[kotajacob]

Sorry if this is a stupid question, but do we know if this location was collected by the operating system of the mobile devices? Or was it being collected simply by data from carriers? Also since this was just an API vulnerability would I be correct to assume it's still being exploited by this companies customers?

[kevcampb]

The information is likely to be provided by an API from AT&T and others, which is obtained from cell towers.

[kotajacob]

Makes sense... Thanks. There should be a law...

[nneonneo]

Almost certainly obtained from the carriers.