Section: Justice & law Author: V Reading time: ~27 min Sources and further reading: 22 items Topics: police, location data, § 88a, interception, ZEK, data retention, BTS, digital trail SEO / working title: How does police location of a mobile phone work?
How does police location of a mobile phone work? The question sounds simple only until we notice that the film and the file are not comparing the same thing. A judge's order opens network metadata, not the content of a call. A cell marks a device inside a transmitter's coverage, not the door of a flat. Six months at the operator is not the same as four months of interception. And a Union finding against blanket retention does not automatically cancel one criminal-procedure order. The text that follows is about the lawful procedure. It is not a forensic reading of a trail as a verdict on a person, and it is not a guide to avoiding the cell.
1. The file holds a cell. At the table sit three other questions
The file holds a base-station identifier and a time. The investigator says: the phone was in that cell. The defence lawyer says: a cell is not a door; the device may have been lying in a car. The journalist writes: the police tapped him. An official at the operator says: we have data required by law, including BTS Start and BTS Stop, not a film pin on a screen.
At first glance this is a dispute about whether the police can find a phone. In fact each person is describing a different problem. The investigator talks about the registration of a device on the network and about time. The defence lawyer talks about the relation between a device and a person. The journalist talks about the content of communication, even though the file may hold only metadata. The operator talks about what the law requires it to retain and what it may release to an authorised authority.
That is why they can all be partly right and the shared headline still wrong. “The police locked onto him” sounds like the end of proof. In the file it is often the start of a chain: number, IMSI, IMEI, cell, time, order, coverage map, other evidence — and only then a person.
This article is about procedure. It does not decide whether a particular defendant held the phone in his hand. That is a forensic question, which the Jiný Kontext series treats elsewhere under the sentence “The phone was at the scene of the crime.” Here the question is which legal title opened which metadata.
An order opens network metadata. A cell is not proof that the owner stood there.
— Jiný Kontext
2. Police location has at least six layers
The sentence “police location of a mobile phone” joins things that have to be kept apart. The first layer is the network. A mobile device communicates with base stations, the network works with identifiers, and the statute plus a decree determine which data are retained. Decree No. 357/2012 Coll. lists, among other things, IMSI, a device identifier and the Start and Stop base-station designations [5].
The second layer is time. It is not only about place, but about the start and end of a communication or session and about the period marked out by the order. The third layer is the legal title. In criminal proceedings that may be § 88a of the Code of Criminal Procedure; at other times the consent of the device user, a search under the Police Act, or another power listed in ZEK, the Electronic Communications Act [2] [4] [6].
The fourth layer is the output. The operator does not automatically release a photograph of a person in the street. It releases the data it holds that match the request. The fifth layer is the GNSS contrast. GPS in the phone, or AML on an emergency call, are different methods and often different legal channels from a query to the operator. The sixth layer is the reading about a person. Linking a device to a holder is a further chain of proof.
This layering is not an escape from an answer. It is a way not to spoil the answer. If the file holds a cell, we know something about a device on the network. We do not yet know everything about the person.
3. The best reading is the one whose mix-up the file can least bear
With location data the most expensive error is often inconspicuous. It is not that every metadata record is worthless. It is that it is read as something else. Metadata as content. A cell as a door. A device as a person. A search for a missing person as a criminal-procedure order. A time in the system as the time of the act.
| Type of failure | What it looks like | How to test it | What limits the harm |
|---|---|---|---|
| Mixing up institutes | “Interception” where it was § 88a | Compare § 88 and § 88a, content and metadata | Read the order and its legal basis |
| Mixing up the output | BTS is read as a pin in the door | Compare the output with Decree 357/2012 | Read a station designation as coverage, not an address |
| Mixing up the person | A cell is read as the accused | Ask who held the device | Supporting evidence beyond the cell itself |
| Mixing up titles | § 68 of the Police Act poses as § 88a of the Code of Criminal Procedure | Check the purpose: a search, or a criminal case | Separate urgency from process |
| Mixing up time | The operator’s stamp is read as the civil time of the act | Compare the period of the order with the time of the event | A timeline, not an isolated figure |
The table is not a tool for evading the network. It is a tool for reading the file. Good defence, good editing and good investigation need the same brake: first establish what the document actually says. And then what it does not say.
It does not follow that a cell is a weak trail. It follows that its strength depends on the chain. The more layers an article or a file skips, the more certainty it borrows without support.
