Are downloaded map tiles exposing my location?

CuriousBonobo

I launched an app that has a feature to select a nearby shop. It relies on Play Services and fails when it is not installed.

I ran it in a secondary profile and added sandboxed Play Services with the "Reroute location requests to the OS" option checked.

Then I chose the feature to find the nearby shop in the app, and it showed a map with my current location at the center.

While I want to believe my location was not leaked to Google, I can't help but notice that the embedded map used tiles from Google.

So this flow would reveal my location within just a couple of kilometers. Certainly, my country and locality were leaked.

Am I correct in my assumption?

Johnnyloans

CuriousBonobo

Yes, unless the map is provided by open street maps. Then it's the same but them instead of google.

DohnJoe

CuriousBonobo
It's certainly possible to have an approximation of your location based on the tiles you downloaded, with some caveats:

Google Maps will receive the request from your public IP address (that can be a VPN, a proxy, your ISP, etc.), so unless the app also ships a tracker you shouldn't have sent any real identfying information (Maybe someone alse can confirm or disprove this guess)
Google Maps still doesn't know if you used Mock Locations from Developer Settings

Unless the app you are using actively sent some other information, I would say the approximate location cannot be bound to you, especially if you used a good VPN.

If you can, trade this app with something local-first and maybe that uses OpenStreetMaps as backend.

CuriousBonobo

DohnJoe

That's true, but Google could correlate that information with data from other apps using the same Play Services instance.

I'm concerned about this from an opsec point of view.