I'm greatly simplifying here, but basically there is an API between the telco network and the chipset on the UE (User Equipment). This API is primarily a contro

I'm greatly simplifying here, but basically there is an API between the telco network and the chipset on the UE (User Equipment). This API is primarily a control interface for general telco signalling, roaming between towers, receiving an SMS, etc. As part of this API, is an endpoint that can be made by 911 operators in order to request the position of the phone. It's meant to be part of the E911 services, and is generally linked into the E911 system, but I think can also operate independently. One of my regrets for the brief period I was working on these systems, is to trigger this API outside of a 911 call, and see if it still works, and whether it would operate without notifying a user. So that's the part I'm missing, I don't know if the API I'm describing can be activated silently from the UE perspective. As others have pointed out, there are a class of location based services that use non-GPS methods for assisting device location, that may also be at play here, and can be mistaken as GPS by someone who isn't intimately familiar with the technology. As for a backdoor into the OS, this is totally unnecessary, generally things like GPS and radio's are all wired through the baseband processor, so it's possible for the baseband to process requests without OS involvement. It's a CPU and code for all the network communications, that's runs independent of the rest of the phone, that is doing all the complicated wireless protocols. It depends on the way the standards are written, on what information the OS gets to see from the baseband, and then the way the OS is written on whether that information is actually displayed. Sorry, I'm also a bit rusty on my telco standards, it's been a few years since I've been working in the telco industry. If you want to dig in and research, I believe LPP (LTE Positioning Protocol) is the spec/standards to dig into.