mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service

mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service Phuc Dinh † , Yufei Feng † , Eduardo Baena † , Yunmeng Han § , Weiming Qi ¶ , Zihan Xu ‡ , Moinak Ghoshal†, Pau Closas†, Dimitrios Koutsonikolas†, Joerg Widmer † Northeastern University, ‡ Virginia Tech, § University of Cincinnati, ¶ Michigan State University, USA, IMDEA Networks, Spain Abstract Accurate localization in dense urban areas remains a significant challenge due to the limitations of Global Navigation Satellite Systems (GNSS) in environments with obstacles and reflections, such as urban canyons. While the most recent 3GPP standards offer sophisticated network-centric positioning techniques, their widespread deployment will take time and is hindered by high infrastructure costs and complexity. In this work, we present mm-NOLOC, a UEcentric localization system, designed as a practical fallback when GNSS fails to deliver high accuracy, that leverages the growing deployment of 5G mmWave infrastructure in dense urban areas. Unlike traditional approaches, mm-NOLOC operates independently of 3GPP location support and utilizes only standardized controlplane information collected solely on the UE side – Synchronization Signal Block (SSB) Indices that are mapped to 5G mmWave beam directions – to obtain robust position estimations. To address the uncertainty introduced by urban multipath, mm-NOLOC models the SSB-to-angle relationship as a discrete and multimodal distribution, based on empirical measurements in operational 5G mmWave networks, and uses a particle filter to refine position estimates by integrating probabilistic observations with UE-side motion dynamics. We validate mm-NOLOC through experiments over commercial 5G mmWave deployments, as well as trace-based simulations. Our results show that mm-NOLOC achieves a median localization error below 3 m and a 95th percentile error below 10 m, offering a practical fallback localization solution in urban canyon scenarios for 5G networks without network location support. CCS Concepts • Networks → Location based services. Keywords 5G, mmWave, localization, beam management ACM Reference Format: Phuc Dinh † , Yufei Feng † , Eduardo Baena † , Yunmeng Han § , Weiming Qi ¶ , Zihan Xu ‡ , Moinak Ghoshal † , Pau Closas † , Dimitrios Koutsonikolas † , Joerg Widmer . 2025. mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service. In The Twenty-sixth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing (MobiHoc ’25), October 27–30, 2025, Houston, TX, USA. ACM, New York, NY, USA, 10 pages. https://doi.org/10.1145/3704413.3764451 1 Introduction Localization services are integral to modern applications such as navigation, asset tracking, emergency response, and autonomous systems. Among these, Global Navigation Satellite Systems (GNSS) such as the Global Positioning System (GPS), remain the most widely used solution due to their global coverage and ease of use. However, GNSS service deteriorates or becomes unavailable in certain environments, such as indoors or in urban canyons, where satellite signals are blocked or reflected. In such scenarios, technologies such as WiFi and cellular positioning offer viable alternatives. While WiFi localization can be effective indoors, its accuracy diminishes in outdoor environments with sparse deployment or lack of WiFi access points. In contrast, cellular positioning, standardized by 3GPP, provides broad outdoor coverage using mobile network infrastructure, making it a potential solution for urban canyon use cases. To provide robust cellular positioning, 3GPP specifies a range of techniques tailored to diverse scenarios. Methods such as Enhanced Cell ID (E-CID) and Observed Time Difference of Arrival (OTDOA) provide broad coverage but still lack the precision required in dense urban areas due to signal reflections and limited granularity [4]. Advanced techniques, including Downlink Angle of Departure (DLAoD), Uplink Angle of Arrival (UL-AoA), and Channel State Information (CSI)-based positioning, can significantly improve accuracy, but require advanced features, such as high-accuracy synchronization, dedicated reference signals, and advanced antenna configurations, which add considerable deployment costs and complexity. These complexities pose significant challenges for deployment at scale, slowing down their widespread adoption in real-world commercial networks. To the best of our knowledge, no production 5G networks currently support the advanced location features specified in recent 3GPP releases. While operators continue to work toward eventually enabling high-accuracy network-centric solutions, the current reality necessitates an alternative fallback approach for urban environments, where GPS performance is often compromised. In this paper, we fill this practical gap by introducing mm-NOLOC ( mm Wave-based Localization for Mobile Networks with NO 3GPP LOC ation Service), a UE-centric localization solution designed to operate without mobile network location support. mm-NOLOC capitalizes on the fact that operators often deploy 5G mmWave infrastructure in urban areas to meet high data traffic demands, making it uniquely suited to address the localization challenges in such environments. MobiHoc ’25, October 27–30, 2025, Houston, TX, USA Phuc Dinh et al. As a practical UE-centric solution, mm-NOLOC adheres to the constraint of using only standardized control-plane information currently available on the UE side, as defined by 3GPP. This constraint excludes the use of advanced network-specific information, such as CSI, AoA, and AoD, which are impractical on commercial devices. Signal strength metrics (RSRP, RSRQ) are readily available on commercial-off-the-shelf (COTS) UEs but often unreliable for high-accuracy localization. The Timing Advance (TA) [3] field, which is used to synchronize the transmission timing of a UE with the 5G base station (gNB) to compensate for the propagation delay of the radio signals, could be leveraged to calculate the distance between the UE and gNB, but its coarse resolution (39 m for 100 MHz of bandwidth) makes it unsuitable, especially for dense urban cellular deployments. Instead, mm-NOLOC leverages Synchronization Signal Block (SSB) Indices, 3GPP standardized signaling messages commonly used to identify mmWave beams. Leveraging standardized control messages ensures broad compatibility across devices and simplifies integration for application developers, thus accelerating adoption. 