Wi-Fi Only vs Cellular Tablet: Always-On Internet and Security

A tablet with a SIM or eSIM (a "cellular" or "Wi-Fi + Cellular" model) stays connected to the internet wherever it has mobile signal and an active data plan, while a Wi-Fi only tablet is online only when it can join a Wi-Fi network or a hotspot. That always-on link is the cellular tablet's main security benefit: lost device tracking, remote lock and erase, and management check-ins keep working away from home. It also adds a phone number style attack surface (the carrier account, SIM swaps and cellular downgrade tricks) that a Wi-Fi only tablet simply does not have.

This guide covers GPS, battery, public Wi-Fi, 2G downgrades and eSIM risks, then which to buy for children, travellers, field teams and executives.

Key takeaways

• "Always connected" means "wherever there is coverage and a plan." Airplane mode, no signal, data switched off or a flat battery take a cellular tablet offline too.
• Lost device features need a connection. A remote erase only happens when the device receives the command, so a tablet that reaches a network on its own is easier to recover or wipe.
• GPS is not guaranteed on Wi-Fi only tablets. Apple lists GPS/GNSS only on Wi-Fi + Cellular models of the current iPad Air and iPad (A16); Samsung lists GPS and other GNSS systems on the Galaxy Tab S10 FE Wi-Fi model. Check the exact model.
• Cellular is not automatically safer than Wi-Fi. Treat both links as hostile. 2G lacks mutual authentication, which is why Android added a 2G switch and Apple's Lockdown Mode turns off 2G and 3G.
• A cellular plan adds a carrier account to protect. Set a carrier PIN and the free SIM change lock the FCC's November 2023 rules require carriers to offer.
• Phone hotspot tethering is a fair middle path, and the battery cost of cellular is small: Apple rates current iPads at up to 10 hours of browsing on Wi-Fi and 9 on cellular.

Wi-Fi only vs cellular tablets at a glance

Vendor facts below come from the vendor pages in the sources.

Does a cellular tablet really stay connected all the time?

Mostly, but "all the time" needs four conditions. The tablet must be powered on, it must have an active data plan, it must be in an area with coverage, and cellular data must be switched on (not in airplane mode, not disabled in Settings). Remove any one and it behaves exactly like a Wi-Fi only tablet that is out of range.

When those conditions hold, a cellular tablet keeps a background connection to its vendor's services, as a phone does. On Apple devices that channel is the Apple Push Notification service (APNs), which Apple's deployment guide says maintains "persistent communication with Apple devices" and carries word of updates, management policies and messages. Devices reach APNs over TCP port 5223, falling back to 443. On a cellular tablet that channel survives leaving the building; on a Wi-Fi only tablet it lasts as long as the Wi-Fi does. The question is what you lose during the offline hours.

What always-on means for lost device location

Apple Find My. Apple's support page explains what you see for a device that cannot report its location right now. If a device cannot show its current location, for example because the battery is dead, Find My shows its last known location for up to seven days. After seven days without an update, it shows "No location found." With Send Last Location turned on, the device tries to upload its location just before the battery runs out, and iCloud.com shows that location for up to 24 hours.

Apple also describes the Find My network: more than a billion Apple devices that use Bluetooth to detect nearby devices and report their approximate location to the owner, anonymously and encrypted. So a Wi-Fi only iPad is not invisible the moment it leaves Wi-Fi, but crowdsourced location depends on other Apple devices passing nearby.

Google Find Hub. Google's Android help now uses the name Find Hub. You need a signed in Google Account, "Use location" on and "Allow device to be located" enabled; to lock or erase remotely, Google says you must turn on 2-Step Verification. For an offline device, Find Hub shows where it was when last online. Google also documents offline finding (Off, Without network, With network in busy places only, With network everywhere); on supported devices such as the Pixel 8 series, the network can locate a device for a few hours after it powers off if Bluetooth and Location were on.

