Quick answer

Secretly placing or using a GPS tracker to monitor another person can lead to legal action in the Philippines, but there is no single offense called “illegal GPS tracking.” Liability depends on the relationship between the parties, how the device or account was accessed, why the location was collected, and whether the conduct involved harassment, threats, control, sexual or gender-based abuse, trespass, or disclosure of location data.

The strongest remedies commonly arise when:

A current or former husband, boyfriend, dating partner, or person with whom a woman has a common child uses tracking to frighten, control, follow, or harass her.
Tracking forms part of gender-based online sexual harassment or cyberstalking.
The tracker relies on unauthorized access to a phone, online account, vehicle system, or other computer system.
A company, employer, investigator, transport operator, or other organization processes identifiable location data without a lawful basis or beyond a legitimate and proportionate purpose.
The conduct includes threats, coercion, trespass, property damage, publication of private information, or other independently punishable acts.

A tracker alert or discovered device is not, by itself, conclusive proof of who installed it or committed a crime. Preserve the evidence and let law-enforcement officers, a qualified technician, or a digital-forensics examiner document and examine it.

If you believe someone is following you now, knows your real-time location, has threatened you, or may become violent, go to a secure public place or police station and call 911. Do not confront the suspected person alone.

Why GPS tracking can be unlawful

GPS tracking ordinarily involves the collection, recording, retrieval, or use of a person’s movements. A location history that identifies or can reasonably identify an individual may constitute personal information. The legal issue is not merely who owns the tracker, phone, or vehicle. Courts and investigators may also consider consent, account access, the parties’ relationship, the purpose and duration of surveillance, where the device was installed, how the information was used, and the harm or fear caused.

Consent to one form of location sharing is not necessarily consent to every use. Permission given for a delivery, company vehicle, family-safety feature, or shared-device function does not automatically authorize covert, indefinite, or abusive monitoring. Consent may also be withdrawn, subject to lawful contractual, employment, parental, or other grounds for processing.

Conversely, not every GPS use is illegal. Examples that may be lawful, depending on the facts, include transparent fleet management, location processing necessary to provide a requested service, tracking based on valid consent, and surveillance authorized by law or a court. Even then, collection should remain necessary, relevant, secure, and proportionate to its stated purpose.

Laws that may apply

Violence against women and their children

The clearest express treatment of surveillance-based stalking appears in the Anti-Violence Against Women and Their Children Act, Republic Act No. 9262.

R.A. 9262 defines stalking as knowingly and intentionally following a woman or her child, or placing either of them under direct or indirect surveillance, without lawful justification. It also covers conduct that alarms or causes substantial emotional or psychological distress, including stalking, following, entering property against the victim’s will, and other harassment.

This law is relationship-specific. It generally protects a woman or her child against violence committed by her husband or former husband, a person with whom she has or had a sexual or dating relationship, or a person with whom she has a common child. A casual acquaintance or ordinary business or social interaction is not automatically a “dating relationship.”

A covert tracker may therefore support an R.A. 9262 case when it is used by a covered person to monitor, intimidate, control, or harass the victim. For charges based on psychological violence, the prosecution must prove the required conduct and resulting emotional anguish or mental suffering; the device alone does not establish every element. The Supreme Court has emphasized that psychological violence is the means used, while emotional anguish or mental suffering is the harm that must be proved in prosecutions requiring that result.

Available protection orders include:

A barangay protection order (BPO), which is effective for 15 days but is limited by statute to acts of physical harm and threats of physical harm under Sections 5(a) and 5(b). GPS surveillance alone may therefore require a court order rather than a BPO.
A temporary protection order (TPO) issued by a court, generally on the filing date after an ex parte assessment, effective for 30 days.
A permanent protection order (PPO) issued after notice and hearing.

A TPO or PPO may direct the respondent to stop harassment or communication and to stay away from the victim’s home, workplace, school, or other specified places. A court application is treated as an application for both a TPO and PPO. It may be filed in the court with territorial jurisdiction over the petitioner’s residence, with the Family Court taking the case where one exists. Court and barangay personnel must assist with the application, and the Public Attorney’s Office may provide representation when the statutory requirements are met.

Safe Spaces Act and cyberstalking

The Safe Spaces Act, Republic Act No. 11313, expressly includes invasion of privacy through cyberstalking within gender-based online sexual harassment. The law covers specified acts using information and communications technology, including terrorizing or intimidating a victim through physical, psychological, or emotional threats, incessant messaging, certain unauthorized online disclosures, impersonation, and related gender-based conduct.

