Section: Technology & AI Author: V Reading time: ~27 min Sources and further reading: 22 items Topics: phone number, location, privacy, operators, AML, Find My, digital footprint SEO / Working Title: Can a person be located by phone number?
Can a person be located by phone number? The question sounds simple until we notice that a number, a coordinate, and a person are not one item. The number directs the service, not the pin on the map. The coordinates, if they are created at all, describe the device, not the holder. "Last seen" says the app is open, not where someone is standing. And a website that promises GPS after entering a foreign number usually doesn't list the legal title it has to network location. The following text does not show how to find someone. It shows what the number doesn't prove and where the law holds the location data elsewhere.
1. The ad promises a pin. Three other things on the table
Three people sit over one number stored in a notebook. A family sees an ad: enter the phone number and see the location on the map. He takes it as evidence that the operator is selling such information to someone. The security officer counters that location sharing does exist because Find My and Google Maps can show where the phone is. The lawyer says that the location data belongs to the confidentiality of the communications and that the emergency call is a different mode than the commercial page.
Everyone is a little right. But no one compares the same layer. The family compares the desire for a pin to an advertising promise. The security officer compares consent sharing from the account with a foreign MSISDN lookup. A lawyer compares the Electronic Communications Act and the Criminal Code to an e-shop that looks like a map.
Therefore, they can all be partly right and the common conclusion still wrong. Just because a phone can determine its location does not mean that anyone can get it after entering a number. The fact that the operator processes traffic and location data does not mean that it sells live coordinates to private websites. And just because the police or the emergency line have a legal channel doesn't mean there is a consumer button for a stranger.
So the first question is not whether "it works". It sounds like what "it" we're talking about: a number, device, account, network, distress, consent, or legal title.
A number is not a coordinate. Coordinates are not a person.
— Jiný Kontext
2. Position by number has at least six layers
The sentence "they traced him by the number" sounds like one plot. In fact, it is composed of several different things. The first is the service identifier. The phone number tells where the call or message should be routed. It doesn't say where the phone holder is standing.
The second layer is the device. A SIM, eSIM, phone, and Google or Apple account are not the same thing. One number can be changed to another phone. One phone can carry several numbers. An account can share a location, but an account is not a number itself.
The third layer is device location. This can arise from a GNSS chip, Wi-Fi, a mobile network or a combination. Each method has a different accuracy and a different legal regime. The fourth layer is man. The device can be with the owner, with a partner, in the car, in a repair shop, at work, lost or stolen. The number alone will not pull this clutch.
The fifth layer is the request channel. One channel is consent in the operating system. Another is emergency communications. Another is a judicial or police degree. And then there's the site's advertising. Only the first three have a clearly described mechanism in public sources. The sixth layer is interpretation. A pin map is a claim, not a proof. Without consent, distress, or legal title, it can only be a loading animation.
This layering is not an embellishment of the text. Determines exactly where the statement breaks down. If someone shows a number, they haven't shown a coordinate yet. If it shows a coordinate, it hasn't shown a person yet.
3. The best reading is the one you can bear to confuse
With position by number, the main risk is not just technical. The main risk is confusion. One confusion tempts you to pay for fraudulent services. Second to unauthorized surveillance. The third to the false conclusion about man. The fourth is that the emergency or police regime is pretending to be a normal private option.
| A kind of failure | What does he look like? | How to test it | What will limit the damage |
|---|---|---|---|
| The Promise of the Web | "Enter a number, see GPS" untitled | Does the website indicate device approval, ZEK, emergency regime or criminal code? | Do not enter a foreign number, do not pay for unlocking, read the promise against the law |
| Swap identifiers | The number is read as a coordinate and a person | Separate MSISDN, IMSI, IMEI, Account and Holder | Keep the layer chain |
| Swap signals | Online status reads like a city | Verify service help | Don't confuse app availability with a map |
| Swap modes | AML, 112 or Find My will go for "track any number" | Asking who gave consent and what title opened the data | Differentiate between consent, distress and public authority |
The table is not a search guide. It's a brake. A useful test here is not to lead to the location of a stranger. It's meant to show that the no-channel promise is unsubstantiated. In practice, this means a simple rule: if a service claims to return a live GPS after entering a foreign number without consent and without legal title, it does not demonstrate technical capability. It proves advertising at best.
The best reading is therefore one that can withstand error without intruding on someone else's privacy. This does not mean that the location of the phone never exists. It follows from the fact that its origin, approach and interpretation are not contained in the number itself.