In practice, a cellular tablet left in a taxi keeps reporting a live location while its battery lasts. A Wi-Fi only tablet reports its last Wi-Fi location, then relies on crowdsourced finding. For a child's tablet at home that barely matters; for a field worker's tablet full of customer records it matters a great deal.

What always-on means for remote lock and erase

A remote erase is a command sent from a server to the device. The device has to receive the command before it can act on it. Neither Apple's nor Google's support page promises that an erase completes on a device that never reconnects, so assume it does not.

A cellular tablet in coverage receives the erase within moments. A Wi-Fi only tablet receives it only when someone connects it to a network, and a thief who wants the data can keep it offline indefinitely. Apple adds that erasing from the Find My app requires two-factor authentication, and that an erased device running iPadOS 15 or later can still be found. Erase is final, so lock first if recovery is realistic.

The real defence for a device that never reconnects is a strong passcode, the encryption it unlocks and a short auto-lock time. Remote erase is the second line.

What always-on means for updates

Here the always-on advantage is smaller than people expect. Apple's update guide says that with Automatically Install turned on, an available update downloads and installs overnight while the device charges on Wi-Fi. For manual updates, Apple's page tells you to plug in and connect to Wi-Fi. Apple's page does not describe installing iPadOS updates over cellular data, so do not count on a cellular iPad patching itself while it never touches Wi-Fi.

The rule for any tablet: let it see trusted Wi-Fi and a charger regularly. CISA's mobile guidance says to enable automatic updates and check weekly that devices are up to date, SIM or no SIM.

What always-on means for MDM check-ins

Mobile device management (MDM) works through the vendor's push channel (APNs on Apple devices): the device learns that commands are waiting, then fetches them. If it cannot reach the push service, nothing arrives. For an organisation this is the strongest argument for cellular: a new profile, lost mode or a wipe reaches a field tablet the same day, not when the van returns to the depot. NIST SP 800-124 Revision 2 (May 2023) treats centralised management as a core control across the device lifecycle; management can only enforce what it can reach.

Does a Wi-Fi only tablet have GPS?

Sometimes. This is vendor and model specific, and it is the most common surprise after purchase.

Apple. On Apple's spec page for the iPad Air (M4), the Location section lists digital compass, Wi-Fi and iBeacon microlocation for both models, and lists GPS/GNSS and cellular location for Wi-Fi + Cellular models only. Apple's spec page for the iPad 11-inch (A16) shows the same split. So a current Wi-Fi only iPad estimates its position from nearby Wi-Fi networks. That works in towns and indoors, but not on a hike, at sea or in a car between towns, unless the iPad is tethered to a device that supplies location.

Samsung. Samsung's Hong Kong product page for the Galaxy Tab S10 FE (Wi-Fi), model SM-X520, lists its location technology as "GPS, Glonass, Beidou, Galileo, QZSS", with no cellular network or SIM listed. So at least some Wi-Fi only Android tablets do include satellite positioning.

What to do. Do not rely on a reseller listing or a model family name. Open the vendor's own spec page for the exact model and region, and look for GPS, GNSS, Glonass, Galileo or Beidou under Location. If you need offline navigation or precise location logging for field work, and the Wi-Fi model lacks GNSS, that alone can decide the purchase.

The privacy flip side: precise location is what you want for a stolen device and not what you want from an over-permissioned app. CISA tells iPhone and Android users to revoke location, camera and microphone access apps do not need.

Is cellular data safer than public Wi-Fi?

It is safer in some ways, weaker in others, and less important than most people think, because the protection that matters most sits above both links.

Start from the right assumption: every network is hostile

Google's Android security team put it plainly in its August 2023 post on Android 14 cellular security: the Android security model "assumes that all networks are hostile" and Android does not rely on link-layer encryption, expecting network traffic to be end to end encrypted instead. CISA's guidance for highly targeted people goes further and says they should assume that all communications between mobile devices and internet services are at risk of interception or manipulation.

Whether the first hop is a café router or a cell tower, your safety comes from HTTPS, end to end encrypted messaging and apps that validate certificates. The link type changes who sees metadata and how easy an attack is.