The word “cyberstalking” in the statute does not make every unwanted use of a GPS device an offense under R.A. 11313. The conduct must fit the law’s gender-based online sexual-harassment provisions and must involve information and communications technology. A purely physical tracker with no relevant online, sexual, sexist, misogynistic, homophobic, transphobic, or other gender-based context may need to be evaluated under different laws.

The PNP Anti-Cybercrime Group is primarily responsible for receiving complaints of gender-based online sexual harassment. PNP Women and Children’s Desks must also attend to complaints covered by the Act. A court may issue an appropriate restraining order directing the perpetrator to stay away from the victim or specified locations.

An action for an offense under Section 12 is imprescriptible under Section 36 of the Safe Spaces Act. That rule should not be assumed to apply to a different offense merely because GPS technology was involved.

Cybercrime Prevention Act

The Cybercrime Prevention Act, Republic Act No. 10175, does not create a general offense called cyberstalking. It becomes relevant when the tracking involves conduct the Act actually prohibits, such as:

Accessing a phone, cloud account, email account, vehicle system, tracking account, or other computer system without right.
Intercepting non-public computer-data transmissions without right.
Altering, damaging, deleting, or suppressing computer data.
Misusing another person’s identifying information.
Committing an offense under the Revised Penal Code or a special law through information and communications technology, when the legal requirements of Section 6 are met.

Merely using an ordinary GPS device does not automatically prove illegal access, interception, identity theft, or a Section 6 offense. Investigators must identify the particular prohibited act and establish each element.

Service-provider records can disappear under ordinary retention practices. Under R.A. 10175, law enforcement may require preservation of specified computer data and may seek the necessary cybercrime warrants for disclosure, search, seizure, or examination. Victims should report promptly instead of attempting to obtain another person’s private account records themselves.

Data Privacy Act

The Data Privacy Act, Republic Act No. 10173, may apply when identifiable location data is collected or used by an employer, company, transport service, security agency, investigator, condominium, school, application provider, or other personal-information controller.

Processing must have a lawful basis and comply with transparency, legitimate-purpose, and proportionality requirements. Relevant questions include:

Was the person properly informed of the tracking?
Was consent obtained where consent was the asserted legal basis?
Was the tracking genuinely necessary for a contract, legal obligation, vital interest, public function, or legitimate interest recognized by law?
Could the purpose have been achieved through a less intrusive method?
Was monitoring limited to the necessary persons, vehicles, places, and times?
Were location records secured, retained only as necessary, and disclosed only to authorized recipients?

The DPA has an important limitation: its definition of a personal-information controller excludes an individual processing information in connection with that individual’s personal, family, or household affairs. A private dispute between individuals may therefore fall outside the DPA, depending on the nature and scope of the processing. That exclusion does not legalize stalking, threats, abuse, trespass, or other violations under different laws.

Where the DPA applies, a data subject may object, request access to relevant personal data, seek correction or blocking where legally justified, and complain to the National Privacy Commission (NPC). The DPA Implementing Rules explain the applicable principles and rights.

Before filing an ordinary NPC complaint, the complainant generally must notify the respondent in writing and allow the respondent to act. If there is no response within 15 calendar days, or the response is not timely or appropriate, the complainant may proceed and attach proof of the prior notice. The NPC rules contain exceptions and allow waiver in specified circumstances, including when resort to the respondent would be futile or the challenged action is patently illegal. Follow the NPC’s current complaint mechanics and submit supporting documents and affidavits.

Do not send a warning to a dangerous stalker merely to satisfy an administrative step. Explain the safety risk to the NPC or obtain legal advice about an applicable exception.

Other criminal and civil remedies

Depending on what occurred, prosecutors may also evaluate offenses under the Revised Penal Code, including grave threats, grave coercion, unjust vexation, trespass, malicious mischief, or other property-related offenses. These are fact-specific. For example, threats or intimidation may be essential to coercion, while entry into private property and damage caused during installation raise separate issues.

Articles 19, 20, 21, and 26 of the Civil Code may support damages, an injunction, or other relief for abusive conduct, unlawful injury, or interference with privacy and private life even when the facts do not establish a particular crime. Civil liability still requires competent proof of the wrongful act, resulting injury, causation, and any other elements of the chosen claim.

In an exceptional case, a lawyer may assess a petition for a writ of habeas data. The remedy can reach unlawful gathering, collection, or storage of information by a public official, private individual, or entity, but the Supreme Court requires a concrete connection between informational privacy and a threatened or violated right to life, liberty, or security. It is not a substitute for every privacy complaint. See the Supreme Court’s discussion in Gamboa v. Chan.

