How GPS actually works: satellite positioning and the location fights platforms wage every day

Every fraud detection system eventually asks the same question: where are you, really? Ad platforms want to know if a click came from the country it claims. Delivery apps want proof a driver is actually near the restaurant. Dating apps want to confirm a profile isn’t broadcasting from a server farm three time zones away. Almost all of that verification traces back to a positioning system that was designed for missile guidance in the 1970s and now sits quietly inside every phone. Understanding how GPS actually produces a coordinate explains both why it’s trusted and why that trust has limits.

The satellites aren’t looking at you

The first thing that surprises people is that GPS satellites don’t track anything. They don’t know your phone exists. Each satellite just broadcasts a constant, one way radio signal: a timestamp, its own orbital position (called ephemeris data), and a rough map of where every other satellite in the constellation should be (the almanac). That’s it. The satellite has no idea who’s listening.

Your device does all the work. It picks up signals from multiple satellites at once and measures how long each one took to arrive. Since radio waves travel at a known, fixed speed, travel time converts directly into distance. A signal that took 67 milliseconds longer to arrive came from a satellite that’s roughly 20,000 kilometers farther away.

This is called trilateration, not triangulation, and the distinction matters. Triangulation uses angles. GPS uses distances. If you know your distance from one satellite, you’re somewhere on a sphere around it. Add a second satellite and you’re on the ring where two spheres intersect. A third narrows it to two points, one of which is usually absurd (like underground or in space), so it gets discarded. That leaves one plausible location, mathematically.

Why it takes four satellites, not three

Three satellites would be enough if your device’s clock were perfect. It isn’t. A consumer GPS chip’s internal clock drifts by amounts that would translate into location errors of hundreds of kilometers if left uncorrected, because the whole system depends on nanosecond-level timing precision. GPS satellites solve this with atomic clocks accurate to about one second every 300,000 years, but that doesn’t help if the receiver’s clock is sloppy.

The fix is to treat the receiver’s clock error as an unknown variable to solve for, not something to trust. A fourth satellite gives the device a fourth equation, which lets it solve for four unknowns simultaneously: latitude, longitude, altitude, and its own clock offset. This is the actual mechanism, not an approximation. Miss the fourth satellite and the position estimate degrades fast.

The constellation is bigger than “GPS”

“GPS” technically refers only to the US-operated constellation, which maintains around 31 operational satellites in medium Earth orbit, arranged so that at least four are visible from almost anywhere on the planet at any time. But modern phones rarely rely on GPS alone. They pull signals from GLONASS (Russia), Galileo (EU), and BeiDou (China) simultaneously, a practice called multi-constellation GNSS. More visible satellites means faster fixes and better accuracy in tough conditions, because the receiver has more equations to work with and more redundancy against a blocked or reflected signal.

This is also why positioning has gotten meaningfully better over the past decade without any change to the physics. It’s not that GPS satellites improved. It’s that phones now triangulate, or rather trilaterate, against roughly four times as many satellites as they did when only the US constellation was in use.

Why accuracy falls apart in cities

Dilution of precision is the technical term for what happens when the visible satellites are clustered too close together in the sky instead of spread out. Tight geometry means small timing errors turn into large position errors, the same way a slightly wrong angle matters more on a long ruler than a short one.

Urban canyons make this worse in two ways. Tall buildings block satellites near the horizon, shrinking the geometric spread. And signals bounce off glass and concrete before reaching the receiver, a problem called multipath, which makes a satellite appear farther away than it actually is because the signal took a longer, reflected path. This is the real, boring reason a phone’s blue dot sometimes jumps across the street. It’s not a bug in the app. It’s the physics of a 20,000-kilometer-away radio signal bouncing off a skyscraper.

Why your phone rarely uses raw GPS alone

A cold GPS fix, satellites only, no help, can take 30 seconds or more to compute, because the receiver has to download the full almanac from the satellites at a slow data rate before it can do any math. Nobody wants to wait that long for a map to load, so phones use Assisted GPS (A-GPS), where the carrier or Wi-Fi network hands the device a recent copy of the almanac and ephemeris data over the internet instead of waiting for it over radio. This cuts a fix down to a few seconds.

Phones also cross-reference cell tower IDs and nearby Wi-Fi access point signal strengths against crowdsourced location databases, and blend all of it with the accelerometer, gyroscope, and compass through a process called sensor fusion. The dot on the screen is rarely pure satellite math. It’s a weighted average of several independent positioning systems, which is exactly why it’s a harder thing to fake convincingly than people assume.

Location as a trust signal, and why platforms don’t trust it blindly

This is where the two worlds meet. A ride share app, a mobile ad network, a gig work platform, and a geo-restricted streaming service all use device location as one input into a broader trust decision, precisely because raw GPS coordinates are a single sensor reading that software on the device can, in principle, override. Android and iOS both expose a “mock location” capability for legitimate development and testing purposes, and any app with the right permission can report a location that didn’t come from the satellite math at all.

Platforms that actually care about this don’t just read the coordinate and move on. They check for internal consistency instead. Does the reported GPS location match the location implied by the connecting IP address’s known geographic block? Does it match the cell tower or Wi-Fi network the device is also reporting? Is the “mock location” developer flag set on Android, which is visible to any app that checks for it? Does the position change at a physically plausible speed, since a device that jumps 4,000 kilometers between two location reads thirty seconds apart didn’t take a commercial flight to do it? Does the sensor fusion data (accelerometer noise, gyroscope drift) look like it’s coming from a device that’s actually moving, or from an emulator producing suspiciously clean, static readings?

None of these checks is foolproof on its own, which is exactly why serious detection systems stack several of them and look for disagreement between signals rather than trusting any single one. A spoofed GPS reading is easy to produce. Making it agree with the IP geolocation, the cell tower data, the Wi-Fi scan list, and the physics of how a real device moves through space is a much harder problem, and that gap is where most location fraud actually gets caught.

The real story isn’t the satellites

It’s tempting to think of GPS spoofing detection as a GPS problem. It mostly isn’t. The orbital mechanics and the atomic clocks are the same for everyone, and they’re genuinely hard to fake at the radio layer. The actual battleground is data fusion: how many independent, hard-to-fake signals a platform bothers to cross-check against the one coordinate a device hands over. A location claim that has to survive comparison against network data, sensor noise, and behavioral history is a fundamentally different, and much harder, thing to counterfeit than a single GPS reading in isolation. That’s the pattern behind most of the adversarial infrastructure this site covers: individual signals are brittle, but the systems that layer several of them together are where the real defense lives.

If you want more of this kind of teardown, of how platforms verify what they’re being told and where those checks tend to break, Hidden Internet covers the rest of that machinery.

Get new guides and videos first — join the Telegram channel.