Public Wi-Fi in 2026

The US Federal Trade Commission now says that because most websites and apps encrypt data, public Wi-Fi "is usually safe". Its narrower warning: an encrypted fake website is still run by scammers.

The remaining Wi-Fi risks are practical ones:

• Lookalike networks. Anyone can name a hotspot after a hotel or airport; the name proves nothing.
• Captive portals. Hotel and airport sign-in pages are ordinary web pages on a network you do not control. Treat requests there for account passwords or app installs as suspect.
• Open networks. Others nearby can see unencrypted traffic and metadata such as which servers you contact.
• Weak or old security modes. Apple's recommended router settings say to use WPA3 Personal, or WPA2/WPA3 Transitional for older clients, and describe WEP, TKIP, WPA Personal and mixed WPA/WPA2 modes as no longer secure.

WPA3 improves the link itself. The Wi-Fi Alliance says WPA3-Personal gives "increased protections from password guessing attempts" and requires Protected Management Frames, and describes Wi-Fi Enhanced Open as "unauthenticated data encryption" for open networks: protection from passive eavesdroppers, but no proof you joined the network you meant to.

What the cellular link protects, and what it does not

NIST's Guide to LTE Security (SP 800-187, December 2017) explains that LTE provides mutual authentication between the SIM and the network, a real advantage over an open café network where nothing proves the access point is legitimate.

The weaknesses sit in backwards compatibility and in who controls the encryption:

• 2G has no mutual authentication. NIST notes that GSM lacks mutual authentication between handset and network and lacks strong algorithms with keys of sufficient length, and that there is no requirement that the 2G air interface be encrypted at all. It names A5/1 and A5/2 as broken 2G algorithms.
• Downgrades. A rogue base station transmitting at high power can push a nearby device off LTE onto GSM, according to NIST. Google's post adds that this downgrade can be triggered silently and happens regardless of whether the local operator has already switched off its own 2G network.
• The network chooses the cipher. Google explains that circuit switched voice calls and SMS are protected only by the cellular link layer cipher, "fully controlled by the network", with no visibility for the user. It cites reports of null ciphers (no encryption) being used in commercial networks, exposing voice and SMS traffic, including one-time passwords.
• Identifiers. NIST notes that the IMSI, the subscriber's permanent identity, is sometimes sent in clear text over the air, which lets a rogue base station operator check whether a particular subscriber is nearby. That is a tracking risk a Wi-Fi only tablet does not carry.

For a tablet, the voice and SMS points matter less than on a phone, but tracking and downgrades apply to any cellular radio.

IMSI catchers and the 2G downgrade, in plain terms

An IMSI catcher, or false base station, pretends to be a cell tower. Devices attach to the strongest tower for their preferred network, as NIST explains, so a nearby fake can attract them, collect identifiers and push them onto 2G, where the network never proves who it is. These tools mostly concern people who are specifically targeted: journalists, officials, executives, activists. For most families a lookalike Wi-Fi network is the likelier problem. If you are in a higher risk group, turn off 2G where you can.

Turning off 2G on Android tablets and phones

Google's 2023 post explains the history. Android 12 introduced a user setting to disable 2G at the modem level; the Pixel 6 was the first device to adopt it, and it works on Android devices that support Radio HAL 1.6 or later. It was designed so emergency calls still work. The EFF, which campaigned for the feature, reported in January 2022 that the switch is labelled "Allow 2G" under Settings, Network and internet, SIMs on Pixel phones; menu names vary by manufacturer and Android version.

Android 14 added, according to Google, a control for IT administrators to disable 2G across a managed fleet and a user option to disable null-ciphered connections at the modem level, again with emergency calls allowed. Availability of the null cipher option depends on the device's modem and radio software. The fleet control is covered in the enterprise section below.

