Section: Technology & AI Author: V Reading Length: ~27 min Sources and further reading: 22 items Topics: telephone number, location, privacy, operators, AML, Find My, digital footprint SEO / Working Title: Can a person’s location be found from a telephone number?
Can a person’s location be found from a telephone number? The question sounds simple until we notice that a number, a coordinate and a person are not one item. A number routes a service, not a pin on a map. Coordinates, if they arise at all, describe a device, not the holder. “Last seen” says that an application is open, not where someone is standing. And a website that promises GPS after a stranger’s number is entered usually does not state the statutory title that network location would require. The following text does not show how to find someone. It shows what a number does not prove and where the law holds location data elsewhere.
1. The advertisement promises a pin. At the table, three other things
Three people sit over one number stored in a notepad. A family sees an advertisement: enter a telephone number and you will see a location on a map. It takes that as proof that the operator is selling such information to someone. A security employee objects that location sharing does exist, because Find My and Google Maps can show where a phone is. A lawyer says that location data belong to the confidentiality of communications and that an emergency call is a different regime from a commercial page.
Each is a little right. But no one is comparing the same layer. The family compares the desire for a pin with an advertising promise. The security officer compares consented sharing from an account with a lookup of a stranger’s MSISDN. The lawyer compares the Electronic Communications Act and the Criminal Procedure Code with an e-shop that poses as a map.
That is why they can all be partly right and the shared conclusion still wrong. That a phone can determine its location does not mean that anyone can obtain it after entering a number. That an operator processes traffic and location data does not mean that it sells live coordinates to private websites. And that the police or an emergency line have a statutory channel does not mean that there is a consumer button for a stranger.
The first question is therefore not whether “it works”. It is which “it” we are talking about: a number, a device, an account, a network, an emergency, consent, or a statutory title.
A number is not a coordinate. Coordinates are not a person.
— Jiný Kontext
2. Location by number has at least six layers
The sentence “they traced him by the number” sounds like one plot. In fact several different things are usually stacked in it. The first is a service identifier. A telephone number says where a call or a message is to be routed. It does not say where the holder of the phone is standing.
The second layer is the device. A SIM, an eSIM, a phone and a Google or Apple account are not the same thing. One number can be moved into another phone. One phone can carry more numbers. An account can share a location, but an account is not the number itself.
The third layer is the location of the device. It can arise from a GNSS chip, Wi-Fi, a mobile network or a combination. Each method has a different accuracy and a different legal regime. The fourth layer is the person. The device can be with the owner, with a partner, in a car, in a repair shop, at work, lost or stolen. The number itself will not complete this link.
The fifth layer is the channel of the request. One channel is consent in the operating system. Another is emergency communication. A further one is a judicial or police title. And then there is the advertisement of a website. Only the first three have a mechanism clearly described in public sources. The sixth layer is interpretation. A map with a pin is a claim, not proof. Without consent, an emergency or a statutory title it may be only a loading animation.
This layering is not an ornament of the text. It determines exactly where the claim falls apart. If someone shows a number, they have not yet shown a coordinate. If they show a coordinate, they have not yet shown a person.
3. The best reading is the one whose confusion you can bear
With location by number the main risk is not only technical. The main risk is a swap. One swap tempts payment for a fraudulent service. A second tempts unauthorised surveillance. A third tempts a false conclusion about a person. A fourth tempts treating an emergency or police regime as an ordinary private option.
| Type of failure | What it looks like | How to test it | What will limit the damage |
|---|---|---|---|
| A website’s promise | “Enter a number, you will see GPS” without a title | Does the website state device consent, ZEK, an emergency regime or the Criminal Procedure Code? | Do not enter a stranger’s number, do not pay for unlocking, read the promise against the law |
| A swap of identifiers | A number is read as a coordinate and a person | Separate MSISDN, IMSI, IMEI, account and holder | Keep the chain of layers |
| A swap of signals | An online state is read as a city | Check the service’s help | Do not confuse availability of an application with a map |
| A swap of regimes | AML, 112 or Find My are passed off as “track any number” | Ask who gave consent and which title opened the datum | Distinguish consent, an emergency and a public authority |
The table is not a guide to a search. It is a brake. A useful test here is not meant to lead to the location of a stranger. It is meant to show that a promise without a channel is undocumented. In practice that means a simple rule: if a service claims that after a stranger’s number is entered it will return live GPS without consent and without a statutory title, it does not document a technical ability. At best it documents an advertisement.
The best reading is therefore one that can bear an error without an intrusion into someone else’s privacy. It does not follow that a phone’s location never exists. It follows that its arising, access and interpretation are not contained in the number itself.