5G mmWave gNBs transmit different SSBs periodically and directionally, typically every 5–160 ms. Each SSB Index can serve as an indicator for the transmission direction of the gNB, and hence implicitly provides information about the angular relationship between the UE and the gNB. Different SSBs from neighboring gNBs provide multiple angular relationships, which can be combined with knowledge of gNB positions in the service area and the orientations of their antenna panels to localize the UE. Nonetheless, leveraging SSB indices to build a high-precision localization system faces a set of practical challenges. First, mmNOLOC relies on constructing an SSB-to-angle mapping function. For such an approach to be scalable, this function should generalize effectively across a large number of gNBs without requiring exhaustive measurements at every gNB. Second, unlike previous the variability and multimodality observed in real deployments. For the third challenge, mm-NOLOC integrates the learned mapping function into a particle filter that uses these directional priors for sampling and resampling, achieving accurate localization without relying on the strict geometric constraints of multi-angulation. We evaluate mm-NOLOC via real-world experiments in two cities and extensive trace-based simulations. Our results demonstrate that mm-NOLOC achieves high localization accuracy, comparable to or even better than GPS, with a median error below 3 m and a 95th percentile below 10 m. Overall, mm-NOLOC offers a dependable fallback solution for location-based services in urban canyon environments, where GPS accuracy is often compromised, by only leveraging features of today’s 5G deployments and information readily available in COTS UEs. Our dataset is publicly available [1]. 2 mm-NOLOC Design In this section, we present the design of mm-NOLOC. We begin by justifying two central design decisions: (i) using SSB indices as the primary input for localization, rather than relying on raw signal strength metrics; and (ii) adopting a particle filter for position estimation, in place of more traditional approaches like the Kalman filter, which is commonly used in similar contexts. We then describe the core components and workflow of the mm-NOLOC architecture. 2.1 Limitations of Signal Strength One common approach in wireless localization is to use signal strength, such as the Reference Signal Received Power (RSRP), to estimate the UE’s distance to nearby gNBs [8]. This approach relies on the assumption that signal strength degrades predictably with distance, allowing a system to approximate a UE’s position using trilateration, i.e., by estimating distances to multiple gNBs and solving for the intersection point. 0.8 theoretical works that assume a direct and deterministic relationship between SSB measurements (beams) and angular positions, this relationship in practice is discrete and multimodal (due to irregular beam patterns generated by phased arrays on commercial gNBs) and contains some degree of randomness (due to blockage and multipath effects), hindering direct application of many traditional localization techniques. Third, in practical 5G mmWave deployments, where gNBs are often installed on traffic lights or −60 −70 −80 −90 −100 −110 Distance to gNB (m) 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0.0 Angle (degrees) lamp posts, the UE may frequently be within the coverage range of only a few gNBs, or, in the worst case, just a single gNB, due to the inherently limited range of mmWave signals or building blockage. This limited coverage significantly hinders the accuracy of Figure 1: RSRP vs. Distance for two gNBs in Boston and Charlotte. Figure 2: Empirical examples of multi-modality in angle distributions. traditional multi-angulation techniques, which rely on input from multiple gNBs at the same time for precise localization. To address the first challenge, we carried out a measurement campaign in two US cities, covering 17 gNBs deployed by two major mobile operators. Our analysis reveals a strong similarity in the SSBto-angle mappings among gNBs from the same operator within a city. This allows the construction of a unique mapping function for a given city by using only a small number of measurements at one (or at most a few) gNB(s) for calibration, enabling city-level deployment with minimal effort. For the second challenge, mm-NOLOC models the SSB index–to-angle relationship probabilistically, using empirical distributions derived from our measurements to capture To evaluate the reliability of RSRP as a localization metric, we conduct a controlled walk test in front of two arbitrary mmWave gNBs, one in Boston and one in Charlotte. In both cases, the UE moves steadily toward the serving gNB – from approximately 90 m down to 10 m – while recording RSRP and GPS coordinates. According to the theoretical free-space path loss (FSPL) model, RSRP is expected to increase superlinearly as the UE approaches the gNB. However, as shown in Fig. 1, the observed correlation between RSRP and distance is weak and inconsistent across the two test locations. This discrepancy arises primarily because the path loss model assumes a fixed transmit power, whereas, in practice, gNBs employ adaptive beam switching and power control. Notably, Boston Charlotte Trimodal SSB Index Bimodal SSB Index RSRP (dBm) Probability mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service MobiHoc ’25, October 27–30, 2025, Houston, TX, USA there is also a clear difference in the overall RSRP range between the two cities, reflecting variations in antenna gain and transmit power among the deployed gNBs. These observations indicate that RSRP is a poor predictor of distance and, consequently, of location estimation in practical mmWave systems. 