What to do after discovering a tracker

1. Deal with immediate safety first

If you may be in danger:

Do not go directly home if doing so could reveal a safe address.
Proceed to a police station, guarded establishment, or another secure public place.
Call 911 and tell the responder that an unknown tracker may be transmitting your live location.
Inform trusted persons using a device or account the suspected stalker cannot access.
Ask the nearest police station for the Women and Children Protection Desk when the case involves a woman, child, intimate partner, or gender-based harassment.
Avoid confronting or arranging to meet the suspected person.

Removing or disabling the tracker may alert its user. Leaving it active may expose your movements. Police should help assess that safety tradeoff.

2. Document the device before it is moved

When safe, record:

Wide photographs showing exactly where the device was found.
Close photographs of the device, attachment method, damage, serial number, QR code, SIM information, and visible markings.
The date, time, location, vehicle or object involved, and names of everyone present.
The alert or notification that led to discovery.
Who had access to the vehicle, bag, phone, premises, keys, or accounts.
Any recent servicing, borrowing, towing, parking, or repair history.

Do not dismantle, reset, pair, charge, log into, or probe the device unless instructed by investigators. Such steps may alter data or raise questions about authenticity and chain of custody.

3. Preserve related digital evidence

Keep original copies of:

Tracker alerts and maps.
Screenshots that show the full screen, date, time, username, URL, and account name where available.
Emails, messages, threats, admissions, and references to places you visited.
Sign-in alerts, account-access history, device lists, password-change notices, and location-sharing settings.
Dashcam, doorbell, parking, toll, building-access, repair-shop, and CCTV records.
Call logs and voicemails.
A chronological incident log describing sightings, communications, unexpected appearances, fear, disruption, and safety measures taken.

Export original files when the platform permits. Preserve metadata and keep an untouched copy. Back up evidence to a secure account unknown to the suspected stalker. Avoid editing, cropping, annotating, or repeatedly forwarding the only copy.

Ask businesses or property administrators promptly to preserve CCTV or access records. They may not be able to release footage directly because of privacy rules, but law enforcement or a court can pursue lawful disclosure.

4. Secure accounts and devices safely

From a trusted device:

Change passwords for email, Apple, Google, social-media, vehicle, telco, and location-sharing accounts.
Use unique passwords and enable multi-factor authentication.
Review signed-in devices, recovery addresses, trusted telephone numbers, family-sharing groups, shared calendars, and location permissions.
Remove unknown sessions or devices only after documenting them.
Ask your mobile provider about unauthorized SIM replacement or account changes.
Consider a professional device check if spyware, account compromise, or physical access is suspected.

Changing access may notify the stalker or escalate the situation. If intimate-partner violence is possible, coordinate the timing with police, a lawyer, or a victim advocate.

5. Make a formal report

Bring identification, the device if safely recovered, photographs, your incident timeline, original messages, witness details, and proof of account activity.

Possible reporting points include:

The nearest PNP station.
The PNP Women and Children Protection Desk.
The PNP Anti-Cybercrime Group for online harassment, compromised accounts, or other cybercrime elements.
The NBI Cybercrime Division or the NBI’s online complaint page.
The National Privacy Commission when an organization or other covered controller unlawfully processed location data.
The prosecutor’s office, ordinarily with assistance in preparing a complaint-affidavit and supporting affidavits.

Request a copy of the blotter entry, complaint, acknowledgment, or reference number. A barangay blotter can document an incident but does not replace a police investigation, prosecutor’s complaint, or court protection order.

6. Ask specifically about protection

If R.A. 9262 applies, ask about a TPO or PPO and describe the tracking, threats, relationship, prior incidents, access to weapons, knowledge of your routine, and risks to children. Request terms addressing direct and indirect contact, surveillance, proximity to your home or workplace, and location-enabled accounts where appropriate.

For a Safe Spaces Act case, ask whether a restraining order under Section 27 is suitable. In other cases, a lawyer can assess an injunction, damages action, habeas data petition, or another available remedy.

Evidence that often matters most

A useful case file connects the device to the suspect and the suspect to the unlawful purpose. Important evidence may include:

Purchase, registration, subscription, SIM, or billing records.
Account records identifying who activated or viewed the tracker.
Fingerprints, DNA, or physical characteristics of installation, where forensic examination is feasible.
CCTV showing installation or repeated physical following.
Messages admitting surveillance or revealing knowledge obtainable only through tracking.
Proof of unauthorized account access.
Witnesses who saw the installation or heard admissions.
A consistent history of threats, coercive control, following, or unwanted appearances.
Medical, counseling, workplace, school, or relocation records showing the effects of the conduct when emotional harm or damages are relevant.

Some of these records require consent, lawful process, or a court warrant. Do not impersonate the suspect, access the suspect’s account, or guess passwords to obtain them.