4. A number is a routing label. It is not a beacon
In ordinary speech a telephone number poses as a personal attribute. We say “my number”, just as “my address”. But on a network a number is mainly a routing datum of a service. The Electronic Communications Act works with an end point, a service, a subscriber and a user. It defines a location datum as a datum that determines the geographical position of the telecommunications terminal equipment of a user of a publicly available service [5]. Already in this sentence there are two brakes: a device, not a person; a service and a network, not an arbitrary map.
When someone claims that they “have a location by the number”, they have skipped the question of how a service identifier became a datum about a device. And then they have skipped the further question of how a datum about a device became a conclusion about a person. Both links can sometimes be documented. They are not automatic.
The law at the same time protects the confidentiality of communications. Traffic and location data are not a free commodity that can be put in a basket next to a subscription. Section 89 ZEK protects confidentiality, Section 91 sets the conditions for processing location data in value-added services and requires anonymisation or consent [3] [5].
That is the difference between a beacon and a label. A beacon itself transmits a location to whoever is looking. A number routes communication inside the rules of a network. If a location is to arise from it, a further layer must come. Consent. An emergency. A judicial or police title. Without it the number is still only a number.
5. MSISDN is not IMSI, IMEI or a person
Commercial promises like to work with one word: number. In fact the mobile world distinguishes several identifiers. MSISDN is the telephone number used for the service. IMSI identifies a subscriber identity on the network. IMEI relates to the apparatus. Decree No. 357/2012 Sb. keeps these data as different items, including identifiers of the subscriber and of the apparatus and the designation of the base station in mobile communication [7].
The difference is not word-play. When a number is ported to another operator, that does not retrospectively change the physical place where a person moved. ZEK expressly regulates number portability [2]. A number is therefore not a permanent relation to a particular network, still less to a geographical place. It can survive a change of SIM, of phone and of provider.
That is where the idea falls apart that a prefix or the digits themselves carry a map. Sometimes a type of service or a historical origin of assignment can be guessed from a number. That is not a location. It is a trace of administration, often further weakened by portability.
Still more distant is the person. A contract may be written for one person, the phone may be used by another. A prepaid card may have a weaker or different relation to a particular user than a tariff contract. A company number may be held by an employee, a colleague or a spare device. Whether a particular person was at the phone is further proof. Not a property of the number.
6. A device is not an owner
A digital footprint tempts a personal shortcut. The phone was there, therefore the person was there. With location by number this shortcut is still weaker, because often we do not even have the location of the phone. We have only a promise that someone could obtain it from the number.
Even when a device location arises by a statutory or consented path, it still speaks of a device. A phone can lie in a car, in a backpack, on a work desk, with a child, with a partner, in a service centre or with a thief. It can be switched on without the owner having it with them. It can be signed into the account of a person who is not holding it just then. These are not excuses against digital traces. They are conditions of their reading.
This is precisely where the Jiný Kontext series on the digital footprint and the sentence “the phone was at the scene of the crime” continues. There the forensic question is what follows from a trace about a person. This text is narrower. It asks whether a live location follows from the number itself. The answer is still more cautious: the number itself does not prove even a device at a place, still less a person.
A good reading therefore must not end with the first name in the contacts. It needs a chain. Which device? Which account? Which time? Who had physical access? Which title opened the datum? Without these links the person is in the story too early.
7. A network cell is not GPS
The location of a phone can mean several things. GNSS in the phone is one layer. A mobile cell is another. A Wi-Fi location is a further one. A swap of these methods is a frequent reason why an advertising promise looks more credible than it is.
GPS.gov states for a GPS-enabled smartphone a typical accuracy of 4.9 metres in radius under an open sky [20]. This figure is a datum about the ability of the receiver in the phone under the given conditions. It does not measure the accuracy of a website that knows only a telephone number. It does not measure the accuracy of every police or operator output either. And it certainly does not say that a private person will obtain a GNSS location of a stranger’s device without consent.
ZEK speaks of a location datum as the position of terminal equipment on the network [5]. The decree, for mobile communication, works among other things with the designation of the base station [7]. That is not the same as GNSS coordinates from the phone’s chip. A cell can be significant for certain purposes, but its interpretation belongs in another chapter. The detailed difference between cell-ID, time and proof about a person is the subject of a following article on the police procedure.
For this text a plain distinction is enough. GPS is an ability of the device and of its operating system. A cell is a trace of the device’s relation to the network. A telephone number is neither. It is a service address from which no pin falls out by itself.
