It is not too far a stretch to call all Google apps spyware.
Google has been busted several times for disregarding the user's personal settings about tracking everything, including location.
Making sure that the device's location services are off- all of them- and then ensuring that they stay that way after any restart/reboot is most important.
Using 3rd party apps that are FOSS is also important. These apps usually have no interest in finding you, ie. if they know then it is because you told them. Often these apps don't care, they need the info to provide service- like GPS, maps, local attractions, etc.
There are many ways that your location is being tracked by your phone.
Accuracy varies by method, but if you are using cell service they know what tower you are connected to.
With Wi-Fi, the system you are using is visable. The IP address shows an approximate location, they know what internet service is being used (who knows what you are doing on line), and your browser gives out info like your device, OS, and other identifiers that can be used to show that you made a specific search from here using this device.
VPN services, TOR, and such things can help- but where there is a will, there is a way- and you can be located.
Modern cellphones even have an 'emergency location' feature for in case you call 911 and get disconnected they can track the device.
This can be turned off, but these settings are buried and hard to find.
And some devices reset all these when they get restarted or rebooted.
So yes, you are basically walking around with a tracking device that stores and records your position and travels.
And you are doing this willingly, and paying for it with your money.
It's all right there in that TL/DR agreement that we all agree to because we want the convenience of these phones.
So turn off device location, go into your app settings and disable location permissions from apps, double check your location, sharing, and other similar settngs inside Google.
Be careful disabling location permissions from system apps, as you can make your phone not work properly anymore.
Of course, these apps that must have location permission on in order for your phone to work are known by- if not made by- Google themselves.
So they could use these apps to get the information that they want anyway.
Even GBoard, the Google keyboard, keeps what you type, and sends it off to be stored and analysed.
You can restricf internet access to apps like this by using a firewall, but that firewall must run all the time, constantly.
It must restart itself when you turn the phone off and back on again.
I use a firewall, one that I have used for a long while.
Usually it is very reliable.
But just last night, I noticed that the icon was off in the status bar.
WTH, I thought as I opened the app and restarted it.
I have no idea how long it was off or how much info got sent to who or to who knows where.