Turning off 2G on iPad

Apple does not offer a standalone 2G switch. Its route is Lockdown Mode, an optional extreme protection mode available in iPadOS 16 or later. Apple's support page says that in Lockdown Mode "2G and 3G cellular support is turned off for iPhone and iPad", and that the device won't automatically join non-secure Wi-Fi networks and will disconnect from one it is already on. There is a trade-off for managed fleets: Apple says a device in Lockdown Mode cannot be enrolled in MDM, although a device enrolled before Lockdown Mode was turned on remains managed.

Lockdown Mode restricts many other features, so it suits people who may be targeted; CISA lists it first among its iPhone recommendations for highly targeted individuals.

Is a phone hotspot a good middle path?

For many people, yes. A Wi-Fi only tablet tethered to a phone gets mobile data without a second plan and without its own carrier account to protect.

How it works on each platform, from the vendors' own pages:

• Apple. Personal Hotspot uses the cellular data connection of an iPhone or a Wi-Fi + Cellular iPad to create a temporary Wi-Fi network. Instant Hotspot lets devices signed in to the same Apple Account, or in the same Family Sharing group, connect to each other's hotspot more quickly. Apple notes that the carrier must support Personal Hotspot, that extra fees may apply, and that how many devices can join depends on the carrier and iPhone model.
• Android. Google's help page covers Wi-Fi hotspot, Bluetooth tethering and USB tethering. A hotspot requires a password by default; you can set Security to "None", which you should not do. Google says some carriers limit tethering or charge extra, that you can share mobile data with up to 10 other devices over Wi-Fi, and that some phones can turn the hotspot off automatically when nothing is connected.

The trade-offs: a hotspot you control beats a stranger's Wi-Fi, provided you keep a long password and auto turn off. It does not fix lost device recovery, because the tablet is offline again once it leaves the phone. The phone's battery pays, every session starts with a manual step (field teams often stop bothering), and a Wi-Fi only iPad still has no GNSS receiver. USB tethering avoids broadcasting a network at all, though Google notes Macs cannot tether over USB with Android.

eSIM provisioning, SIM swaps and port-out risk

How tablets get a cellular plan now

Apple's spec pages state that the current iPad Air (M4) and iPad (A16) cellular models use eSIM and are not compatible with physical SIM cards, and that not all carriers support eSIM.

Apple's "Set up eSIM on iPad" page lists the activation routes:

1. Carrier activation. If the carrier supports it, a "Carrier Cellular Plan Ready to Be Installed" notification appears; tap it and continue.
2. QR code. Scan a code from the carrier with the Camera app and tap Add Cellular Plan, entering a confirmation code if asked.
3. Join iPhone Plan. In Settings, Cellular Data, tap Join iPhone Plan. Wi-Fi must be on and the iPad and iPhone must use the same Apple Account.
4. Transfer iPad Plan. Move a plan from another iPad from Settings, Cellular Data.
5. Travel. Roam with your carrier, or buy an eSIM from a local carrier that supports eSIM in the country you visit.

Apple says an iPad can hold eight or more eSIMs, so frequent travellers can keep a home plan and several local plans and switch between them.

What eSIM changes for security, and what it does not

eSIM helps against one thing: a thief cannot pop the card out to stop the tablet reporting its location. It does not help against SIM swap and port-out fraud, because those attacks target your carrier account, not the device. In a SIM swap, the FCC explains, a bad actor gets your carrier to move your number to a SIM they control; in a port-out, they open an account elsewhere and have your number transferred. Your texts and one-time codes then go to them. For a data only tablet line the direct damage is smaller, but if it shares an account with your phone, the account's protections are the phone's protections.

What the FCC rules and CISA advice say

In its Report and Order adopted on 15 November 2023 (FCC 23-95, WC Docket No. 21-341), the FCC revised its customer proprietary network information and number porting rules to:

• require wireless providers to use secure methods of authenticating a customer before redirecting a phone number to a new device or provider;
• require wireless providers to notify customers immediately of any SIM change request, before the change is carried out, and to notify them of port-out requests;
• require wireless providers to offer all customers, at no cost, the option to lock or freeze their account against SIM changes, with similar locks for port-outs.

How each carrier implements these, and in what menus, varies; check your own carrier's account settings.