2.2 Handling empirical SSB-to-Angle Mapping Given the unreliability of RSRP for accurate localization in realworld mmWave networks, mm-NOLOC shifts focus from raw signal strength to sector-level information provided by SSB indices. Intuitively, SSB indices, transmitted periodically by the gNB, provide directional hints about the UE’s location offering a rough estimate of the direction from which the signal arrives. Furthermore, the metric provides more stable cues about the UE’s spatial orientation relative to the gNB. With this new focus, another straightforward hypothesis is: Since SSBs carry angular information, we can simply infer the UE’s angle based on the measured index and apply triangulation from multiple and leveraged to improve localization accuracy by combining their spatial information. Temporal information using UE dynamics. While spatial cues from SSB indices form the foundation of our localization system, mm-NOLOC further strengthens its accuracy and robustness by incorporating temporal information through motion modeling. This temporal layer is especially critical in real-world scenarios, where environmental dynamics, such as sudden blockage, intermittent visibility, and rapid signal fluctuations, can cause spatial observations to become sparse or ambiguous. By fusing spatial and temporal information, mm-NOLOC transforms unreliable, fragmented SSB observations into a coherent localization trajectory. This dynamic inference capability is especially powerful in the challenging and fast-changing channel conditions of mmWave links, enabling continuous and accurate tracking without relying on external infrastructure or inter-gNB coordination. Additionally, the UE-centric design avoids dependencies on advanced 3GPP location features, making it compatible with today’s gNBs for location estimation. However, this hypothesis also breaks down in real-world scenarios. From our extensive measurement commercial devices. I Previous - I particles campaign (§3), we draw two fundamental insights: ssB Angle I I " ,, 'T Predicted (1) The relationship between SSB index and angular position is Indices Probabilistic distribution( I '\ mapping .._ ' \ I Particle Dynamic particleC \ neither deterministic nor one-to-one. A single SSB index may be observed from multiple directions. This necessitates modeling the SSB-angle relationship probabilistically, hindering direct applicabil- / function ,/ , ,,. Mapping function v / t generator model I I IIAngular- •domain :particles Cartesian-domain V / Particle weight update h Weighted ity of deterministic geometric approaches such as triangulation. (2) Even after probabilistically modeling the relationship between Cell /Os b inary f g NB s' I locations a I `³ 3` Domain particles '\ 7particles Particle resampling SSB indices and angles, modeling SSB indices as input remains nontrivial due to the nature of their empirical distributions. These distributions are discrete and can be multimodal, deviating sig- \ Operator's V ,I database v £ ı transformation ._ n I g NB s' lt on . entat 1 c ons, I Resampled , 7 particles Location estimations nificantly from the theoretical Gaussian assumptions underlying commonly used estimation techniques such as the Kalman filter. As a result, common estimation approaches cannot be directly applied. We show two examples of angle distribution multimodality for two different SSB indices from our dataset in Fig. 2. Physically, this behavior is due to imperfect beam patterns, which are common in commercial mmWave antenna arrays, where sidelobes may point to directions different from the main lobe, producing multiple dominant angles. These insights motivate framing the localization problem as a probabilistic, non-parametric inference problem that leverages empirical angle distributions. Unlike theoretical models (e.g., Gaussian) that may overlook critical features like secondary modes or asymmetries, empirical likelihoods retain the structure of observed data, avoiding information loss from oversimplified curve fitting. 2.3 System overview At a high level, mm-NOLOC combines spatial information derived from SSB index measurements and temporal information inferred from the UE’s motion through a particle filter to deliver robust and accurate location estimates. Spatial information through SSB indices. As discussed earlier, SSB index measurements provide directional cues about the UE’s position relative to a gNB’s position. In mmWave networks with sufficiently dense deployments, as is often the case in urban canyons, SSBs from multiple nearby gNBs can be simultaneously observed Preprocessing stage Filtering stage Figure 3: System architecture of mm-NOLOC. 2.4 System architecture The system architecture of mm-NOLOC is shown in Fig. 3. We organize the architecture into four stages: Input, Preprocessing Stage, Filtering Stage, and Output. Input. mm-NOLOC uses two types of information provided by the 5G gNBs for location estimations. • Synchronization Signal Block (SSB) Indices: These indices are broadcast periodically by surrounding gNBs in mmWave networks. They provide relative directional cues about the UE’s position with respect to the transmitting gNB. • Physical Cell IDs (PCIs): This information helps identify gNBs in the operator’s network. PCIs enable mm-NOLOC to retrieve the corresponding gNBs’ location, orientation data, and which mapping function to use from the operator’s database. Unlike metrics such as Angle of Arrival (AoA), Angle of Departure (AoD), or Channel State Information (CSI), SSB indices and PCIs are fundamental pieces of control-plane information defined by 3GPP and used in routine network operations. Although these parameters are not exposed through public Android or iOS APIs by default, multiple open-source tools like MobileInsight [20] have demonstrated access to them via diagnostic modes on common phone chipsets (e.g., Qualcomm, Mediatek, Samsung). Hence, exposing this information to higher layers of the protocol stack is a Estimation I .._ I I I I I I MobiHoc ’25, October 27–30, 2025, Houston, TX, USA Phuc Dinh et al. matter of policy and interface exposure, not hardware or firmware limitations, as it is already available in modem logs. Preprocessing Stage. This stage prepares the inputs required for the particle filter-based inference. • The operator’s database provides three essential pieces of information: the positions of the gNBs in the service area, the orientations of their antenna panels, and the corresponding mapping function used in this service area to generate angle distributions for the filtering stage. • The probabilistic mapping function is constructed empirically offiine and provided through the operator’s database in a binary format. This function transforms the SSB indices into angle distributions, capturing the noisy and probabilistic nature of urban environments. We note that, since the probabilistic mapping function is unique for a large service area (e.g., a city), as will be shown in §3, and gNB deployment is generally fixed, the preprocessing stage can be performed as a one-time operation upon entering the mm-NOLOC service area. Hence, once deployed in a city, mm-NOLOC can operate without further on-site measurements. Filtering Stage. This stage leverages a particle filter framework to deal with uncertainty in probabilistic SSB-to-angle inputs for position estimation. • The particle generator creates angular-domain particles based on the angle