In contrast with iOS and Android, Microsoft says that its Windows Phone OS doesn't create any persistent on-phone record of where you've been. That's not to say that the company doesn't collect the information at all—but the large location caches found on handsets with competing operating systems aren't found on Microsoft-powered phones.
Windows Phone offers location-based services, and just as on the other platforms, these location-based services use a combination of WiFi positioning and GPS. Whenever the phone makes a location-based search, it sends the MAC addresses of visible WiFi access points, and if GPS is turned on, the GPS-acquired position and velocity. This information is persistently recorded for Microsoft's Orion positioning service. Since WiFi base stations don't generally move around much, and since MAC addresses are, at least in theory, globally unique, knowing the GPS co-ordinates of a WiFi base station allows the approximate location of any device within range of that base station to be rapidly acquired, without the battery drain of GPS. All three companies record this information to build ever larger—and ever more accurate—location databases.
Speaking to CNET, Microsoft also said that a unique, per-device ID was transmitted along with the requests. Though there are benign uses of such an ID—and in fact, services like "Find My Phone" depend on it—the risk is that it will be stored long-term, allowing both Microsoft and law-enforcement to track movements of Windows Phone users.
The company declined to comment on what the retention policy for this more personal information was, only that it was retained for a "limited period." Nor would the company disclose under exactly what circumstances it would hand the information over to law enforcement agents.
Somewhat surprisingly, Microsoft did not say whether cell tower data was sent or recorded. iOS and Android both cache cell tower positions, and Windows Phone uses cell tower positioning to augment the other positioning methods. To convert the data sent by the cell tower into useful GPS coordinates requires a database lookup, and that in turn means that the phones must be sending some cell tower information to Microsoft's services.
Update: Speaking to PCWorld, Microsoft has confirmed that its positioning database includes cell tower data, implicitly confirming that the phones do, of course, send cell tower IDs.
Microsoft did stress is that if location services are disabled on the phone, then any and all location information, including the device IDs, is no longer sent to the company. In that situation, the police would have to approach the mobile network operator if they want to find out where someone is—something they have no qualms about doing.