Common mistakes to avoid

Assuming that every unwanted tracker automatically proves “cyberstalking” under the Safe Spaces Act.
Publicly naming the suspected installer before identity and evidence are verified.
Destroying, resetting, or discarding the tracker.
Confronting the suspected stalker alone.
Using the tracker to conduct your own counter-surveillance.
Entering another person’s account or device without permission.
Posting serial numbers, home addresses, live locations, children’s routines, or investigative details online.
Relying only on screenshots when original files or platform exports are available.
Waiting until CCTV, account logs, or service-provider data are deleted.
Treating a barangay settlement as the only option in a dangerous case. Barangay conciliation requirements have statutory exceptions, and protection-order proceedings under R.A. 9262 are not matters that officials should pressure parties to compromise.
Assuming ownership of a car, phone plan, or family account conclusively settles whether surveillance was lawful.

When legal help is urgent

Seek immediate assistance from police and a Philippine lawyer when:

The tracker appears to transmit your location in real time.
The suspected person has threatened violence, owns or carries weapons, or has assaulted you before.
Children, elderly persons, or persons with disabilities are being tracked.
The suspect is a current or former intimate partner who controls money, transport, communications, or housing.
The person repeatedly appears at private or unpredictable locations.
Your phone, email, cloud account, vehicle account, or SIM may be compromised.
Evidence is held by a platform or provider and may require urgent preservation or a warrant.
The tracking involves an employer, school, government office, security agency, or large collection of location records.
You need a TPO, PPO, restraining order, injunction, or habeas data remedy.
Police decline to record the complaint despite a continuing safety threat.

The Public Attorney’s Office may assist qualified indigent clients. Under R.A. 9262, the court may direct PAO representation for a protection-order applicant who lacks economic means, including a victim deprived of access to family or conjugal resources.

FAQ

Is it automatically illegal to put a GPS tracker on someone else’s car?

No automatic rule covers every situation. Lack of consent is highly relevant, but investigators must consider ownership, authority to access the vehicle, purpose, relationship, method of installation, data use, and accompanying harassment or threats. Co-ownership does not necessarily authorize abusive surveillance of another person.

Can a spouse track the other spouse without permission?

Marriage does not create an unlimited right to covertly monitor a spouse. Tracking used to frighten, control, follow, or cause substantial emotional or psychological distress may fall under R.A. 9262, depending on the evidence and statutory elements.

Does the Data Privacy Act always apply to a private stalker?

No. An individual processing information in connection with personal, family, or household affairs is excluded from the Act’s definition of a personal-information controller. The scope of that exclusion is fact-dependent, and other criminal, protective, and civil laws may still apply.

Should I remove the tracker immediately?

Safety comes first. If the device could reveal your location, contact police from a safe place. Photograph it in position before removal when that can be done safely. Let police or a qualified technician remove and preserve it if possible. Do not keep driving to sensitive locations with an active tracker.

Can the tracker company identify the owner for me?

A provider may decline to disclose subscriber or account data directly because the information belongs to another user. Police can request preservation and seek lawful disclosure or a cybercrime warrant when the legal requirements are met.

Can screenshots be used as evidence?

They can help, but authenticity and completeness matter. Preserve original messages, files, URLs, timestamps, metadata, device alerts, exports, and the device itself. Electronic evidence must still satisfy applicable rules on relevance, authenticity, and admissibility.

Can I obtain a protection order even before a criminal conviction?

Yes, where the governing law applies. Under R.A. 9262, a court may issue a TPO after an ex parte assessment and a PPO after notice and hearing. The Safe Spaces Act also allows a court to issue an appropriate stay-away order before final decision.

What if I do not know who installed the device?

Report the facts without guessing. Preserve the tracker, photographs, serial information, CCTV, access history, and account alerts. Investigators may use purchase records, subscriptions, digital-forensic results, witnesses, and lawful requests to identify the user.

What if the tracker was installed by my employer?

Request the employer’s privacy notice, policy, stated purpose, lawful basis, tracking schedule, recipients, retention period, and procedure for exercising data-subject rights. Secret or excessive off-duty tracking may raise labor, privacy, contractual, or civil issues. Report an unresolved covered privacy violation to the NPC after following its complaint rules, unless an exception to prior notice applies.

Is there a deadline for taking action?

Deadlines depend on the particular criminal, civil, administrative, or protective remedy. Section 12 offenses under the Safe Spaces Act are expressly imprescriptible, but other offenses and civil claims have different periods. Evidence may disappear much sooner than a legal claim expires, so obtain case-specific advice and request preservation promptly.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. GPS-tracking cases turn on the parties’ relationship, device and account records, consent, purpose, accompanying conduct, and admissible evidence. Consult a Philippine lawyer or the proper authorities about your circumstances. Laws, procedures, and official guidance were checked as of 5 September 2026.