4. The number is a routing label. There is no lighthouse
In common parlance, a phone number appears as a personal property. We say "my number" as well as "my address". But in the network, the number is mainly the routing information of the service. The Electronic Communications Act deals with endpoint, service, subscriber and user. It defines location data as data that determines the geographic location of the telecommunications terminal device of the user of a publicly available service [5]. Already in this sentence there are two brakes: the device, not the person; service and network, not just any map.
When someone claims they "have location by number", they've skipped the question of how the service identifier became the device data. And then he skipped over the next question, how did the data about the device become the inference about the person. Both conjunctions can sometimes be attested. But they are not automatic.
At the same time, the law protects the confidentiality of communications. Traffic and location data is not a free commodity that can be put in the cart next to the subscription. § 89 ZEK protects confidentiality, § 91 sets the conditions for the processing of location data for value-added services and requires anonymization or consent [3] [5].
That's the difference between a beacon and a nameplate. The beacon itself broadcasts the location to the viewer. The number directs communication within the rules of the network. If it is to become a position, another layer must come. Agreement. Distress. Court or police title. Without it, a number is still just a number.
5. MSISDN is not IMSI, IMEI or human
Commercial promises like to work with one word: number. In fact, the mobile world distinguishes several identifiers. The MSISDN is the telephone number used for the service. The IMSI identifies the subscriber identity in the network. The IMEI refers to the device. Decree No. 357/2012 Coll. it keeps this data as various items, including subscriber and device identifiers and the designation of the base station for mobile communication [7].
The difference is not a matter of words. When the number is transferred to another operator, it does not reverse the physical location where the person moved. ZEK explicitly regulates the portability of numbers [2]. Therefore, the number is not a permanent relationship to a specific network, let alone a geographic location. It can survive SIM, phone and provider changes.
This dispels the notion that the area code or digits themselves carry the map. Sometimes the type of service or the historical origin of the assignment can be estimated from the number. That's not a location. It is a trace of administration, often additionally weakened by portability.
Man is even more distant. The contract can be written for one person, the phone can be used by another. A prepaid card may have a weaker or different relationship to a specific user than a tariff contract. The company number can be held by an employee, a colleague or a spare device. If there was a certain person on the phone, there is additional proof. Not a property of number.
6. The device is not the owner
The digital footprint leads to a personal shortcut. The phone was there, so the person was there. With location by number, this shortcut is even weaker because we often don't even have the location of the phone. We only have a promise that someone from the number would be able to get it.
Even if the location of the device is created through legal or consensual means, it is still talking about the device. The phone can be in a car, in a backpack, on a desk, with a child, with a partner, in a service center or with a thief. It can be turned on without the owner having it with them. It can be logged into the account of a person who does not currently hold it. These are not excuses against digital footprints. It is the conditions of their reading.
This is where the Another Context series about the digital trace and the phrase "the phone was at the crime scene" continues. There it is a forensic question of what the trace reveals about the person. This text is narrower. It asks if the live location is derived from the number itself. The answer is even more cautious: the number itself doesn't even show a device in place, let alone a person.
Therefore, a good read must not end with the first name in a contact. It needs a string. What device? What account? what time Who had physical access? What title did the data open? Without these connectors, one is too early in the story.
7. Network cell is not GPS
The location of the phone can mean several things. GNSS in the phone is one layer. Mobile cell is different. Wi-Fi location is another. The confusion of these methods is a common reason why an advertising promise seems more believable than it is.
GPS.gov lists a typical accuracy of 4.9 meters in an open-sky radius for a GPS-enabled smartphone [20]. This number is an indication of the capability of the receiver in the phone under the given conditions. It doesn't measure the accuracy of a website that only knows a phone number. Nor does it measure the accuracy of each police or operator output. And it doesn't say at all that a private person will obtain the GNSS location of a foreign device without consent.
ZEK refers to location data as the location of the end device in the network [5]. In the case of mobile communication, the decree works, among other things, with the designation of the base station [7]. This is not the same as GNSS coordinates from the phone chip. A cell may be significant for certain purposes, but its interpretation belongs in another chapter. The detailed difference between cell-ID, time and human evidence is the subject of a follow-up article on police procedure.
A simple distinction is sufficient for this text. GPS is a capability of the device and its operating system. A cell is a footprint of a device's relationship to the network. The phone number doesn't matter either. It is a service address from which no pin will fall out by itself.