8. Last seen is not a location
Many people confuse the availability of an application with a location. They see “online”, “last seen” or a green dot and add a map into the story. In its help WhatsApp describes last seen and online as information about when a contact last used the application or that they have it open and the device is connected to the internet. At the same time it expressly distinguishes that this does not mean a message has been read [19].
If even the reading of a message does not follow from this mark, a city cannot follow from it. An online state is not GPS, is not a mobile cell and is not the holder of the phone. It is a state of an application in a particular privacy regime. Catalogues of numbers, spam databases and services that show a caller’s name need to be read with the same caution. They can help guess an identity or a spam risk. They do not document live coordinates.
This error is tempting because an application feels close to a person. When we see that someone is online, we have a feeling of presence. But presence in an interface is not presence in space. A device can be on a network, an application can be open, an account can be active, and still we do not know where the person is standing.
The right question is therefore not whether an application shows something. It is what exactly it shows and what does not follow from that. “Online” is an answer to a different question from “where”.
9. Consented sharing is not track any number
Find My and Google Location Sharing are real products. That is precisely why they need to be read precisely. In its help Google states that Location Sharing is off by default and that the user decides with whom and for how long they share a location [17]. Google Maps at the same time describe a temporary link for people without Gmail, which can be valid for up to 24 hours [17]. That is the validity of a link created by the holder of the device, not the tracking of a stranger’s number.
Apple Find My works similarly as a consented layer of an account. The user shares a location with a chosen contact and chooses the duration of sharing: one hour, until the end of the day or indefinitely, according to Apple’s help [18]. Here too knowledge of a stranger’s MSISDN is not decisive. What is decisive is the account, the device, the setting of location services and an act of the person whose location is being shared.
That is good news for security and bad news for the advertising shortcut. Yes, a phone can share a location. No, it does not follow that anyone can find a stranger’s device after entering a number. Consented sharing is a bridge built from the side of the watched account. “Track any number” claims that the bridge is not needed.
The practical test should be defensive. Look in your own account at whom you share a location with. Cancel sharing that you do not want. Do not try to verify a stranger’s number on a page that promises to unlock a map.
10. 112 and AML are not a private search
Emergency communication is a different regime. ZEK provides that in emergency communication to the numbers 112, 150, 155 and 158 the operator makes location data available to the emergency-communication centre, even without the caller’s consent [1]. That is not a gap for curiosity. It is a rule for the protection of life, health and safety.
Advanced Mobile Location adds to this the ability of a smartphone to send a more precise datum in an emergency call. HZS ČR states minimum versions of the operating systems Android 4.1 and iOS 13 and describes an accuracy from metres to hundreds of metres according to the available method and conditions [13]. The Police of the Czech Republic announced the launch of localisation SMS for Android on 11 February 2020 [14]. These figures measure emergency infrastructure and properties of a device in an emergency situation. They do not measure a commercial website.
eCall too is an emergency channel, not a service for a private search. Regulation (EU) 2015/758 and the following arrangement for mobile devices deal with the transmission of data for 112 and emergency services [15] [16]. At the centre are an accident, a call and help. Not a stranger’s number inserted into a form.
From AML one therefore cannot infer that the same accuracy is available to anyone. Something else follows from it: the legal system knows situations in which a device location can be made available quickly and without ordinary consent. That is precisely why it holds them in an emergency regime, not in an advertisement.
11. Section 88a is not an e-shop with GPS
In criminal proceedings the police can obtain data about telecommunications traffic. Not because they know a number and click on a map. The Criminal Procedure Code in Section 88a provides for a judge’s order for data about accomplished telecommunications traffic. The general branch aims at an intentional offence with an upper limit of the sentencing range of at least three years or at enumerated offences [8]. The order is to be written and reasoned. That is a process, not a consumer API.
Section 88a(3) moreover shows a further distinction: an order is not needed if consent is given by the user of the telecommunications device to which the data relate [8]. That resembles the logic of consented sharing. Consent belongs to that device and user, not to a third person who knows a stranger’s number.
Outside criminal proceedings there are further statutory titles. The Act on the Police of the Czech Republic allows data to be required in a commenced search for a particular wanted or missing person, and that for the time and place of stay [9]. That is different from Section 88a and different from a web service. It has a purpose, an authority and a responsibility.
This article does not analyse the police procedure in detail. That is the subject of a following text. Here a boundary is enough: a statutory title is not proof that a private website can do the same. On the contrary it explains why an ordinary page should have nowhere legal to take it from.
12. Six months with the operator are not a live pin for anyone
Under ZEK the operator has a duty to retain certain traffic and location data for six months. The act at the same time provides that the content of messages is not retained, and it delimits the circle of authorised authorities [6]. Six months are therefore a retention window for metadata. They are not a live map for the public.
