Even with location tracking turned off, Facebook uses IP addresses, check-ins, and cities on profiles to approximate user locations for ads and other services
Aleksandra Korolova has turned off Facebook's access to her location in every way that she can.
Context & Ripple Effects
Privacy researcher Aleksandra Korolova's experiment shows that Facebook's location targeting runs on more than GPS: IP addresses, check-ins, and the city listed on a profile keep feeding ad targeting even when every user-facing location setting is switched off. The finding lands on a well-documented arc — Facebook Messenger shipped with exact GPS coordinates in chats by default back in 2015, and Google was caught the same year collecting nearby cell tower addresses from Android phones with location services disabled.
First-order effects
- Users who believe they have opted out of location-based advertising are still receiving it, because Facebook treats network-level signals (IP address) and user-generated content (check-ins, profile city) as location inputs outside the scope of the location toggle.
- Facebook's own disclosures become the story: when it explains these practices to lawmakers, the explanation itself triggers backlash rather than reassurance.
Second-order effects
- Platform-level pressure forces product changes — Facebook rolls out new Android location controls and settings-check prompts months after this reporting, effectively conceding that app-level toggles were insufficient.
- Operating-system vendors step into the enforcement role: ahead of iOS 13's warnings about apps collecting background location, Facebook pre-emptively publishes a blog post defending its practices, signaling that Apple's privacy prompts are now shaping what platforms must disclose.
Third-order effects
- If the pattern holds, meaningful location privacy shifts from user settings to OS vendors and regulators — Apple and Google's permission systems, not Facebook's preference panels, become the binding constraint on how location data is collected and monetized.
- The gap between what an 'off' switch promises and what a platform infers from other signals becomes a recurring regulatory target, with each disclosure cycle raising the political cost of inferred-location advertising.
The trend: Location privacy is migrating from app-level opt-outs, which keep proving porous, to operating-system permissions and legislative scrutiny as the mechanisms that actually constrain platforms.