A majority of Android smartphones collect location data and send it back to Google, even when location services are switched off.
News website Quartz reported Android phones gathered information about nearby mobile phone masts and shared those details with Google.
One privacy advocate described the finding as a "betrayal" of users.
Google told Quartz the information was never stored and it said Android would be updated to stop the practice.
The issue affected Android phones with Google Play Services running in the background. Google Play Services are required to access many of the search giant's apps and the framework is pre-installed on a majority of Android smartphones targeted at consumers.
Quartz found that the smartphones were scooping up phone mast addresses – a string of data used to identify individual masts – and sending them back to Google.
The data could be used to work out a person's position.
The phones did so even when location services were switched off in the settings menu and even when there was no Sim card in the phone.
There was no option to disable the practice.
'Discarded'
Google said it had been collecting the tower addresses for 11 months "as an additional signal to further improve the speed and performance of message delivery".
"We never incorporated Cell ID into our network sync system, so that data was immediately discarded," it said in a statement.
Online rights group Privacy International said the finding showed people had "little control" over what smartphones did in the background.
"When we buy a smartphone, we don't expect it to betray us," said Millie Graham Wood, a solicitor for Privacy International.
"While Google states in this instance it will stop the practice, this raises the question of what else it is doing beyond the knowledge of the user, and why."
Let's