CISA's mobile communications guidance (version 2.0, 24 November 2025) adds the user side:

• Set a telco PIN. Most providers let you add a PIN or passcode that is required for sensitive operations such as porting a number. CISA calls this a critical step against SIM swapping and says to add a PIN and MFA to the carrier account.
• Move away from SMS based MFA. CISA says not to use SMS as a second factor, because SMS messages are not encrypted and are not phishing resistant. It recommends FIDO based authentication, such as security keys or passkeys, and notes that enrolling in an authenticator app does not automatically remove SMS as a fallback, so you must disable SMS yourself.

Battery life and cost

Battery. A cellular modem uses power, more so in weak signal areas where it transmits harder. Apple publishes like for like figures: the iPad Air (M4) and the iPad (A16) are rated at up to 10 hours of web browsing or video on Wi-Fi and up to 9 hours of web browsing on a cellular data network. That is about a 10 percent difference in Apple's own test. You can turn cellular data off when you are on Wi-Fi all day, which makes a cellular tablet behave like a Wi-Fi one.

Cost. Cellular models cost more upfront (check the vendor's price list for your model and region) and need a plan: standalone, an add-on to a phone plan, a local travel eSIM, or none except on trips. Tethering costs nothing extra unless your carrier charges for it, which Apple and Google both say some do. For a business, weigh the line fee against a lost tablet that cannot be wiped.

Enterprise MDM, kiosk and dedicated device use

Knowledge workers sit near Wi-Fi most of the day, so a managed Wi-Fi only tablet plus phone tethering usually works; staff carrying sensitive data on the road are the exception. Fixed kiosks on a building network rarely need cellular. Mobile dedicated devices (a driver's tablet, a site inspector's, a pop-up check-in desk) usually do.

Kiosks and dedicated devices

On Android, single purpose devices use lock task mode, which the developer guide describes as "an immersive, kiosk-like fashion" where users "typically can't see notifications, access non-allowlisted apps, or return to the home screen". It works on Android 5.0 or later, only for apps the device policy controller allowlists, and unlike screen pinning the user cannot simply exit. Google's guide shows the allowlisting call:

// Run inside your device policy controller (DPC).
// Only allowlisted packages may enter lock task mode.
dpm.setLockTaskPackages(adminName, arrayOf("com.example.kiosk", "com.example.player"))

On Apple devices, single app operation is configured through device management; Apple's Platform Deployment guide documents an Autonomous Single App Mode payload and restrictions for supervised devices.

Fleet policy for the cellular radio

If your risk model includes targeted interception, block 2G centrally. The Android reference documents the DISALLOW_CELLULAR_2G user restriction, added in API level 34 (Android 14):

// Requires device owner, or profile owner of an organisation-owned
// managed profile acting on the parent profile. Applies device wide.
dpm.addUserRestriction(adminName, UserManager.DISALLOW_CELLULAR_2G)

Test it in the regions where your teams work: the reference warns devices lose cellular service where only 2G is available, though emergency calls still connect. For iPads the equivalent is Lockdown Mode, which blocks new MDM enrolment, so it suits individuals with specific threat models rather than whole fleets.

Checklist for buying a fleet

1. Decide where devices spend working hours: managed Wi-Fi, vehicles or on the move.
2. If location matters, confirm GNSS on the Wi-Fi model's spec page.
3. Confirm eSIM support with your carrier and how it fits your MDM workflow.
4. Put carrier account locks and port-out PINs in place before activating lines.
5. Set update deadlines in MDM and make sure devices see Wi-Fi and power weekly.
6. Decide 2G policy per region for Android, and who, if anyone, needs Lockdown Mode on iPad.
7. Write down who triggers lock and erase for a lost device, and test it once.

Step by step: harden a tablet on either kind of connection

These steps use settings the vendors document. Menu names vary between versions and manufacturers.