4. § 88 is not § 88a
The most common public mix-up is simple: everything is called interception. The Code of Criminal Procedure, however, distinguishes the content of communication from data on completed telecommunications traffic. § 88 governs the interception and recording of telecommunications traffic, that is an interference with content. In general it aims at a crime whose upper prison term is at least eight years, and at listed offences. An order is issued for at most four months and may be extended, each time by at most a further four months [1].
§ 88a is a different institute. It concerns data on completed telecommunications traffic, typically metadata. The general branch aims at an intentional offence whose upper prison term is at least three years, or at listed offences. It requires a written and reasoned order of the presiding judge, in pre-trial proceedings a judge on a prosecutor’s motion, and subsidiarity: the purpose pursued cannot be achieved otherwise, or achieving it would be substantially more difficult [2].
The numbers have to be read with their unit. Eight years and four months describe interception of content under § 88. Three years describe the general threshold sentence for metadata under § 88a. They do not measure how often the police apply, and they say nothing about the precision of a cell.
When a newspaper text writes “interception” where the subject was location data, it changes the interference for the reader. When the file speaks of § 88a, it is not about the content of a call. It is about another layer.
5. Traffic data are not location data, even when they are often requested together
ZEK distinguishes traffic data and location data. Traffic data under § 90 relate to the transmission of a message on the network or to the billing of a service. They are not the content of communication [4]. Location data under § 91 determine the geographic position of the telecommunications terminal equipment of a user of a publicly available service [4].
In practice they may be requested together. That does not erase the difference. Data on who communicated with whom and when are a different layer from data on the position of a terminal on the network. Both can be sensitive. Both can matter in criminal proceedings. But they do not say the same thing.
The distinction also helps when reading the words “data on telecommunications traffic”. They do not automatically mean that the police know the content of a message. They do not automatically mean that the police hold a GNSS coordinate from the phone. They may include identifiers, times, directions of communication and network data according to the legal basis and the decree.
The right question is therefore not only: did the police obtain data? It is: what kind of data, for what period, under which provision and in what format? Without those answers metadata easily become a story that looked more precise than it was.
6. BTS Start/Stop is not a GNSS coordinate of the phone
Decree No. 357/2012 Coll. is more sober than a film scene. For a mobile network it contemplates the Start and Stop base-station designations, IMSI and a device identifier [5]. That is an output about the relation of a device to the network. It is not an automatic GNSS coordinate of the phone.
GPS.gov states a typical accuracy of a GPS-enabled smartphone of 4.9 metres in radius under open sky [17]. That figure measures the capability of the receiver in the phone under those conditions. It does not measure the accuracy of cell-ID in a file under § 88a. It does not measure the operator’s ability to identify a flat. It is a contrast, not a converter.
Forensic literature shows that location from mobile devices is not one quantity. A 2020 DFRWS/Forensic Science International survey cites an example of a GSM antenna with a range of up to 35 kilometres and, beside it, U-TDOA on the order of 30 to 50 metres [16]. These numbers have to be kept on a leash. They are literary examples of methods and orders of magnitude, not an official accuracy table of the Police of the Czech Republic for 2026, and not a measuring manual.
Public sources therefore do not allow a single sentence of the type “a police cell has an accuracy of X metres”. Sometimes the figure may be coarse, sometimes supplemented by further data. But BTS Start/Stop from the decree is still not the 4.9 metres from a GNSS chip.
The direction of the proof also matters. When the system stores a station designation, an item arises that can be placed into the network. Only a further step says what territory that station practically covered at the given time and whether it could overlap with other stations. That step can be expert and useful. It must not be passed off as the original datum. Otherwise an administrative designation becomes a precise point only because someone drew it over a map base.
That is why it makes sense to ask in the file, separately, for the raw output and for its interpretation. The raw output answers what the operator released. The interpretation answers how space is inferred from that. And only further evidence answers who had the phone with them.
7. A judge's order in the Code of Criminal Procedure is not a request under § 68 of the Police Act
The police may work with location data in different regimes. Criminal proceedings under § 88a are one of them. A search for a particular wanted or missing person under § 68 of the Police Act of the Czech Republic is another. The purpose here is narrower: to establish the time and place of stay of such a person, and the statute binds the result to that purpose [6].
Before mixing a search with criminal proceedings
The first question is which paragraph is in the file or in the request. The second, whether it is criminal activity or a missing person. The third, whether the purpose and the period for which the data are requested are described. § 71 of the Police Act adds a further special branch for a concrete terrorist threat [6]. Even that is not a general “the police at any time”.
