IIT Delhi Study Reveals AI-Driven GPS Data Can Breach Privacy

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Researchers at IIT Delhi developed AndroCon, an AI system that uses fine-grained GPS data from Android phones to infer sensitive information such as user activities and room layouts. The study highlights significant privacy risks, as apps with location permissions could covertly exploit this data without user awareness.[AI generated]

Why's our monitor labelling this an incident or hazard?

The research involves AI systems (machine learning models) analyzing GPS data to infer sensitive information, which could plausibly lead to violations of privacy and human rights if misused. Since the article focuses on revealing this potential risk and security gap without reporting actual incidents of harm, it fits the definition of an AI Hazard. The AI system's development and use could plausibly lead to harm (privacy violations), but no direct harm is reported yet. Therefore, the event is best classified as an AI Hazard.[AI generated]
AI principles
Privacy & data governanceRespect of human rightsTransparency & explainability

Industries
Digital security

Affected stakeholders
Consumers

Harm types
Human or fundamental rights

Severity
AI hazard

AI system task:
Forecasting/prediction


Articles about this incident or hazard

Thumbnail Image

Your Phone's GPS Knows More Than Your Location, IIT Delhi Research Warns

2025-10-30
NDTV
Why's our monitor labelling this an incident or hazard?
The research involves AI systems (machine learning models) analyzing GPS data to infer sensitive information, which could plausibly lead to violations of privacy and human rights if misused. Since the article focuses on revealing this potential risk and security gap without reporting actual incidents of harm, it fits the definition of an AI Hazard. The AI system's development and use could plausibly lead to harm (privacy violations), but no direct harm is reported yet. Therefore, the event is best classified as an AI Hazard.
Thumbnail Image

The unseen side of GPS: 'Fine-grained' data can expose far more than just location - The Tribune

2025-10-30
The Tribune
Why's our monitor labelling this an incident or hazard?
The study involves the use of AI (machine learning) to analyze GPS data, which qualifies as an AI system. The potential misuse of this system by any Android app with location permissions could plausibly lead to violations of privacy and human rights, constituting harm under the framework. Since the article does not report actual harm but warns of a credible risk of misuse and privacy violations, this event fits the definition of an AI Hazard rather than an AI Incident or Complementary Information.
Thumbnail Image

IIT Delhi study reveals unseen side of GPS: 'Fine-grained' data expose far more than just location | Technology

2025-10-30
Devdiscourse
Why's our monitor labelling this an incident or hazard?
The study involves an AI system that uses machine learning to interpret fine-grained GPS data to infer human activities and environmental context. The use of AI in this system is explicit and central to the findings. The event highlights a critical security gap where the AI-enabled system's use could lead to violations of privacy rights, which are a form of human rights violation. Although no direct harm is reported as having occurred yet, the potential for misuse and privacy violations is clearly plausible and significant. Therefore, this event qualifies as an AI Hazard because it plausibly could lead to an AI Incident involving violations of rights due to misuse of AI-enabled GPS sensing capabilities.
Thumbnail Image

Your smartphone is a silent spy: IIT Delhi warns of hidden GPS surveillance - The Statesman

2025-10-31
The Statesman
Why's our monitor labelling this an incident or hazard?
The event involves an AI system (AndroCon) that uses machine learning and signal processing to analyze GPS data for inferring user activities and environments, which is beyond traditional GPS navigation. The study reveals a plausible risk that apps with precise location permissions could misuse this AI capability to spy on users covertly, constituting a credible threat to privacy and human rights. However, no actual harm or incident has been reported yet; the article warns about potential future harms. Thus, it fits the definition of an AI Hazard rather than an AI Incident or Complementary Information.
Thumbnail Image

Tracking whatever you do: IIT study finds Android apps are gathering far more information than users think

2025-11-03
ETCISO.in
Why's our monitor labelling this an incident or hazard?
The study involves the use of an AI system (machine learning combined with signal processing) to analyze GPS data and infer user context. The event highlights a privacy risk where apps with precise location access could extract sensitive information without user awareness or consent. This constitutes a potential violation of privacy rights, which falls under harm category (c) - violations of human rights or breach of obligations protecting fundamental rights. However, the article does not report that such harm has already occurred, only that it could plausibly happen given the capabilities demonstrated. Therefore, this event is best classified as an AI Hazard, as the development and use of AI in this context could plausibly lead to an AI Incident involving privacy violations.
Thumbnail Image

Tracking whatever you do: IIT study finds Android apps are gathering far more information than users think

2025-11-02
Economic Times
Why's our monitor labelling this an incident or hazard?
The study involves an AI system (AndroCon) that uses machine learning to analyze GPS data to infer user behavior and environment. The use of AI here is explicit and central to the findings. The event highlights a privacy risk where apps with location permission could misuse this AI capability to gather sensitive data without user consent, which constitutes a violation of privacy rights (a human rights concern). Although no specific harm incident is reported as having occurred, the described capability plausibly leads to harm through privacy violations and unauthorized data collection. Therefore, this event qualifies as an AI Hazard because it plausibly could lead to an AI Incident involving violations of rights and privacy.
Thumbnail Image

Android apps overstep privacy boundaries: IIT study

2025-11-02
NewsBytes
Why's our monitor labelling this an incident or hazard?
The system described is an AI system that infers user behavior from GPS data, which is a sophisticated data processing task. The researchers warn about a privacy gap, indicating a credible risk that the AI system's use could lead to violations of privacy rights in the future. Since no actual harm or incident is reported, but a plausible risk is identified, this qualifies as an AI Hazard rather than an AI Incident or Complementary Information.