Mock location has been a two-tap developer setting on Android since 2014. It still works. It also gets caught within seconds by most apps worth spoofing. For background, see our recent coverage.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The four signals that decide whether a spoof holds
Almost no serious app trusts GPS coordinates on their own. Android’s fused location provider blends satellite fixes with Wi-Fi scan results, Bluetooth beacons and cell tower identifiers, and any app receiving a location object can inspect whether that object arrived from a mock provider. Three more checks run server-side, in parallel: the IP address the request came from, the timezone the device reports, and the language headers the client sends.
A spoof fails when those four disagree with each other. Coordinates in Toronto, a device timezone of Europe/Madrid and an IP allocated to a Spanish residential ISP is not a location. It is a flag.
Google’s turndown of the SafetyNet Attestation API in January 2025 pushed developers onto the Play Integrity API, which reports whether a device passes hardware-backed integrity checks. A phone with Developer Options unlocked and a mock provider running fails a meaningful share of those checks on its own, before anyone looks at the coordinates.
Everything below assumes the goal is a consistent set of signals rather than one convincing fake coordinate.
Android still hands you the keys
Step 1. Install the mock provider first
Android will not populate the mock location dropdown until at least one installed app declares android.permission.ACCESS_MOCK_LOCATION in its manifest. Install the app before hunting for the setting, otherwise the menu appears empty and the usual conclusion is that the feature was removed.
Step 2. Unlock Developer Options
Settings, About phone, then tap Build number seven times. On Samsung and Xiaomi builds the entry sits under Software information.
Step 3. Select the mock location app
Developer options, then Select mock location app. One app at a time. Switching requires closing the previous one, and some apps hold the provider until force-stopped.
Step 4. Cut the scanning signals
This is the step most guides skip. Under Location, Location services, turn off Wi-Fi scanning, Bluetooth scanning and Google Location Accuracy. Left on, the fused provider keeps harvesting real Wi-Fi BSSIDs from the surrounding area, and those map to a physical address with roughly 20 metre accuracy in dense cities.
Step 5. Match timezone and locale by hand
Disable automatic date and time, then set the timezone for the target region. Change the system language region as well if the app serves market-specific content. Two minutes of work that removes the cheapest detection method in existence.
Where most of this falls apart
Step 6. Deal with the IP address
The device layer is the easy half. Every request still leaves the handset from an IP address, and commercial geolocation databases resolve that address to a city or a region with enough confidence that streaming platforms, betting operators and banks all rely on it. MaxMind GeoIP2 remains the most widely deployed of these. No amount of GPS mocking touches that layer.
Masking it means routing traffic through an endpoint in the target region, and the tooling for that is a crowded, uneven category. The 2016 CSIRO, UC Berkeley and UNSW analysis of 283 Android apps requesting VPN permissions found 38% flagged for malware by VirusTotal and 84% leaking IPv6 traffic outside the tunnel, which is a useful reminder that the category punishes casual selection. Gizmodo published a breakdown of what separates the usable options from the rest if the shortlist matters more than the mechanism.
Two failure modes survive even a correct setup: DNS queries resolving through a local resolver, and WebRTC exposing the real address from inside a browser session. Both are worth testing rather than assuming.
iOS does not offer the same door
Step 7. Turn on Developer Mode
Introduced with iOS 16 and still required in 2026. Settings, Privacy & Security, Developer Mode, then restart. The toggle only appears after a development tool has attempted to connect at least once.
Step 8. Feed Xcode a GPX file
Connect the iPhone to a Mac running Xcode, create an empty project, then use Debug, Simulate Location. A custom .gpx file with a single waypoint holds a static position. Multiple waypoints produce movement, which matters because a coordinate that never drifts by a metre is itself suspicious.
Step 9. Accept the limits
The simulated fix ends when the cable comes out. iOS also keeps Significant Locations history and syncs location to Find My independently of what Xcode reports, so the spoof covers the app in front of you and nothing else.
Desktop utilities that promise the same result without Xcode exist, and most of them do exactly what Xcode does through the same developer interface, with a subscription attached. The ones that ask to install a configuration profile or a helper daemon are asking for persistent system access to solve a problem that a free Apple toolchain already solves. That trade is rarely worth making.
Browsers are a separate fight
Step 10. Override geolocation at the browser layer
Chrome DevTools, Sensors panel, Location override handles the HTML5 Geolocation API. That API is one input among several. Sites routinely read Intl.DateTimeFormat().resolvedOptions().timeZone, compare it against the claimed position, and quietly discard the session when the two conflict.
Firefox exposes the equivalent control through geo.provider.network.url in about:config, which redirects the lookup to a JSON endpoint returning fixed coordinates. Useful for testing, awkward for daily use, and it does nothing for the timezone check. The DevTools override also resets on every browser restart, which catches people out more often than it should.
One detail worth carrying over from the mobile section: browser extensions marketed as location changers frequently request permission to read and modify data on every site visited. That is a wide grant for a narrow function.
Check the work before relying on it
Step 11. Verify each layer separately
Test the IP-derived city, the DNS resolver’s apparent country, WebRTC exposure, browser timezone and reported locale as five distinct results. A setup that passes four out of five is a setup that fails, because detection looks for contradiction rather than for any single wrong value.
What this looks like in two years
The direction of travel is attestation, not coordinates. Play Integrity already reports device state alongside the location payload, and the practical consequence is that the presence of Developer Options becomes evidence regardless of what the GPS says. Banking apps have enforced that logic for years. Ride-hailing and delivery platforms adopted it after driver-side fraud became a measurable cost line.
There is a second pressure worth watching. Dual-frequency GNSS receivers, standard on flagship handsets since roughly 2020, pick up the L5 civilian band alongside L1, and the raw measurement data those chipsets expose to Android gives developers a way to compare reported position against observable satellite geometry. Few apps do that today. The API has been sitting there since Android 7.
Which leaves an odd conclusion for anyone reading a step-by-step guide: the device-level techniques are the part with a visible expiry date, and the network layer is the part that keeps working precisely because it never touches the device at all.
Related articles
- How to Set Up MCP Servers: 13 Steps, 100 Min [2026]
- How to Apply Thermal Paste: 12 Steps, 45 Min [2026]
- Xbox Price Increase Hits $800 as Costs Head to 5x [2026]
- Tchap Breach Hits 73,467 French Government Accounts [2026]
