Laura Bliss is CityLab’s West Coast bureau chief. She also writes MapLab, a biweekly newsletter about maps (subscribe here). Her work has appeared in The New York Times, The Atlantic, Los Angeles magazine, and beyond.
We’re creatures of habit. And for some third-party apps, that means we’re easy to find.
As you go through you daily routine—home, cafe, work, gym—your phone scans all of the Wi-Fi networks you pass through, public and private. In cities, it registers hundreds of routers and access points every day, even if you only connect to a handful of them — and even when you’ve manually turned Wi-Fi off.
Phone makers including Google, Apple, and Microsoft have access to vast chronologies of your phone’s Wi-Fi scans. The majority of apps for Android have this access, too.
Should you care? Of the reams of data your smartphone collects—apps you open, websites you visit, your GPS coordinates—storing info on Wi-Fi networks might seem pretty innocuous. Although most routers’ unique alphanumeric identifiers can be linked to locations through databases, we pass through so many Wi-Fi networks each day that it’s hard to imagine someone would take time to locate each one in order to home in on us.
But as a study published in the online journal PLOS One last week shows, your daily route can be easily tracked based just on a small number of the innumerable Wi-Fi signals you encounter. We humans are creatures of habit, and spend the vast majority of our time close to a small number of distinct Wi-Fi access points. The repetition of those access points in our smartphones’ chronologies alone—without very much location data at all—is enough to give away our personal mobility patterns to smartphone makers and third-party apps.
With colleagues from MIT and the University of Denmark, lead study author Piotr Sapiezynski of the Technical University of Denmark collected GPS and Wi-Fi network data around greater Copenhagen, and mapped the density of Wi-Fi access points. This allowed them to strengthen their knowledge of the Wi-Fi locations.
The authors built an Android app that allowed them to access the Wi-Fi chronologies of any phone that downloaded it (again, this access is common to most Android apps). They equipped 63 student participants—all with different daily routines—with smartphones loaded with the app, then collected their GPS and Wi-Fi data every 5 minutes and 16 seconds, respectively, for six months. Participants encountered a median of 20,000 Wi-Fi routers over that time.
They found that when compared to the students’ GPS locations, the time sequence of Wi-Fi access points was virtually equal to location data because of how habitual the students’ movements were. “We find that participants in our study have stable routines, with locations visited in the first one, two, three, and four weeks of the study still visited frequently six months later,” the authors write. On average, the researchers were able to pinpoint a participant’s location 90 percent of the time, just by knowing the location of the 20 routers she passed through most often.
For Sapiezynski, a mere eight routers could give his team a clear sense of the four main locations he visited throughout his day, although his exact route was a little muddy. Above is a map of 48 hours of Sapiezynski’s location data, with four visited locations marked in blue: His home, two offices, and a supermarket. The authors write:
Even though the author’s phone has sensed 3,822 unique routers in this period, only a few are enough to describe the location more than 90% of time. [Figure A] shows traces recorded with GPS; [B shows] traces reconstructed using all available data on WiFi routers locations—the transition traces are distorted, but all stop locations are visible and the location is known 97% of the time. [C shows that with the] 8 top routers it is still possible to discover stop locations in which the author spent 95% of the time.
Sapiezynski says that his studies’ findings don’t necessarily imply that companies are actively inferring your daily routine through Wi-Fi signals. Instead, he hopes that consumers will become a little more aware of how much data they’re giving away. “We hope to increase awareness so that people might be able to make better decisions, like which apps they’re willing to install,” he tells CityLab.
And though the timing is likely coincidental, just a few days after the study was uploaded, a Google engineer acknowledged that the fact that third-party apps have access to Wi-Fi logs was an issue, and that the next version of Android would fix it.
“Still, a vast majority of the phones on the market today will not get the upgrade to the newest version, so the problem will persist for most people,” says Sapiezynski.