This figure needs a reservation. It measures the mandatory period of retention of delimited data in Czech public networks and services according to the wording of the act in force as of September 2026. It does not measure accuracy, it says nothing about the content of communication and it does not open access to a commercial service. After the period expires the data are to be destroyed unless they have been handed over or otherwise lawfully retained. Even from that, however, one cannot mechanically infer that no datum will ever remain anywhere for billing or other legal purposes.
This is precisely where an advertising promise often poses as a technical matter of course. The operator has the data, so the website will show them. That is a bad jump. Between retention and release stand the confidentiality of communications, a purpose, an authority and a title. Section 182 of the Criminal Code protects the secrecy of conveyed messages; with a stranger’s device further criminal-law boundaries may be added [10] [11].
Six months with the operator are therefore not proof of availability. They are proof that the law treats such data as sensitive metadata.
13. A website’s promise is not a technical ability
Commercial websites promising “enter a number and you will see GPS” usually work with one trick: they omit the title. They show a map, an animation, convincing words and sometimes a payment gateway. They do not, however, publish a contract with a Czech operator, a legal basis for locating a stranger’s device or the consent of the person whose location is supposedly to be displayed.
Public sources as of September 2026 do not document a legal consumer interface of a Czech operator that would return live coordinates after a stranger’s number is entered without consent and without a statutory title. That is a cautious sentence. It does not say that no fraudster will ever extract information by another path. It does not say that technical attacks on networks do not exist. It says that the promised ordinary service has no support in how public law describes access to location data.
The article therefore deliberately contains no procedures for network attacks, for bypassing an operator, for social engineering or for hidden software. That would not be a test of an advertisement. That would be a shift into a guide to an attack. The test of a promise is enough on paper: who is the holder of consent, who is the authorised authority, which paragraph or emergency regime opened the datum?
With similar websites it is good to watch one more thing: at what moment a technical claim becomes psychological pressure. A page often first hints that it has already found something. Then it shows a blurred map, a countdown or a message about “verifying the operator”. Finally it wants a payment, a registration or a further step. Not one of these screens is proof that a lawful location of a device has taken place. It is only an interface that creates an impression of progress.
The difference is recognised by responsibility. A statutory channel has an actor, a purpose and a trace: an emergency centre, the police, a judge, an operator, a user’s consent. An advertising website often has only a promise and a commercial form. It does not follow that every page with a map is a fraud. It follows that a map without an explained title has no evidentiary value. With a sensitive datum it is not enough that the result looks like a product.
If the answer is missing and only a payment button remains, there is no need to enter a stranger’s number. The bridge between advertisement and evidence is missing.
14. Stalkerware is not a location service by number
Hidden software on a stranger’s phone is a different problem. The Coalition Against Stalkerware describes stalkerware as tools that enable hidden surveillance of devices and persons without the victim’s knowledge [21]. This definition matters precisely because it is not a search for a person by a number. It is an intrusion into a device.
It does not follow that this is less dangerous. It follows that it does not belong in the same box as MSISDN. If someone claims that a number is enough, and in fact relies on the installation of hidden software, they fraudulently change the description of the service. They did not read a location from the number. They tried to get into a stranger’s device.
The legal framework is proportionate to that. For unauthorised access to a computer system Section 230 of the Criminal Code comes into consideration, for long-term concealed surveillance also the framework of dangerous pursuit under Section 354 [11] [12]. This text goes no further, because further on a guide would begin. For the reader’s decision it is enough to distinguish that stalkerware is not an operator’s service and is not a location function of a telephone number.
The practical defence here is different from that against an advertising website. With a website it is enough not to accept a promise without a title and not to enter a stranger’s data. With one’s own phone it makes sense to check application permissions, location sharing, signed-in accounts and devices that have access to an Apple or Google account. That is work with one’s own security setting, not a search for someone else. Its aim is to shrink one’s own footprint and to find unexpected sharing.
This distinction protects victims as well. A person who suspects surveillance does not need to hear that “a phone cannot be found by number”, as if that made their problem disappear. They need to know that the problem may lie in a device, an account or relationship violence, and that it should be dealt with safely. Technical precision must not sound like downplaying here.
The safe conclusion is plain. If you fear surveillance of your own device, deal with your own account, application permissions, location sharing, a security check of the phone and if need be the police. Do not look for a better website for a stranger’s number.
15. A number can be ported. Coordinates do not move with it
Number portability is an unpleasant thing for an advertising promise. ZEK allows a subscriber to keep a number when changing provider [2]. A number is therefore not firmly nailed to one operator, one network or one place. It can remain the same even when the commercial relation and the technical environment change.