Any tablet

1. Set a strong passcode and short auto-lock. It protects a tablet that never reconnects.
2. Turn on automatic updates, and leave the tablet on Wi-Fi and a charger overnight now and then.
3. Turn on lost device features: Find My, the Find My network and Send Last Location on iPad; "Allow device to be located" and an offline finding setting in Find Hub on Android.
4. Turn on two-factor authentication for the Apple or Google Account. Google requires 2-Step Verification for remote lock and erase; Apple requires two-factor authentication to erase from the Find My app.
5. Review app permissions for location, camera and microphone.
6. Forget Wi-Fi networks you no longer use so the tablet does not auto-join a lookalike.

Cellular tablets

1. Set a carrier PIN and enable the carrier's SIM change and port-out locks.
2. Move important logins off SMS codes to passkeys or security keys.
3. On Android, turn off "Allow 2G" and, on Android 14 or later, null-ciphered connections if offered.
4. On iPad, consider Lockdown Mode if you may be targeted.

Wi-Fi only tablets

1. Use a phone hotspot rather than public Wi-Fi for anything sensitive.
2. Check whether your model has GNSS before relying on it for navigation.

Which should you buy? A decision table

Common mistakes

• Assuming a cellular tablet is always online. Airplane mode, data switched off, no plan, no signal or a flat battery all make it a Wi-Fi only tablet. Your lost device plan should cover that case.
• Buying a Wi-Fi only iPad for navigation. Apple lists GPS/GNSS only on Wi-Fi + Cellular models for the current iPad Air and iPad (A16). Check the spec page before you buy.
• Treating cellular as encrypted end to end. The network decides the cellular cipher, and 2G can be forced on a device. Rely on HTTPS and end to end encrypted apps on every link.
• Leaving SMS as the second factor. Even after you add an authenticator app, the SMS fallback stays enabled until you remove it, as CISA points out.
• Skipping the carrier PIN. A shared family account with no PIN or lock is the weakest point for every line on it, tablet included.
• Relying on remote erase alone. A device kept offline never receives the command. A strong passcode is what protects it.
• Assuming cellular means automatic updates. Apple's automatic install runs overnight on Wi-Fi while charging. A tablet that never sees Wi-Fi may sit unpatched.
• Turning off 2G fleet wide without testing. Devices lose service where only 2G exists, which may include rural routes.

Fix it without waiting for upstream

A tablet is mostly a consumer of software rather than something you build, but the apps your organisation ships to its tablet fleet, and the services those tablets talk to over Wi-Fi or cellular, are built from open source dependencies. When those dependencies carry known vulnerabilities, it does not matter how good the link encryption is, so keeping what you build and ship patched still matters here, even though the fit to tablet hardware itself is indirect.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Where Safeguard fits, honestly

Safeguard does not manage tablets, enforce 2G or Wi-Fi policy, locate lost devices, scan devices for malware or protect carrier accounts. Those jobs belong to the device vendor, your MDM and your carrier. The fit is on the software side. If your team builds the kiosk app, the field service app or the backend those tablets call, Safeguard scans those repositories and container images for vulnerable dependencies, shows which projects carry a given component and version, and can open fix pull requests (switched off by default). And because Safeguard's phone app can approve commands on a computer running the Safeguard CLI, a team lead on a cellular tablet or phone away from the office can still review and approve a fix as it runs, which is one practical reason the always-on link helps developers too.

FAQ

Does a cellular iPad stay connected to the internet all the time?

It stays connected wherever it has coverage, an active plan and cellular data turned on, much like a phone. In airplane mode, in a dead zone, with no plan or with a flat battery, it is offline like a Wi-Fi only iPad.

Does a Wi-Fi only iPad have GPS?

Not the current models Apple lists. Apple's spec pages for the iPad Air (M4) and iPad (A16) list GPS/GNSS only on Wi-Fi + Cellular models; Wi-Fi models use Wi-Fi based location, a digital compass and iBeacon microlocation.

Do Wi-Fi only Android tablets have GPS?

Some do. Samsung lists GPS, Glonass, Beidou, Galileo and QZSS for the Galaxy Tab S10 FE Wi-Fi model. Check the location section on the vendor's spec page for your exact model.

