I find it interesting that the `web history` link wanted me to re-authenticate, which I failed to do. (Specifically it wanted a 2FA token.)

This location history came up w/o even verifying my identity or asking for re-authentication. (I'm on a machine that has multiple Google profiles signed in.)

An adversary mining my location history for metadata is _much more worrisome_ than somebody finding out I listened to the whole `Kagerou Project` playlist on youtube for the third time.

I'm not upset that Google has this data; I do use Google Now which practically exists solely to extract metadata from my routine. I just can't believe its not behind a `re-authentication wall.`

Maybe that's because they're both behind different sub-domains and you did authenticate/use maps.google.com for other stuff more recently?

You can also disable both search history and location history through the google now app.

Location history is necessary for some Google Maps feature I don't remember. But for either of these services you can create a dummy account on your Android devices and just enable it per-device, and separately sync your main [real] account's mail, contacts, etc. Segregates privacy information so any exposure is limited to an individual device or profile.

I keep my Android tablet at home and so my location history is all screwed up. It thinks that I keep on jumping between my home and wherever I actual am.

That's fixable as well. You can turn off location reporting on your home device while still leaving location services active for things that need it.

Argh! I knew about the search history and had it turned off but I did not know about this location database. I recently got an Android phone and it must save your location history because it is showing all my travel for the period I've been using the phone. This is creepy as hell. This phone is going back.

Just remember that your phone provider is doing the same, even if you use a dumbphone. You just can't see it.

Android must have warned you before turning on Location services. Anyway, you can turn this off in the settings.

It absolutely does. Not only when you initially setup the device, but the first time you launch the G+ app (if you do that), too.

I doubt Google wrote special code especially for you. It has _always_ been opt in.

You can disable the location tracking on your phone. I would try that before you return it. You can forbid Google from collecting location data and still be able to use location functionality on the phone (like for navigation).

Sorry, but your threat modelling is all wrong here.

the phone company can to some extent track your location as well based on the cell tower

The phone companies sell this data[1], and it can be obtained in civil court cases[2] and it is usually pretty accurate[3].

convenient as the GPS data

Convenient for whom? You can't ever see it, but the network operator and its clients can see it very easily.

Contrast that to Google Location Services, where you have an interface to remove parts of your history and/or you can turn it off completely.

Plus it is used to give you useful stuff like Google Now travel time notifications for places you regularly travel to.

[1] eg: http://www.mobilephonelocate.com/cell-phone-tracking.html

[2] http://www.iiiweb.net/forensic-services/cell-phone-tower-tri...

[3] http://en.wikipedia.org/wiki/Mobile_phone_tracking#Network-b...

It's not Android; it's the services. This happens on iPhone's too.

Or you could install one of the versions of Android that have no connection to Google.