8. Last seen is not a location
Many people confuse app availability with location. They see "online", "last active" or a green dot and add a map to their story. In its help, WhatsApp describes last seen and online as information about when a contact last used the app or that they have it open and the device is connected to the Internet. At the same time, it explicitly distinguishes that this does not mean reading the message [19].
If even reading the message does not flow from this sign, the city cannot flow from it. Online status is not GPS, not mobile cell and not phone holder. It is the state of the application in a certain privacy mode. Just as carefully, you need to read number directories, spam databases and services that show the name of the caller. They can help estimate the identity or risk of spam. They do not document live coordinates.
This error is tempting because the app feels close to the human. When we see that someone is online, we have a sense of presence. But presence in interface is not presence in space. The device can be on the network, the app can be open, the account can be active, and yet we don't know where the person stands.
So the right question isn't whether the app shows something. It sounds exactly what it shows and what it doesn't. "Online" is an answer to a different question than "where".
9. Consensual sharing is not a track any number
Find My and Google Location Sharing are real products. That is why it is necessary to read them exactly. Google says in its help that Location Sharing is turned off by default and that the user decides with whom and for how long the location is shared [17]. At the same time, Google Maps describes a temporary link for people without Gmail that can be valid for up to 24 hours [17]. This is the validity of the link created by the owner of the device, not the tracking of a foreign number.
Apple Find My works similarly to the consent layer of an account. The user shares the location with the selected contact and chooses the sharing time: one hour, until the end of the day, or indefinitely, according to Apple Help [18]. Knowledge of a foreign MSISDN is not decisive here either. Account, device, location service settings and the action of the person whose location is being shared are decisive.
That's good news for security and bad news for the ad acronym. Yes, the phone can share location. No, it does not follow that anyone can find someone else's device after entering the number. Consensual sharing is a bridge built by the monitored account. "Track any number" claims the bridge is not needed.
The practical test is supposed to be defensive. See who you're sharing your location with in your own account. Unshare the ones you don't want. Do not try to verify a foreign number on a page that promises to unlock the map.
10. 112 and AML are not private searches
Emergency communication is a different mode. The ZEK stipulates that when making emergency calls to numbers 112, 150, 155 and 158, the operator will make location data available to the emergency communication center, even without the caller's consent [1]. This is not a loophole for curiosity. It is a rule to protect life, health and safety.
Advanced Mobile Location adds to this the ability of the smartphone to send a more accurate data during an emergency call. HZS CR lists the minimum versions of the operating systems Android 4,1 and iOS 13 and describes the accuracy from meters to hundreds of meters according to the available method and conditions [13]. The Police of the Czech Republic announced the launch of location SMS for Android on 11 February 2020 [14]. These numbers measure the emergency infrastructure and features of the facility in an emergency situation. It does not measure a commercial website.
Also, eCall is an emergency channel, not a private search service. Regulation (EU) 2015/758 and subsequent regulation for mobile devices address data transmission for 112 and emergency services [15] [16]. In the center is the accident, call and help. Not a foreign number entered into the form.
Therefore, it cannot be inferred from AML that the same accuracy is available to everyone. It implies something else: the legal system knows situations where a device's location can be made available quickly and without normal consent. That's why they keep them in emergency mode, not advertising.
11. § 88a is not an e-shop with GPS
The police can obtain data on telecommunications traffic in criminal proceedings. Not because he knows the number and clicks on the map. § 88a of the Criminal Code provides for a judge's order for data on telecommunications traffic. The general branch aims at an intentional crime with a maximum sentence of at least three years or at listed crimes [8]. The order must be in writing and justified. That's a process, not a consumer API.
§ 88a odst. 3 additionally shows another distinction: an order is not needed if consent is given by the user of the telecommunications device to which the data relates [8]. This is similar to the logic of consensual sharing. Consent belongs to that device and the user, not to a third party who knows a foreign number.
There are other legal titles outside of criminal proceedings. The Act on the Police of the Czech Republic allows for data to be requested when a search is launched for a specific wanted or missing person, namely for the time and place of stay [9]. This is different from § 88a and different from a web service. It has purpose, authority and responsibility.
This article does not discuss police procedure in detail. This is the topic of the following text. A boundary is sufficient here: a legal title is not proof that a private website can do the same. On the contrary, it explains why the regular site has nowhere to legally take it from.
12. Six months with the operator is not a live pin for anyone
According to the ZEK, the operator is obliged to store certain operational and location data for a period of six months. At the same time, the law stipulates that the content of messages is not stored and defines the range of authorized authorities [6]. So six months is the retention window for metadata. It is not a live map for the public.