The Constitutional Court in judgment Pl. ÚS 45/17 of 2019 accepted, for a search, the absence of judicial review in view of urgency and a possible threat to life, but at the same time insisted on a strict application of the retention rules [10]. That is a precise reservation. It does not say that the police may do everything. It says that different titles have different purposes and different safeguards.
To mix § 68 for § 88a is to change the nature of the interference. One regime looks for a person. The other serves a criminal case. Both may work with data from the operator. They are not, however, the same door.
8. Six months under ZEK is not four months of interception
ZEK requires operators to retain defined traffic and location data for six months. This retention window has applied, in the present wording, since 1 October 2012, when the legislature reacted to the annulment of the previous rules [4] [10]. The statute at the same time forbids retaining the content of messages in this regime [4].
Six months here measure the period of mandatory metadata retention at providers of public networks and services. They do not measure the length of content interception. That, in § 88, the Code of Criminal Procedure sets at most at four months with the possibility of extension, each time by at most a further four months [1]. Different clocks, different object.
These numbers also carry a second reservation. From the six-month retention window one cannot simply say that after it expires no data exist anywhere. Other legal grounds may exist for billing, handover or retention inside a particular case. At the same time, however, the window cannot be turned into a live database for anyone. Access is bound to authorised authorities and a title.
Four months of interception and six months of metadata easily fuse in headlines. In the file they have to be kept apart. Otherwise the reader does not know whether we are talking about what someone said, or about when and in what network context a device communicated.
9. A Union conflict from 2025 does not automatically cancel one order
Czech data retention has a long dispute behind it. The Constitutional Court in Pl. ÚS 24/10 annulled the previous data-retention rules; the judgment was published as 94/2011 Coll. The then § 88a was later annulled as well, published as 43/2012 Coll. [8] [9]. The legislature recast the regime and from 1 October 2012 set six-month retention.
In 2019 the Constitutional Court in Pl. ÚS 45/17 dismissed an application to annul the new rules. It stressed, however, a constitutionally conforming application, strict conditions and the importance of judicial control where it is required [10]. Meanwhile the Court of Justice of the EU in Tele2 Sverige of 21 December 2016 and La Quadrature du Net of 6 October 2020 rejected general and indiscriminate retention of traffic and location data, with only narrow exceptions [13] [14] [15].
The Supreme Court on 30 December 2025 in case 30 Cdo 2556/2025, a civil dispute about an apology, stated that § 97(3) ZEK conflicts with EU law; the press release appeared on 8 January 2026 [11]. That is a strong signal of a defect in the blanket regime. It is not, however, an automatic derogation of a criminal-procedure order in every case. The judgment dealt with an apology, not a blanket erasure of § 88a.
The correct sentence is narrower and more precise: the Czech retention regime is under pressure from EU law, but as of September 2026 the statute remains in the Collection of Laws and each procedure is assessed according to title, time, purpose and usability in the particular case.
For the reader that yields a double caution. It is not precise to say that blanket retention is without a problem because the Constitutional Court dismissed an application in 2019. It is not precise either to say that every datum released under § 88a after the Supreme Court decision automatically vanished from the file. The first sentence ignores the development of EU law. The second turns a civil apology into a procedural magic trick in a criminal case.
The better question is concrete. What datum was retained? Under which rules? For what purpose was it released? Could the matter have proceeded with less interference in privacy? And how did the court in the case treat a Union objection, if someone raised one? Only this series of questions keeps the dispute where it actually is.
10. OTT is not a mobile network. A number on the network does not measure WhatsApp
A further mix-up concerns applications. The Constitutional Court in Pl. ÚS 45/17 expressly stated that the data-retention duty does not fall on OTT services, that is services that run over the internet on top of an access network, such as some communications applications [10]. In other words: locating a number on the mobile network is not a measurement of an encrypted chat.
That does not mean that the content of a phone or an application never enters criminal proceedings. It means that other content requires another title. Examination of device content has its own rules, and § 113a of the Code of Criminal Procedure is a different question from a query to the operator under § 88a [20]. The opinion of NSZ, the Supreme Public Prosecutor’s Office, on securing the content of phones and e-mails shows precisely this boundary between institutes [19].
In practice that means a simple thing. When a file contains data from a mobile operator, it does not thereby automatically speak about the content of WhatsApp, Signal or another application. It may show that a device communicated with the network at a certain time and through a certain cell. It need not say what a person wrote, to whom they wrote in an application, or whether they had the application open.
