Location Services

Location Services capabilities allow service providers to retrieve the geographical position of a mobile device using network-level information. Unlike GPS-based location, which requires application-level access and can be spoofed, operator-provided location is derived from network infrastructure and is typically harder to spoof, reflecting the device’s location as observed by the operator within its coverage area.

These capabilities are part of the CAMARA standard and require explicit user authorization before any location data is shared.

Location Retrieval

What it does: Provides the geographical area where a device is currently located, either as a circle (coordinates and radius) or as a polygon (closed shape defined by coordinate points).

When a service provider requests location retrieval, the operator determines the device’s position based on network signals and returns an area that represents the device’s location. The shape and precision of this area depend on network conditions, cell tower density, and the accuracy capabilities available at that moment.

The service provider can optionally specify constraints:

• Maximum age (maxAge): How fresh the location must be (e.g., “no older than 600 seconds”)
• Maximum surface (maxSurface): The largest acceptable area size (e.g., “no larger than 1,000,000 square meters”)

If the operator cannot meet these constraints, the API returns an error indicating which requirement could not be satisfied.

Who benefits:

• Financial services: Fraud prevention by verifying that a user is located in a region authorized for transactions
• Content delivery platforms: Ensuring GPS coordinates reported by an app are accurate and have not been faked to bypass regional restrictions
• Advertising networks: Contextual targeting by confirming a device is within a specific area of interest before serving location-based ads
• Mobility services: Vehicle and bike rental platforms retrieving the actual location of a device to verify it is in the expected location at the start or end of a rental
• Delivery and logistics: Confirming driver location for route optimization and real-time tracking

Why it matters:

GPS coordinates can be falsified by the user through device settings, mock location apps, or GPS spoofing tools. Because location retrieval is provided by the operator based on network infrastructure, it is generally harder for the device owner to manipulate. This makes it a more reliable signal for security, compliance, and business logic decisions.

Additionally, many devices and applications do not have constant GPS access or permission. Location retrieval offers a network-level alternative that does not depend on the device exposing its GPS sensor to the application layer.

Response formats

Location is returned in one of two geometrical formats:

Circle:

• Center defined by latitude and longitude (WGS84 decimal degrees)
• Radius in meters indicating the area’s size
• Surface area calculated as π × radius²

Polygon:

• Closed shape defined by an ordered array of coordinate points
• Each point represented as latitude and longitude
• The last point implicitly connects back to the first point
• Surface area calculated based on the polygon’s boundary

The format returned depends on the network’s ability to determine location shape. Service providers must be prepared to handle either format.

Freshness and accuracy controls

Maximum Age (maxAge):

• Absence of maxAge means the service provider accepts location data of any age. The response will include lastLocationTime to indicate when the device was last located.
• maxAge=0 means a fresh, real-time calculation is required. If the operator cannot provide a fresh location, the API returns error 422 LOCATION_RETRIEVAL.UNABLE_TO_FULFILL_MAX_AGE.
• If the operator has no location data at all, the API returns error 422 LOCATION_RETRIEVAL.UNABLE_TO_LOCATE.

Maximum Surface (maxSurface):

• Absence of maxSurface means the service provider accepts any area size.
• If the operator cannot provide an area smaller than the requested maxSurface, the API returns error 422 LOCATION_RETRIEVAL.UNABLE_TO_FULFILL_MAX_SURFACE.
• Some implementations define a minimum acceptable maxSurface (e.g., 10,000 square meters) to prevent requests for impractically precise locations.

If both maxAge and maxSurface constraints fail, the operator returns one of the two error codes based on which constraint was evaluated first.

Multi-SIM scenarios

In cases where a phone number is associated with multiple physical devices (e.g., a smartphone with a paired smartwatch), the API behavior depends on the operator’s implementation:

• Single device response: If one device is considered the primary SIM holder, the operator may return the location of that device only.
• Combined location: The operator may return a location area that encompasses all devices associated with the phone number.
• Error response: The operator may reject the request with an error indicating that multi-SIM scenarios are not supported for this API.

Service providers should check with the operator to understand the expected behavior. To make location retrieval more deterministic in multi-SIM scenarios, service providers can:

• Use the authorization code flow (three-legged token) to automatically identify the intended device
• Identify the device by unique attributes such as IP address and port
• Use a secondary phone number if one is associated with the specific device

Privacy and consent

Before using Location Retrieval, service providers must ensure:

• The user has been informed of the purpose for which their location will be accessed
• The user has explicitly consented to location access for that purpose
• The consent scope matches the API operation being invoked
• The processing complies with applicable data protection regulations (e.g., GDPR, CCPA)

Open Gateway enforces consent at the platform level. If a user has not consented or has revoked consent, location retrieval requests will fail with an authorization error, regardless of whether the service provider holds a valid access token.

Use cases