This number needs a caveat. It measures the mandatory retention period of defined data in Czech public networks and services according to the effective wording of the law as of September 2026. It does not measure accuracy, does not say anything about the content of the communication, and does not open access to a commercial service. After the expiry of the period, the data must be disposed of, if they have not been transferred or otherwise legally retained. Even from this, it cannot be automatically concluded that no data will ever remain anywhere for accounting or other legal purposespurposes.
This is where the advertising promise often appears as a technical matter of course. The operator has the data, so the website will show it. That's a bad jump. Between retention and release stand the confidentiality of communications, purpose, authority and title. Section 182 of the Criminal Code protects the secrecy of messages conveyed; additional criminal law boundaries may be added for foreign equipment [10] [11].
Six months with the operator is therefore not proof of availability. It is evidence that the law treats such data as sensitive metadata.
13. The promise of the site is not technical ability
Commercial sites promising "enter a number and see GPS" usually work with one trick: they omit the title. They will show a map, animation, persuasive words and sometimes a payment gateway. However, they will not publish the contract with the Czech operator, the legal basis for the location of a foreign device, or the consent of the person whose location is supposed to be displayed.
As of September 2026, public sources do not document a legal consumer interface of the Czech operator, which would return live coordinates after entering a foreign number without consent and without a legal title. That's a careful sentence. It doesn't say that no scammer ever lures information by another route. It does not say that technical attacks on networks do not exist. He says the promised mainstream service has no basis in how public law describes access to location data.
Therefore, the article deliberately does not include methods of network attacks, carrier bypassing, social engineering, or hidden software. That would not be a test of advertising. That would be the transition to the attack tutorial. It is enough to perform the test of the promise on paper: who is the consent holder, who is the authorized authority, what section or emergency regime opened the data?
There's one more thing to watch out for with similar sites: at what point does a technical claim turn into psychological coercion. The site will often first indicate that it has already found something. It will then show a blurry map, countdown, or "operator verification" message. Finally, he wants payment, registration, or the next step. Neither of these screens is proof that a legitimate device location has taken place. It is only an interface that gives the impression of progress.
We can tell the difference by responsibility. A legal channel has an actor, a purpose and a trace: emergency center, police, judge, operator, user consent. An advertising website often only has a promise and a business form. This does not mean that every map page is a scam. It follows that a map without an explained title has no probative value. For sensitive data, it is not enough that the result looks like a product.
If the answer is missing and only the payment button remains, there is no need to enter a foreign number. The bridge between advertising and records is missing.
14. Stalkerware is not a location service by number
Hidden software on someone else's phone is another issue. The Coalition Against Stalkerware describes stalkerware as tools that enable covert surveillance of devices and people without the victim's knowledge [21]. This definition is important precisely because it is not about finding a person by number. It's a device hack.
That doesn't make it any less dangerous. It follows that it doesn't belong in the same box as MSISDN. If someone claims a number is enough and actually relies on installing hidden software, they are fraudulently changing the service description. He didn't read the location from the number. He was trying to access a foreign device.
The legal framework is commensurate with this. In the case of unauthorized access to a computer system, § 230 of the Criminal Code comes into consideration, in the case of long-term covert surveillance, also the framework of dangerous persecution according to § 354 [11] [12]. This text does not go any further, because the instructions would start next. For the reader's decision, it is sufficient to distinguish that stalkerware is not a carrier service and is not a phone number location feature.
The practical defense here is different than with an advertising website. With the website, just don't accept a promise without a title and don't enter other people's data. On your own phone, it makes sense to control app permissions, location sharing, signed-in accounts, and devices that have access to an Apple or Google account. That's working with your own security settings, not looking for someone else's. Her goal is to reduce her own footprint and find unexpected shares.
This distinction also protects victims. A person who suspects tracking doesn't need to hear that "the phone cannot be found by number" as if that makes their problem go away. He needs to know that the problem may lie with the device, the account, or relationship violence, and that it should be handled safely. Technical precision must not sound trivial here.
The safe conclusion is simple. If you're worried about your device being tracked, deal with your own account, app permissions, location sharing, phone security checks, and possibly the police. Do not look for a better website on a foreign number.
15. Number can be ported. The coordinates do not move with it
Number portability is an annoying thing for an advertising promise. ZEK allows the subscriber to keep the number when changing the provider [2]. So the number is not fixed to one operator, one network or one location. It can remain the same even if the business relationship and technical environment change.