distributions obtained from the probabilistic mapping function. • The domain transformation module converts angular-domain particles into Cartesian-domain particles. This transformation uses the retrieved cell positions and orientations to align directional information into a common positional reference frame. This module ensures seamless integration between the mapping function and the weight update functionality of the particle filter. • The dynamic model propagates particles based on the UE’s motion model and system dynamics. • In the particle weight update step, particles are weighted based on the likelihood of observing the received SSB indices at their hypothesized positions. • The particle resampling module focuses computational resources on particles with higher weights by resampling them, mitigating particle degeneracy. • The estimation module produces the final UE’s location by computing the weighted mean of the resampled particles. Output. The output provides estimations of UE’s location, produced by the filtering stage. In the following, we provide a detailed description of the two core components of mm-NOLOC– the probabilistic mapping function in §3 and the particle filter in §4, including their design and solutions to the identified challenges. 3 SSB Index-Angle Mapping Obtaining the SSB index-angle mapping faces two major challenges: Challenge 1: Proprietary Codebook Information. Although the SSBs received at the UE are directly related to the UE’s angular position, the specific mapping and implementation details, including the beam codebook used that defines the SSB patterns, are proprietary information and not publicly disclosed. In fact, even for operators and developers, the knowledge of the beam codebook alone is not enough, as the SSB index-direction mapping may vary to a certain degree in different environments due to blockage, multipath, UE orientation, etc. Consequently, we adopt a probabilistic approach instead of a deterministic one. We obtain the mapping via a field measurement campaign including 17 different gNBs deployed by two major operators in two cities. Challenge 2: Reusability of Mapping Functions. Operators may deploy different types of gNB hardware, raising concerns about the generalization of the constructed mapping function. If the mapping was different for each gNB, constructing mapping functions would require significant effort, undermining the scalability of our approach. However, our analysis in §3.2 demonstrates that SSB-to-angle distributions within a city show significant similarity, indicating that variations across gNBs stem primarily from environment-specific factors and not from differences in beam codebooks. Thus, we can use a unique, city-wide probabilistic mapping function, which can be derived using a small number of measurements at one (or at most a few) gNBs. In the rest of this section, we describe (§3.1) our measurement methodology for obtaining the SSB index-angle mapping for each city that addresses Challenge 1 . We then describe (§3.2) our analysis of the collected dataset, which highlights the reusability of the obtained mappings from a small set of gNBs by comparing them with the overall distributions from all surveyed gNBs, therefore addressing Challenge 2. 3.1 SSB Index-Angle Measurement Methodology 3.1.1 Measurement Locations and Devices. We conducted measurements in two U.S. cities – Boston and Charlotte – that feature commercial 5G mmWave deployments by Verizon and AT&T. For Verizon in Charlotte, we identified a street with dense coverage, featuring 7 consecutive gNBs deployed on nearly every block. For Verizon in Boston, we identified two large zones with a total of 8 mmWave gNBs. On average, Verizon’s mmWave gNBs are deployed approximately 100 m or less apart in both cities, enabling more continuous mmWave coverage. In contrast, AT&T’s gNBs are typically spaced around 1 km apart in both cities, resulting in intermittent mmWave service and frequent fallback to sub-6 GHz 5G. Our measurements were performed using a Samsung Galaxy S21 smartphone equipped with a Qualcomm 5G modem – the most widely adopted mmWave chipset in commercial devices in the U.S. – ensuring that our data reflects typical user hardware. For precise localization, we used an RTK-GPS module to obtain centimeterlevel positioning accuracy. SSB and PCI information was collected using an Accuver XCAL-Solo [2], which connects to the phone’s USB-C port and interfaces with the diagnostic subsystem to log PHY-layer KPIs and signaling messages. Note that the use of specialized hardware like XCAL-Solo is not a necessity to extract PCI and SSB information. Many software-based solutions have been developed to extract similar control-plane information without requiring non-standard firmware modifications, e.g., [20]. Exposing this information to app developers is finally a matter of policy, as we noticed in 2.4. Similarly, we used an RTK GPS solely to obtain high-precision data for our evaluation. In practice, operators already know the exact locations and SSB configurations of their gNBs, and can obtain beam-angle mappings from the hardware vendor as part of equipment specifications. mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service MobiHoc ’25, October 27–30, 2025, Houston, TX, USA (a) AT&T Coordinates (b) Verizon Coordinates provides a good trade-off between measurement overhead and accuracy. Finally, although XCAL records SSB indices every few hundred ms, short-term blockages from vehicles or pedestrians are common in urban settings. Collecting data over 5 s per orientation mitigates these transient effects, producing a more robust dataset. 3.2 Analysis of SSB Index Measurements After data collection, we build the mapping from serving SSB indices to angles. For each angle, we extract the percentage of time each SSB Index is measured and then analyze the SSB Index distributions for each angle. Note that, due to the sparse deployment of AT&T Figure 4: Constructed angular coordinates. 