"Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers-even when location services are disabled-and sending that data back to Google", Quartz reported.
Therefore Google has access to data about individuals' locations and movements, even when their phones are turned off or disconnected from the Internet, which violates the privacy of smartphone users.
Quartz said its investigation showed that the location-sharing practice wasn't confined to any particular type of Android smartphone or tablet.
"In order for Android users to receive notifications and messages quickly, an Android device needs to maintain a persistent connection to Google servers using Firebase Cloud Messaging", the source added.
Google's phone woes come as it sought to clampdown on another practice which has plagued it in recent months, ticket resellers offering second-hand tickets at vastly inflated prices.
United Kingdom data protection officials are also looking into the matter. When Android devices are connected to a WiFi network, they will send the tower addresses to Google even if they don't have SIM cards installed.
Phone networks routinely collect data about where mobile users are, via information recorded from phone masts across the country. The period between pings can vary by network and can have an affect on battery life and connectivity.
This means that even people who actively turn off their Global Positioning System tracking service - thinking their locations will no longer be shared - were being tracked by Google nonetheless.
But, according to the company, the information was never actually used to determine an Android device's location and is completely unrelated to the location services in Android that user's can enable or disable. It's particularly easier to pinpoint a device's location in urban centers where cell towers are more concentrated.
Google said the data was "immediately discarded" and promised to update phones to prevent it happening in the future. That data is then sent back to Google, which may be an invasion of privacy, the report says.