Worried your phone may be recording your movements? You should be. Turns out, even when you manually turn off your location services and remove the SIM card, your Android phone tracks you anyway. That’s according to a new report from Quartz that studied the various data collecting practices conducted by Google over the past year.

By analyzing how Android phones collect location data from nearby cell towers, Google can track users’ location and their specific movements in real-time. The scary part is that these phones do this without your consent, even when you have your location services turned off.

Now here’s the kicker (and it’s a big one): Because these trackers are automatic, there’s no real way to prevent your Android phone from recording and sharing your real-time location. Sure, you can switch to an iPhone, but Apple isn’t much better.

The only real tool you can use to help stay private is to use a VPN.

Secret trackers record your movements

Google has been using this new tracking system since the beginning of 2017 to allegedly manage push notifications and send real-time updates to your phone. Unfortunately, this means every time your phone is within range of a cell tower, Google receives real-time updates on your location. It doesn’t matter whether you have a SIM card inserted or not; if you own an Android, you’re being tracked.

Once Google was confronted with the findings, they were quick to accept responsibility, stating:

“In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery,” the Google spokesperson said in an email. “However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID.”

In layman’s terms, that basically means Google has been testing the system intentionally, but now that the cat’s out of the bag they’re working to update their methodology.  

Keeping tabs whether you like it or not

This location data—combined with the myriad other personal and invasive details Google and other companies already know about you—serves as another chilling reminder that our lives are no longer private.

Perhaps more alarming is the realization that this tracking software affects all modern Android devices. Even when factory settings are reset and a SIM is removed, the phone is still sending notifications to Google.

The last part is particularly confusing given Google’s statement implied they were using this location-sharing technique to give users push notifications. Why would Google send notifications to a phone that’s not connected to a specific carrier network? Matthew Hickey, a security expert at Hacker House in London, raised a similar question when speaking with Quartz.

“It is really a mystery as to why this is not optional,” Hickey said. “It seems quite intrusive for Google to be collecting such information that is only relevant to carrier networks when there are no SIM card or enabled services.”

But wait, there’s more

This news comes on the heels of another privacy expose, where nonprofit think tank the Privacy Group published another scathing report on how hundreds of Android apps in the Google Play Store contain dozens of hidden trackers.

The report, conducted in part by Yale University’s Privacy Lab and French nonprofit Exodus Privacy, examined mobile apps for 25 known trackers. The results showed that roughly 75% (or ¾) of Android apps contain at least one tracker that uses third-party tools.

With these findings shedding new light on the invasive nature of mobile apps, the researchers are calling for increased transparency for both app developers and their marketers. (It’s worth noting that iPhones were excluded from this study.)

While Google promised to end their tracking practice by the end of the year, there’s no telling what other methods companies use to track your movements.

Long story short, your phone is never truly anonymous — unless you use a VPN.