A telephone number used in an application has to be read with the same care. The number may serve as a login or verification datum, but the application itself communicates through the internet layer. It does not follow that an operator extract from the mobile network automatically describes movement inside the application. It may help with a timeline of the device’s connection. It is not a transcript of an encrypted service.
A number on the network therefore measures the network layer. The application is a further layer. If the file holds both, each must have its own title and its own reading.
11. Time in a CDR is not necessarily the civil time of the act
Location data are read in time. That looks obvious until we ask whose time it is. The operator’s record has its own system stamp, the order marks out a period, and the event in the real world has its civil timeline. These three times are supposed to meet. They must not merely be assumed to be the same.
This point is not a guide to evasion. It is a check on interpretation. In the file one needs to know for what period the judge authorised the data, when the operator recorded them and how that relates to the time of the act. A stretch older than the statutory retention window need not be covered by ordinary retention, unless another legal ground for retention or a prior securing exists [4].
A delay in registration, a difference between a session and a communication, or work with a time zone are also questions of data interpretation. They are not proof of error, but they are a reason for a precise reading. One minute may be beside the point in some cases. In another it may be decisive.
That is why a good procedure does not begin with a map. It begins with a timeline. When was the act supposed to have happened? What period did the order cover? What time does the operator state? And what happens if these times are not placed in one row, but left as separate layers?
A timeline also prevents the opposite error. Sometimes uncertainty is turned into an automatic doubt about everything. That is not necessary. If the order, the operator’s output and the other evidence are aligned in time, the datum may be strong. It only has to be visible what exactly was aligned. Precision does not arise from not talking about time. It arises from describing it.
12. A cell is not a person
A cell speaks about a device on the network. It does not itself say who held the device. The phone may have been lent, stolen, forgotten, left in a car or used by someone else. A contract may point to a subscriber, but the subscriber is not always the current holder. IMEI may point to a handset, IMSI to a subscriber identity, a number to a service. The person is a further link in the chain.
Here this text touches the series “The phone was at the scene of the crime. Was its owner there as well?” only as a reference. There the main question is the forensic reading of a trail. Here we stay with procedure: what a legal title can open, and what does not follow by itself from the released datum.
This is not an argument against the police. It is an argument against a shortcut. A cell can be very important when it fits into further evidence: cameras, witnesses, payments, a seized device, phone content or the movement of a vehicle. Without those joins, however, it should not carry more than it can bear.
The correct sentence therefore reads: a device was recorded in a certain network context. Not: a person stood at a precise place. Between those two sentences lies the whole of proof.
13. GNSS in the phone is a different title from a query to the operator
A GNSS position in the phone and cell-ID from the operator can fuse in public debate. Both are drawn on a map. Both concern a mobile. Legally and technically, however, they are different layers.
GPS.gov states for a smartphone a typical accuracy of 4.9 metres under open sky [17]. HZS, the Fire Rescue Service of the Czech Republic, describes for AML that a smartphone can, on an emergency call, send a position obtained among other things from GNSS or Wi-Fi, and that accuracy may be in metres to hundreds of metres according to conditions [18]. Those are data about a device and an emergency channel. Not about a standard operator output under § 88a.
If GNSS data appear in the file from the content of the phone, another title enters play. The Code of Criminal Procedure knows procedures for examining device content, including § 113a [20]. That is not the same as requesting metadata from the operator. The mix-up is tempting, because the result may end up on the same map. The path to it is, however, different.
That also matters for review. With operator data we ask about the order, the period, identifiers and cells. With phone content we ask about seizure of the device, the scope of examination, the integrity of the data and the title to the content. One map does not cancel the difference between two sources.
14. A three-year threshold sentence is not the police at any time
§ 88a of the Code of Criminal Procedure has conditions. In general it concerns an intentional offence for which the law sets a prison sentence with an upper term of at least three years, or listed offences. Among those listed are, among others, fraud, unauthorised access to a computer system, dangerous threatening, dangerous stalking or breach of the secrecy of conveyed messages [2].
The figure three years is a threshold sentence in the legal text. It does not measure the gravity of every case and is not a free authorisation for any curiosity. Subsidiarity, a written reasoned order and the identity of the user, if known, join it [2]. In pre-trial proceedings the prosecutor moves and the judge decides.
§ 88a(3) admits the consent of the user of the telecommunications device. Precision is needed here as well. Consent replaces the order for data relating to the device and the user who gives the consent. It is not the consent of a third person who wants to know where someone else is.