We don't notice it in everyday life. A person always has the "same number". But the network must arrange for the communication to be routed correctly after a change of provider. This capability confirms that the number is a service routing label. Not coordinates.
Other situations work the same way. A VoIP number may have a different relationship to a physical device than a mobile SIM. The eSIM can be moved or combined with another line. The company phone can be issued to another employee. A replacement device may carry the same number and a different movement history. None of these circumstances alone tell where one stands.
Portability also spoils the alluring notion of "number geography". Part of the number may remind a person of an older assignment, provider or service. But even if such a hint sometimes fits, it is still talking about administrative history. It says nothing about today's phone in today's street. The moment and device, not the memory of a number, are decisive for localization.
If the number were a beacon, portability would give the map a special magic. The coordinates would migrate with the administrative identifier. That's not how the world works. The location is created on the device or in the network at a certain time. The number helps route the service. Those are two different things.
16. Three tests of what a number does not prove
The practical test of this topic must not be a test of how to find a stranger. It is supposed to be a test of reading the promise. Its goal is to determine whether the claim describes the documented channel at all.
What needs to be tested for the promise of the site
First question: does the website state the legal title or consent of the other device? Look for an explicit relationship to the confidentiality of communications according to the ZEK, to the conditions for processing location data, to emergency communications, to § 88a of the Criminal Code, or to the consent sharing of the location from the account [3] [5] [8] [17]. If a service promises live GPS without all of that, the promise isn't backed up.
The second question: what is actually entered? If only the phone number, the device, account, location and person are missing. If the service additionally requires the other person to click a link or allow something, it is not location by number. It is an attempt to gain consent or other interaction. This text does not describe how to force such an interaction. That's the limit.
The third question: who is responsible for the result? With Find My, the account and its settings are responsible for sharing. In times of need, the statutory aid system is responsible. In criminal proceedings, the authority and court title are responsible. A site that hides behind anonymous terms of service and a promise of "accurate GPS" lacks a checkpoint. The more sensitive the data, the less a smooth interface should be enough.
Three tests of what the number doesn't prove
The first test is: a number is not a coordinate. MSISDN directs the service, the decree separates the number, IMSI, IMEI and cell data, and portability cancels the idea of a geographic number [2] [7]. The second test is: a number is not a person. Anyone can hold the device and the app's online status is not a map [19]. The third test is: the number is not a legal channel. For six months, the operator has no public API, AML is in dire straits, and Find My requires an account whose location is shared [6] [13] [18].
These tests can be done without a single foreign number. Just read the service help, the legal text and your own account settings. That is essential. Once a test needs to test a stranger, it has ceased to be a test of claims and has become an intervention. Safe practice asks about the chain of evidence, not whether someone can bypass consent.
One last question: what would convince you? For a serious claim, there would be a traceable legal basis, an identifiable provider, a description of consent or authority, and a clear purpose limitation. In the case of a bad promise, on the other hand, the boundary blurs. One time they talk about a number, another time about GPS, a third time about family sharing and finally about emergency technology. It is the alternation of layers that is the warning.
When a loved one is missing, an advertisement form is not the official way. It is the Police of the Czech Republic and the legal search procedure [9]. That's advice on the title, not the focus.
17. The question is not where who is. Sounds like what could it possibly be
The most attractive promise is the shortest: write the number, see the map. That is why it needs to be extended. Which device? Which account? What consent? What legal title? What metadata? What interpretation? Who was holding the phone?
Hidden cargo is not ignorance of GPS. It is an abbreviation that replaces the service name with a beacon and the device with a person. Such a shortcut can cost money, privacy and bad decisions. Sometimes all three things at once.
This does not mean that the location of the phone is always unavailable. It follows that availability is not a property of number. The location can be created on the phone, in the network, during emergency communication, during consensual sharing or based on a legal process. Each path has a different actor, a different control and a different meaning.
So the right question is not: can a person's location be determined by a phone number? It reads: what does the number imply as service routing, and what documented title could even open the device's location data?
A site promise is not a legal title. And last seen is not a map.
— Jiný Kontext
Related texts in this series
- How does police mobile phone tracking work? — legal title, not GPS e-shop.
- On the web, series A digital footprint is not a judgment: The phone was at the crime scene. Was his owner there too? — what a trace proves about a person. This text: what the number does not prove.
- Can the police search your cell phone?