In ordinary life we do not notice this. A person still has “the same number”. The network, however, must arrange that communication is routed correctly after a change of provider. This ability confirms that a number is a routing label of a service. Not a coordinate.
Further situations work in the same way. A VoIP number can have a different relation to a physical device than a mobile SIM. An eSIM can be moved or combined with a further line. A company phone can be issued to another employee. A spare device can carry the same number and a different history of movement. None of these circumstances by itself says where a person is standing.
Portability also spoils the tempting idea of a “geography of the number”. Part of a number can remind a person of an older assignment, a provider or a service. But even if such a hint sometimes fitted, it would still speak of an administrative history. It would say nothing about today’s phone in today’s street. In location the decisive things are the moment and the device, not the memory of a number.
If a number were a beacon, portability would give a map a peculiar magic. Coordinates would move with an administrative identifier. The world does not work that way. A location arises on a device or on a network at a particular time. A number helps to route a service. Those are two different things.
16. Three tests of what a number does not prove
The practical test of this subject must not be a test of how to find a stranger. It should be a test of reading a promise. Its aim is to find out whether a claim describes a documented channel at all.
What needs to be tested in a website’s promise
First question: does the website state a statutory title or the consent of the other device? Look for an express relation to the confidentiality of communications under ZEK, to the conditions for processing location data, to emergency communication, to Section 88a of the Criminal Procedure Code, or to consented sharing of a location from an account [3] [5] [8] [17]. If a service promises live GPS without all of that, the promise is not documented.
Second question: what is actually being entered? If only a telephone number, a device, an account, a location and a person are missing. If the service additionally requires that the other person click a link or permit something, it is not location by number. It is an attempt to obtain consent or another interaction. This text does not describe how to force such an interaction. That is precisely the boundary.
Third question: who bears responsibility for the result? With Find My the account and its setting answer for the sharing. With an emergency the statutory system of help answers. With criminal proceedings an authority and a judicial title answer. With a website that hides behind anonymous terms and a promise of “precise GPS”, a control point is missing. The more sensitive the datum, the less a smooth interface should suffice.
Three tests of what a number does not prove
The first test is: a number is not a coordinate. MSISDN routes a service, the decree separates a number, IMSI, IMEI and cell data, and portability cancels the idea of a geographical number [2] [7]. The second test is: a number is not a person. Anyone can hold a device and an application’s online state is not a map [19]. The third test is: a number is not a statutory channel. Six months with the operator are not a public API, AML belongs to an emergency and Find My requires an act of the account whose location is being shared [6] [13] [18].
These tests can be done without a single stranger’s number. It is enough to read a service’s help, the statutory text and one’s own account setting. That is essential. Once a test needs to try a stranger, it has ceased to be a test of a claim and has become an intrusion. A safe procedure asks about the chain of evidence, not about whether someone manages to bypass consent.
One more question belongs at the end: what would convince you? With a serious claim there would be a traceable legal basis, an identifiable provider, a description of consent or of an authority and a clear limit of purpose. With a bad promise the boundary is on the contrary blurred. Once one speaks of a number, then of GPS, then of family sharing and finally of emergency technology. Precisely the swapping of layers is a warning.
When a close person is missing, the official path is not an advertising form. It is the Police of the Czech Republic and the statutory procedure of a search [9]. That is advice toward a title, not toward targeting.
17. The question is not where someone is. It is from what that could follow at all
The most attractive promise is the shortest: write a number, you will see a map. That is precisely why it needs to be lengthened. Which device? Which account? Which consent? Which statutory title? Which metadata? Which interpretation? Who held the phone?
The hidden cost is not ignorance of GPS. It is the shortcut that swaps a service label for a beacon and a device for a person. Such a shortcut can cost money, privacy and a bad decision. Sometimes all three things at once.
It does not follow that a phone’s location is always unavailable. It follows that availability is not a property of the number. A location can arise in the phone, on the network, in emergency communication, in consented sharing or on the basis of a statutory procedure. Each path has a different actor, a different control and a different meaning.
The right question is therefore not: can a person’s location be found from a telephone number? It is: what follows from a number as the routing of a service, and which documented title could open a datum about the location of a device at all?
A website’s promise is not a statutory title. And last seen is not a map.
— Jiný Kontext
Related texts in this series
- How does police location of a mobile phone work? — a statutory title, not an e-shop with GPS.
- On the website, the series A digital footprint is not a judgment: The phone was at the scene of the crime. Was its owner there too? — what a trace proves about a person. This text: what a number does not prove.
- May the police search your mobile phone?