3.1.2 Constructing angular coordinates. To build a mapping between SSB Indices and angles, we first need to construct an angular coordinate system surrounding each gNB we experiment with. Each of these coordinate systems is constructed using the following steps: • Defining the 0𝑜 angle: Since the beam codebook is not known, and we only need to know relative angle measurements from gNBs to locate the UE, we can define the 0 𝑜 angle arbitrarily as a reference for measuring other angles, as long as the definition is consistent among different gNBs. In our constructed coordinate system, we define the 0𝑜 as the direction that is perpendicular to the antenna panel. We obtain the GPS coordinates of the gNB and a random point on the 0𝑜 direction to construct the direction vector. • Building the angular coordinate system: After obtaining the 0𝑜 direction vector for a gNB, we use Google Earth Pro, which supports accurate angle measurements, to manually generate the coordinates for that gNB. Unlike simpler plotting tools, Google Earth Pro ensures that the measured angles and points are accurate real-world angles and measurement points. We construct angles in steps of 10𝑜 surrounding each gNB. Then, we obtain the GPS coordinates of the intersections between an inner circle with radius of 10 meters and an outer circles at radius 20 of meters and used these intersection as "experiment points" for SSB measurements. Fig. 4 shows examples of constructed coordinate systems for two gNBs from Verizon and AT&T. The center of the circle is the gNB position, while the 0 𝑜 angles are marked in red. The circles intersect with the lines identifying the angles to create experiment points. Note that the angle notations used in coordinate systems in Fig. 4 differ slightly between AT&T and Verizon due to their differing approaches to gNB identification. Specifically, 5G mmWave gNBs are typically equipped with three antenna panels. Verizon assigns a unique PCI to each panel, resulting in three PCIs per gNB, whereas AT&T uses a single PCI to identify an entire 3-panel gNB. 3.1.3 Experimental Procedure. After defining the coordinate system for each gNB, we collect SSB measurements at every experiment point using the following procedure: • Step 1: Position the phone so that it directly faces the serving antenna panel. • Step 2: Run a script that sends a small amount of traffic for 5 s. During this interval, the script logs the angle and device orientation, while XCAL-Solo records the serving SSB index. • Step 3: Rotate 45◦ clockwise and repeat Step 2 with the new orientation. • Step 4: Continue Step 3 until completing a full 360 ◦ sweep. Since a UE in motion may face any direction and experience partial or full body blockage, the SSB index is not assumed constant across orientations. Capturing SSB indices in 8 directions per point mmWave gNBs and the locations of most gNBs (often in the middle of the road), we only managed to do experiments with 2 AT&T gNBs with 11 different angles. For Verizon, the deployment is much denser giving us multiple options. Specifically, we experimented with 8 gNBs in Boston and 7 in Charlotte. Due to space limitation, we cannot show the distributions for all 17 gNBs. Fig. 5 shows a comparison between two representative Verizon gNBs in Charlotte with a Verizon gNB and another AT&T gNB in Boston. We make two observations from our analysis and Fig. 5. Observation 1: many-to-many relationship between measured SSB Index and angle . We observe that multiple SSB indices can be associated with the same angle. For example, in Boston-Verizon (Fig. 5a), we often see 9-10 SSB indices for a given angle. This can be attributed to (i) the use of 3D beamforming, due to which, the SSB selection is affected not only by the angles but also the distance to the gNB, and (ii) environmental noise such as transient or permanent blockage, which causes the UE to receive SSBs from nonline-of-sight (nLOS) paths. Conversely, the same SSB index can cover multiple angles, as illustrated by repeated colors at different measured angles in Figs. 5a-5d. This is understandable, since one SSB index can cover a sector larger than 10 0 , especially in scenarios with a low number of supported beams. Another reason is the presence of irregular beam patterns featuring one main lobe pointing at one main angle and multiple side lobes pointing at different angles. Observation 2: SSB Index configurations can vary operator-wise or city-wise. In particular, Verizon gNBs in Boston have 48 activated beams per PCI, while AT&T in Boston have 24 per PCI (only a subset of angles are shown due to the limited number of feasible measured positions), and Verizon gNBs in Charlotte have 12 per PCI. They also have different distributions. For example, in BostonVerizon case, the most frequently observed beam at angle 0 is SSB Index 25 (pink) while in Charlotte-Verizon, beam 11 (green) is most frequently observed at the same angle. Observation 3: SSB Index configurations for the same operator in the same area exhibit similar distributions. Specifically, we observe that SSB indices measured at the same angle for different gNBs within a given service area display similar patterns in their distribution. Simply put, we often observe similar sets of of dominant indices per measured angle across gNBs in the same city. An example is shown in Figs. 5b and 5c. To formally quantify this observation and compare individual gNBs’ distributions with the overall distributions, Fig. 6 presents heatmaps of the average pairwise Jensen-Shannon divergence (JSD) for the SSB index-angle distributions for a few different gNBs as compared to the overall distributions of all gNBs in our dataset. JSD quantifies the dissimilarity between two distributions, ranging from 0 (identical distributions) to 1 (completely 110 100 140 5 70 180 190 200 210 40 AT&T gNB 30 20 10 240 250 340 330 260 320 270 280 290 300 310 4 60 50 -50 -40 -30 -20 Verizon gNB 40 30 20 10 10 20 -20 -30 30 40 50 60 -50 -40 1 160 130 120 90 80 0 60 10 0 -10 -20 20 -30 30 - 40 0 -50 170 50 50 60 220 0 -10 0 230 350 0 -10 MobiHoc ’25, October 27–30, 2025, Houston, TX, USA Phuc Dinh et al. 1.0 0.5 0.0 Angle (degree) (a) Boston-Verizon 1.0 0.5 0.0 Angle (degree) (b) Charlotte-Verizon 1 1.0 0.5 0.0 Angle (degree) (c) Charlotte-Verizon 2 1.0 0.5 0.0 Angle (degree) (d) Boston-AT&T Figure 5: Empirical distributions of observed SSB indices for different angles across gNBs in different cities and operators. Each color represents a distinct SSB index detected at the corresponding angle. dissimilar). Our results show that, when comparing different gNBs against each other and the overall distribution, most JSD values are close to 0.1, with the largest divergence (0.2) observed between gNB 1 and gNB 2 for Verizon in Boston. This finding underscores two key points: (i) operators generally deploy gNBs with the same beam codebook across a large service area, and (ii) slight variations in SSB indices at similar angles are primarily due to environmental factors rather than fundamental differences in codebook. Intuitively, if the beam codebooks were entirely different for each gNB, the SSBangle distributions would lack similarity, resulting in JSD values close to 1. More importantly, this result highlights a practical advantage: the SSB index-angle mapping can generalize for a large area (e.g., a city) using measurements from only a small subset of gNBs. This significantly reduces the measurement effort required, making mm-NOLOC scalable and practical for real-world deployment. 