They need a big enough marketshare per-country to make sure no TelCo bans users of the brand.
  4. They mustn’t be based in jurisdiction where this wouldn’t be well-seen (exit Xiaomi)

BTW, thanks @jonah for the great analysis.

Any chance you could drop the docs you used for reference? Mainly curious if you were reading IEEE specs or other specs.