Can I find a lost Wi-Fi only tablet?

Often, yes. Apple and Google show the last known location, and both offer crowdsourced offline finding on supported devices if you turned it on. You will not get a live, precise location while it is away from Wi-Fi, which a cellular tablet can give.

Can I remotely wipe a tablet that is offline?

You can send the command, but the tablet must receive it to act on it. That needs a network connection, which a cellular tablet in coverage usually has and a Wi-Fi only tablet may not. A strong passcode protects the data in the meantime.

Is cellular data safer than public Wi-Fi?

Partly. LTE and later networks authenticate the network to the device, which an open Wi-Fi hotspot does not, but devices can be pushed down to weak 2G and the network controls the cellular cipher. Use HTTPS and end to end encrypted apps on both.

Should I turn off 2G on my tablet?

If your Android device has an "Allow 2G" switch and you do not depend on 2G coverage, turning it off removes a known downgrade route; emergency calls still work. On iPad, 2G and 3G are turned off only in Lockdown Mode, which suits people who may be targeted.

Is eSIM safer than a physical SIM?

Against theft, slightly: a thief cannot pull an eSIM out to stop the device connecting. Against SIM swap and port-out fraud, no, because those attacks target your carrier account. Set a carrier PIN and an account lock.

Does a cellular tablet use more battery?

Slightly. Apple rates the iPad Air (M4) and iPad (A16) at up to 10 hours of web browsing on Wi-Fi and up to 9 hours on cellular data. Weak signal areas cost more.

See how Safeguard would help

These demos show the software side, not tablet hardware or connectivity. To try them yourself, download Safeguard and follow the CLI docs.

The first demo is a real Android session. You send work to a computer running the Safeguard CLI and approve the command on the phone with Allow once, Allow for turn or Deny. It shows why an always-on mobile link is useful beyond lost device recovery: whoever owns the approval can respond from a phone, or the same way from a cellular tablet, while away from the desk.

Click through it at your own pace, or open it full screen.

The second demo is a real CLI session. You install the CLI, open the interactive terminal with safeguard, and ask it to "fix the lodash CVE in this repo"; it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same flow applies to the code behind a kiosk or field service app: the dependency gets fixed and tested before the next build reaches your tablet fleet.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apple: iPad Air technical specifications
• Apple: iPad 11-inch (A16) technical specifications
• Apple Support: Use Find My to locate your lost Apple device or AirTag
• Apple Support: Update your iPhone or iPad
• Apple Support: Set up eSIM on iPad
• Apple Support: Connect to the Personal Hotspot of an iPhone or iPad
• Apple Support: Recommended settings for Wi-Fi routers and access points
• Apple Support: About Lockdown Mode
• Apple Platform Deployment: Apple Push Notification service
• Apple Platform Deployment: Single App Mode and Autonomous Single App Mode
• Google Android Help: Find, lock or erase a lost Android device
• Google Android Help: Share a mobile connection by hotspot or tethering on Android
• Google Android Help: Connect to Wi-Fi networks on your Android device
• Google Online Security Blog: Android 14 introduces first-of-its-kind cellular connectivity security features (8 August 2023)
• Android Developers: UserManager reference (DISALLOW_CELLULAR_2G)
• Android Developers: Lock task mode
• Samsung Hong Kong: Galaxy Tab S10 FE (Wi-Fi) SM-X520 specifications
• FCC: Protecting Consumers from SIM Swap and Port-Out Fraud, Report and Order FCC 23-95
• CISA: Mobile Communications Best Practice Guidance
• CISA: Mobile Communications Best Practice Guidance, version 2.0 (PDF)
• NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise
• NIST SP 800-187: Guide to LTE Security
• Wi-Fi Alliance: Security
• FTC: Are public Wi-Fi networks safe? What you need to know
• EFF: Victory! Google releases "disable 2G" feature for new Android smartphones (12 January 2022)

Last reviewed: 23 October 2026.