4.1 Modeling Rationale At its core, mm-NOLOC leverages a nonparametric, data-driven likelihood mapping function, quantifying the likelihood of different angular positions for measured SSB Indices. Unlike traditional Gaussian-based modeling approaches, our modeling approach captures the discrete, sparse, and multimodal nature of mmWave signal propagation, reflecting real-world effects like sidelobes or blockage. All g1 g2 g3 All g1 g2 All g1 g2 g3 g3 All g1 g2 All g1 g2 g3 All g1 g2 0.5 0.4 0.3 0.2 0.1 0.0 (a) Boston-Verizon (b) Charlotte-Verizon (c) Boston-AT&T Figure 6: Pairwise Jensen-Shannon Divergences between different gNBs for the same City/Operator. We also note that, in practice, operators obtain their hardware from one (or a few) vendor(s) (e.g., Samsung, Nokia, and Ericsson in the US) and are further constrained by 3GPP standards that limit SSB configuration diversity. As a result, only a small number of SSB configurations are used nationwide. This was confirmed experimentally by our recent study [10], in which we drove in 11 US cities with mmWave deployments, and found only 2 distinct configurations for each of the two main 5G mmWave operators (Verizon and AT&T). Thus, our observation in this work that a single mapping function generalizes within a city is actually conservative; real deployments suggest even broader reuse. 4 Particle Filter Model While the use of particle filtering for location estimation is not new, its effectiveness hinges on the careful construction of measurement models. This section provides the rationale and intuition behind our modeling approach before presenting the mathematical formulation. In 4.1, we describe intuitively how particle filtering is particularly well-suited for our setting, given the uncertainty introduced by mmWave-specific characteristics, such as signal blockage, NLoS paths, and the inherently multimodal nature of the observed SSBto-angle relationship in real-world deployments. The formalization of our intuition is described in 4.2. Figure 7: A conceptual visualization of location estimations based on SSB measurements with particle filtering. To provide a high-level intuition, we present a conceptual visualization of our system in Fig. 7, illustrating how mm-NOLOC uses a particle filter to operate under a realistic mmWave scenario. Upon entering a mmWave service region, the UE may experience partial blockage (e.g., between 𝑡 = 1 and 𝑡 = 3), during which it receives SSBs only from a single gNB. Consequently, the particle cluster, representing the set of hypothesized UE positions generated using mm-NOLOC’s empirical likelihood distributions, becomes increasingly uncertain, as indicated by the growing spread of the particles. At 𝑡 = 4, when the UE exits the blockage and receives an SSB measurement from a new gNB, this additional spatial information reduces the uncertainty, as it aligns well with the UE’s historical motion (moving from left to right), resulting in a more confident position estimate. Naturally, mm-NOLOC’s measurement model also incorporates SSB indices received from multiple gNBs, as shown at 𝑡 = 5. This further increases robustness in estimation and reduces uncertainty. In effect, the system benefits from a voting-like mechanism, where multiple independent observations (collected from different gNBs) contribute to the overall likelihood estimate, mitigating the impact of any single erroneous or ambiguous measurement. This capability is particularly valuable in dense urban environments, where 0.12 0.11 0 0.08 0.12 0 0.2 0.18 0.11 0.2 0 0.16 0.08 0.18 0.16 0 0.06 0.04 0 0.09 0.06 0 0.14 0.09 0.09 0.14 0 0.17 0.04 0.09 0.17 0 0.13 0.12 0 0 0.15 0.13 0.12 0.15 0 Probability Probability Probability Probability mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service MobiHoc ’25, October 27–30, 2025, Houston, TX, USA 𝑘 . . 𝑘 𝑘 𝑘 𝑘 overlapping coverage from multiple gNBs can be leveraged without requiring inter-gNB coordination or additional infrastructure. Moreover, this voting-like mechanism effectively handles cases where the SSB index distribution is multi-modal, i.e., when there are multiple dominant angles, by discounting unlikely angles that are inconsistent with the directionality of other SSB measurements. 4.2 Mathematical Formulation In this section, we formalize the proposed measurement model For simplicity, we call vectors c 𝑘 and s 𝑘 the PCI vector and the SSB vector, respectively. Since the position and orientation of the cell deployed by the service provider are provided by the operator, let us denote the lookup function as L(.). The vectors of cell positions and their directional vectors can be obtained as: (P𝑘, D𝑘 ) = L(c𝑘 ) (6) where P𝑘 = (p1,𝑘, p2,𝑘 , . . . , p𝑀,𝑘 ), (7) D𝑘 = (d1,𝑘, d2,𝑘 , . . . , d𝑀,𝑘 ), and how it fits into the overall particle filter framework together with p (for 𝑚 = 1 , 2 , . . . , 𝑀 ) the position of the 𝑚 -th serving cell, with our derived empirical distribution collected by our extensive 𝑚,𝑘 and d (for = 1 2 ) the directional vector of the cell’s measurements. 𝑚,𝑘 𝑚 , , . . . , 𝑀 Given a set of 𝑁 particles {x𝑖 , 𝑤𝑖 } 𝑁 , where x 𝑖 is the state antenna of the 𝑚 -th cell. vector and 𝑖 𝑘 𝑘 𝑖=1 𝑘 Since we associate the angle of the directional vector with its 𝑤 is the weight of the 𝑖-th particle, the filter operates using the foll𝑘owing key steps: • Prediction: Propagate each particle through the state transition 0𝑜 angle by convention, we define the relative angle of a UE from a cell as the difference between the UE’s position vector and the cell direction vector. Therefore, the angle of a UE at the time step 𝑘 model with noise vector v𝑖 : x𝑖 ∼ 𝑝 (x𝑘 |x𝑖 −1, v𝑖 ) from PCI 𝑚 can be written as • Update: Adjust weights based on the measurement model: 𝑤 𝑖 ∝ 𝑝 ( z 𝑘 | x 𝑖 ) 𝜃 = 180 · atan2 r × d , r · d (8) 𝑘 𝑚,𝑘 • 𝑚,𝑘 𝑚,𝑘 𝑚,𝑘 𝑚,𝑘 Resampling: Resample particles to focus on those with higher weights. where r𝑚,𝑘 = p 𝑘 – p 𝑚,𝑘 is the position vector of the UE relative to ⊤ • Estimation: Compute the state estimate as: xˆ𝑘 = . 𝑤𝑖 x𝑖 PCI 𝑚 , with p 𝑘 = ( 𝑥 𝑘 , 𝑦 𝑘 ) representing the position component of System Dynamic Model. 