The legal frame is completed by the Charter. Article 10 protects private and family life, Article 13 the secrecy of messages submitted by telephone and other devices [7]. That does not bar every interference. It does, however, force the question who authorised the interference and why.
15. The output is a station designation. It is not the address of a flat
When a datum is transferred onto a map, it acquires a new authority. A point, a circle or an area look like reality. In fact they are an interpretation of an output. The decree speaks of the Start and Stop base-station designations [5]. Converting BTS onto a coverage map is a further step. That step can be useful, but it is not identical with the original datum.
That is why a description of the chain always has to be requested. What exactly arrived from the operator? What station identification? What time? Who created the map reading, and how? What reservations does coverage have at the given place? Public sources do not give one nationwide table of cell-ID accuracy in metres for every Czech situation. Anyone who asserts one without support is adding extra certainty.
After a case ends, a person has, under certain conditions, a right to learn of the order and to propose a review of its lawfulness by the Supreme Court; § 88a(2) refers to the rules linked to § 88, including exceptions [3]. That too is not a technical detail. It is a safeguard against metadata remaining entirely out of sight of the person they concerned.
In the file, therefore, look for the verbs. The operator “released” data. An expert or a police officer “displayed”, “evaluated”, “compared” or “placed” them on a map. The court “inferred” a certain factual circumstance from them. Each verb marks a further step, and each step may have a different strength. When an article replaces all the verbs with the sentence “the police located”, review is lost.
The output is therefore not the address of a flat. It is an item in a chain. The more precise the conclusion that is to follow from it, the more precise the description of every step between the station and the sentence about a person must be.
16. Three tests of what a cell does not prove
A practical test is meant to serve legal literacy. Not how to become invisible. It contains no advice on switching off registration, rotating identifiers, jamming base stations or delaying emergency location.
What needs to be tested in the file
First question: is it content, or metadata? If someone says interception, check whether it is § 88 or § 88a [1] [2]. Second question: is there in the file a written and reasoned order, or alternatively the consent of the device user? Third: what period does the order cover against ZEK’s six-month retention window [4]. Fourth: what exactly arrived from the operator: a number, IMSI, IMEI, BTS Start/Stop, or something else under the decree [5].
The fifth question is often the most practical: where do the data end and the reading begin? If a document contains only base-station designations and a time, it is necessary to describe separately who assigned a coverage map to them and with what reservations. If the file also contains GNSS from the phone, that is not the same metadata from the operator. A separate title for device content, or another source of the datum, has to be found [20].
Three tests of what a cell does not prove
First test: a cell is not the door of a flat. If the output holds no GNSS, do not read it as GNSS of 4.9 metres and not as an address [17]. Second test: a cell is not a person. Who held the device must follow from further evidence. Third test: a cell is not interception and is not a search for a missing person. Mixing § 88, § 88a and § 68 of the Police Act is an error of institute, not a small shortcut [6].
The point of the tests is not to weaken every piece of evidence. The point is to stop one kind of datum speaking in the voice of another.
A good reading can be strict and at the same time fair. It is strict in that it will not let a cell become a person without further joins. It is fair in that it will not deny the significance of a cell where it fits precisely into a timeline and further evidence. That is the difference between scepticism and review.
17. The question is not how they will find you. It is which title opened which layer
The film question is: how do the police find a mobile? The legal question is slower and more precise. Which title opened which metadata? What period did it cover? What did the operator release? Was it content, or traffic and location data? Is the output a station designation, or a coordinate from the phone? And who held the device?
The hidden cost of a bad reading is not only an error of a few metres. It is a pin that looks like a person but will only bear the registration of a device on the network. Such a pin can help when it is admitted as a link in a chain. It can harm when it is passed off as the end of proof.
It does not follow that police location is unimportant. It follows that its value is procedural and evidentiary, not cinematic. § 88 is not § 88a. Six months are not four months. BTS is not GNSS. A cell is not a person.
That is why a file should be readable layer by layer. Not for formality, but so that review sees the same chain as the decision.
The right closing question is therefore not: how does police location of a mobile phone work? It is: which title opened which layer, and what still does not follow from a cell designation about a door, about the time of the act and about the person who had the phone in their hand?
§ 88 is not § 88a. A station designation is not a pin in the door.
— Jiný Kontext
Related texts in this series
- Can a person’s location be established from a telephone number? — a number ≠ a coordinate.
- How long does an operator retain data… — six months of metadata, not content.
- On the site: The phone was at the scene of the crime. Was its owner there as well? — a forensic reading of a trail. This text is the lawful procedure.