And there’s nothing you could’ve done about it. An investigation by Quartz reveals that Android devices currently send positioning data to Google servers even when location services are turned off, apps aren’t being used, and there isn’t even a carrier’s SIM inserted into the device. Google confirmed to Quartz that the practice has been in place since the start of 2017, and users can’t opt out of it.

The location data is obtained by triangulating a phone in relation to nearby cell towers. That could reveal a person’s location within a quarter-mile—more than enough to worry privacy advocates, and the kind of accuracy that could lead to damaging intrusions if the information entered the wrong hands. The data appears to have been used to improve the way push notifications are delivered to smartphones, and it was never stored. Even so, Google tells Quartz that it will stop the practice by the end of November.

It’s by no means the first time that a big tech firm has been in hot water over collection of location data: for as long as phones have been able to provide granular details of your position, companies and researchers have been trying to make use of it. But the news comes at a particularly low ebb of trust in firms like Facebook and Google, and will do little to bolster confidence that the search firm is still striving to do no evil.