𝑖=1 𝑘 𝑘 the UE’s state vector x 𝑘 , while r 𝑚,𝑘 × d 𝑚,𝑘 is the cross product, and We present the dynamic model of our system, which captures the evolution of the state over time. This model is utilized within the particle filter framework to estimate the state of the system from noisy measurements. The goal of the r 𝑚,𝑘 · d 𝑚,𝑘 is the dot product between the two vectors. The atan2 function computes the angle in radians between the positive x-axis and UE’s position, ensuring the correct quadrant. By multiplying by 180 , the result is converted to degrees. filter is to estimate the position ( 𝑥, 𝑦 ) of a User Equipment (UE) in a predefined coordinate system. We denote the state vector of the Since the probabilities of observing (𝑐 for all 𝑀 PCIs, we can write: 𝑚,𝑘 , 𝑠 𝑚,𝑘 ) are independent system at time 𝑘 as x = (𝑥 , 𝑦 , 𝑣 , 𝑣 )⊤ (1) 𝑀 𝑃 (z |x ) = 𝑃 (𝑐 , 𝑠 |x ) (9) 𝑘 𝑘 𝑘 𝑥,𝑘 𝑦,𝑘 𝑘 k 𝑚,𝑘 𝑚,𝑘 𝑘 where 𝑥𝑘 is the x-coordinate of the UE at time 𝑘, 𝑦𝑘 is the ycoordinate of the UE at time 𝑘, 𝑣𝑥,𝑘 is the velocity of the UE along the x-axis at time 𝑘, and 𝑣𝑦,𝑘 is the velocity of the UE along the y-axis at time 𝑘. Next, we define the state transition model as x𝑘+1 = Fx𝑘 + v𝑘 (2) where F is the state transition matrix, and process noise v𝑘 ∼ 𝑚=1 Furthermore since the state vector x𝑘 follows a deterministic relationship with its relative angle 𝜃𝑚,𝑘 to a given 𝑚 as established in (8), (9) is equivalent to: 𝑀 𝑃 ( z 𝑘 | x k ) = 𝑃 ( 𝑐 𝑚,𝑘 , 𝑠 𝑚,𝑘 | 𝜃 𝑚 , 𝑘 ) (10) 𝑚=1 Therefore, for any state hypothesis x𝑖 generated by the particle N (0, Q𝑘 ) is a joint zero-mean Gaussian distribution with covariance matrix Q 𝑘 , representing process noise; Δ 𝑡 represents the time interval between successive state updates, reflecting the discretetime nature of the system’s evolution. Measurement Model and Weight Update. Next, we discuss the measurement model of the filter. In other words, we present how the particle weights are updated using the measurements received at the UE. z𝑘 = (𝑐1,𝑘 , 𝑠1,𝑘 , 𝑐2,𝑘 , 𝑠2,𝑘 , . . . , 𝑐𝑀,𝑘 , 𝑠𝑀,𝑘 ) (3) where 𝑐 𝑚,𝑘 represents the PCI of the 𝑚 -th cell/gNB 1 and 𝑠 𝑚,𝑘 represents the SSB index from the 𝑚-th cell at time 𝑘 for 𝑚 = 1, 2, . . . , 𝑀. The measurement vector z𝑘 can be broken down into two subvectors c𝑘 and s𝑘 as follows: c𝑘 = (𝑐1,𝑘 , 𝑐2,𝑘 , . . . , 𝑐𝑀,𝑘 ) (4) s𝑘 = (𝑠1,𝑘 , 𝑠2,𝑘 , . . . , 𝑠𝑀,𝑘 ) (5) 1 Recall that each gNB may include one or more PCIs depending on deployment type. filter, we can first transform it to angula 𝑘 r domain using (8), then use (10) as the weight update function. (10) is the likelihood of observing a given SSB index at a given angle, which can be obtained using our collected measurement dataset in §3. This concludes our derivation. The overall algorithm is shown in Algorithm 1. 5 Evaluation In this section, we evaluate mm-NOLOC through real-world experiments and trace-driven simulations. For context, the GPS baseline used in our experiments is dual-frequency GNSS with sensor fusion enabled on modern smartphone chipsets, representing a state-ofthe-art configuration. We emphasize that our goal is not to show that mm-NOLOC outperforms every proposed localization solution in the literature, but to demonstrate a practical solution that provides accuracy comparable to that of GPS in urban canyon environments, using only standardized control-plane information currently available on the UE side. State-of-the-art schemes from the 𝜋 𝜋 MobiHoc ’25, October 27–30, 2025, Houston, TX, USA Phuc Dinh et al. Ground Truth mm-NOLOC GPS Ground Truth mm-NOLOC GPS Algorithm 1 Particle Filter Algorithm for mm-NOLOC 80 60 40 20 0 0 20 40 60 80 100 120 ΔUTM X (m) 1.0 0.8 0.6 0.4 0.2 0.0 0 1 2 3 4 5 Euclidean Distance Error (m) . (a) Type-1 trajectory 80 60 40 20 0 0 20 40 60 80 100 120 ΔUTM X (m) 1.0 0.8 0.6 0.4 0.2 0.0 1 2 3 4 5 6 7 8 Euclidean Distance Error (m) (b) Type-2 trajectory 𝑘 1,𝑘 𝑀,𝑘 80 60 40 20 Figure 8: Performance of mm-NOLOC in Boston. 80 60 40 20 12: Weight Update 13: Collect measurement vector as in (3) 14: Compute the weight for particle 𝑛 based on the measurement vector using (10) 15: end for 16: Weight Normalization 17: Estimation 18: Compute the state estimation for time 𝑘 as the weighted 0 0 20 40 60 80 ΔUTM X (m) 1.0 0.8 0.6 0.4 0.2 0.0 0 1 2 3 4 5 6 7 Euclidean Distance Error (m) (a) Type-1 trajectory 0 0 20 40 60 80 ΔUTM X (m) 1.0 0.8 0.6 0.4 0.2 0.0 0 2 4 6 8 10 12 14 Euclidean Distance Error (m) (b) Type-2 trajectory mean particle state 19: Resampling Resampled new particles based on the updated weights, used for next-iteration prediction. 20: end for literature may indeed provide higher accuracy than mm-NOLOC. However, they are not currently deployed in commercial 5G networks, because of their required complexity, making mm-NOLOC the only easily deployable option. 5.1 Evaluation Methodology Despite promises of dense deployment in urban areas, the majority of commercial 5G mmWave deployments today are still intermittent and sparse, resulting in coverage gaps and making it difficult to achieve continuous mmWave service. This poses a great challenge for real-world evaluations. During our extensive experiments, we found two sites with dense enough deployment for evaluations for Verizon in Boston and Charlotte, while AT&T gNBs are deployed too far apart. Therefore, we focus on Verizon deployments to ensure a fair and consistent evaluation across cities. Establishing ground truth. Since our experiments are conducted in crowded urban areas with surrounding tall buildings, GPS measurements are highly inaccurate and cannot be used to establish ground truth position. Instead, we manually constructed ground truth position over time. Specifically, we used Google Earth to first identify the coordinates of multiple landmarks along our intended evaluation trajectories. During experiments, we moved at a pedestrian speed and logged the timestamps upon arrival at each landmark, while also logging PCI and SSB measurements in the background. Then, we reconstructed the ground truth using the logged time stamps and landmark coordinates using interpolation for our evaluation. Choosing a coordinate system. Outdoor positioning typically uses the Geographic Coordinate System (GCS) with latitudes and Figure 9: Performance of mm-NOLOC in Charlotte. longitudes. For precise distance calculations and geometric operations, we instead use the Universal Transverse Mercator (UTM), a 2D Cartesian system. In our evaluations, we offset UTM values with an appropriate reference point for better visualization. 5.2 Real-world Evaluation In this section, we conduct a real-world evaluation by performing mobility experiments in areas with commercially deployed Verizon mmWave gNBs in Boston and Charlotte. We evaluate two types of trajectories. For Type-1 trajectory, we move straight on the sidewalk of a street where multiple gNBs are deployed for around two minutes at pedestrian speed. For Type-2 trajectory, we first move straight and then make a U-turn and continue walking for a total duration of around 4 minutes in the chosen mmWave service areas. We also log the GPS coordinates on the phone for comparison with mm-NOLOC. The purpose of two types of trajectory is to see how well the filtering algorithm performs with sudden changes in the velocity vector. As shown in Figs. 8 and Fig. 9, mm-NOLOC achieves similar median errors in the two cities – 3.2/4.5 m in Boston and 2.5/4.5 m in Charlotte for the two trajectory types. Additionally, the maximum error is also kept very low – below 6/9 m in Boston and below 7/14 m in Charlotte. The accuracy is similar to or even better than the GPS accuracy; in fact, in Charlotte for Type-1 trajectory, mm-NOLOC outperforms GPS for the whole trajectory. We also observe that Charlotte has much higher maximum errors compared to Boston, especially for the Type-2 trajectory. This can be attributed to Verizon in Charlotte using wider beams, leading to lower angle resolution and sparser particle weight updates. We note that these test areas do not correspond to the most severe urban canyon scenarios, and GNSS in our measurements, while degraded, remains generally available. In truly challenging environments, such as those documented in [12] with mean GNSS errors exceeding 10 m and maximum errors over 200 m, the advantage of mm-NOLOC would be even more pronounced. We also stress mm-NOLOC GPS GPS LOC mm-NO CDF ΔUTM Y (m) CDF ΔUTM Y (m) CDF ΔUTM Y (m) CDF ΔUTM Y (m) 1: 2: Input: 𝑁 , v𝑘 , Δ𝑡 Initialization: 3: for 𝑛 = 1 to 𝑁 do 4: 5: x𝑛 = FxGPS + v𝑘 0 − 1 𝑤𝑛 = 1/𝑃 6: end for 7: for 𝑘 = 1 to 𝐾 do 8: for 𝑛 = 1 to 𝑁 do 9: Prediction 10: Predict new state for particle 𝑛 using (2) 11: Compute the angle vector 𝜽𝑛 = [𝜃𝑛 , ...𝜃𝑝 ] for 𝑀 associated serving PCIs using (8) mm-NOLOC: mmWave-based Localization for Mobile Networks without 3GPP Location Service MobiHoc ’25, October 27–30, 2025, Houston, TX, USA 1.0 0.8 0.6 0.4 0.2 0.0 0 5 10 15 20 25 30 35 1.0 0.8 0.6 0.4 0.2 0.0 0 5 10 15 20 25 30 35 To validate this hypothesis, we present a scatter plot in Fig. 11(d), showing the maximum localization error observed in each trajectory versus the average distance traveled per gNB, with higher values indicating sparser deployments. We observe a clear positive correlation between gNB spacing and maximum error, with a few exceptions. This highlights the importance of dense gNB deployErrors in Euclidean Distance (m) (a) Cumulative performance. Errors in Euclidean Distance (m) (b) Impact of trajectory length. ments in reducing extreme errors and ensuring robust localization performance. Figure 10: Trace-based simulation over 100 trajectories. again that the design goal of mm-NOLOC is not to replace GPS but to complement it, providing a robust fallback when satellite-based positioning becomes unreliable or unavailable. This complementary role is particularly relevant for dense urban deployments where commercial 5G mmWave coverage already exists. 5.3 Trace-based Simulations Another limitation of today’s commercial mmWave deployments is that, in most cities (including the two cities where we conducted our experiments), multiple gNBs are typically deployed on a straight line along one major street. As we turn away from this street, the UE stops receiving SSBs from multiple gNBs or even disconnects from mmWave service due to blockage from tall buildings. This deployment hindered evaluations with long, turn-heavy trajectories to stress-test our solution. To overcome this limitation, we built a simulator based on the collected mobility traces from real-world mmWave gNB deployments in multiple locations in two surveyed cities. Since our measurement methodology (§3) enables us to establish ground truth positions using high-accuracy GPS devices, we can derive the ground truth angles relative to these gNBs for any given measured SSB index. Leveraging these real-world observations, we create multiple "simulated" gNBs with angle-SSB profiles that mimic the behavior of actual operator-deployed gNBs under similar conditions (urban environments). We place these "simulated" gNBs at potential deployment sites to form a grid-like deployment topology. This simulator allows us to evaluate mm-NOLOC on diverse synthetic trajectories that include more complex mobility patterns, such as frequent turns and multi-street traversal, under controlled but realistic conditions. Fig. 10a shows the performance of mm-NOLOC cumulatively for 100 randomly generated trajectories of varying lengths involving left-, right-, and U-turns. The results agree with those in Figs. 8, 9, showing a median error of 3 m and a 95-th percentile below 10 m. Fig. 10b plots the results for the same 100 trajectories broken down by the trajectory length. Interestingly, we observe that the trajectory length (measured in terms of the number of gNBs the UE traverses through) has little impact on accuracy. To further analyze the high-error cases in our results, we focus on specific examples in Boston, where we observe worst-case errors exceeding 30 m. We present two scenarios with high and low maximum errors in Fig. 11(a) and Fig. 11(b), respectively. Despite having very similar travel distances and numbers of turns, and similar median error (Fig. 11(c)), Fig. 11(a) exhibits a maximum error of 35 m, whereas Fig. 11(b) exhibits a maximum error of only 10 m. We conjecture that high-error scenarios are associated with sparser gNB deployments, quantified by the ratio of total travel distance to the total number of unique gNBs observed. 6 Related Work Localization in 4G and earlier generations. Early GSM-based positioning systems, e.g., [13, 14, 22], use signal strength measurements or Cell-ID sequences for localization, effectively handling noisy environments by capturing temporal and spatial dependencies, without specifically addressing NLOS environments. More recent works target localization in LTE networks and employ a combination of techniques to deal with NLOS environments. However, these systems still suffer from poor localization accuracy, e.g., 150-220 m in [9]. [6] proposes a single base station localization system using ToA and AoA and demonstrates accuracy of a few m in an LTE testbed, but it performs the evaluation in indoor environments, which are very different from outdoor ones (e.g., shorter UE-BS distances, absence of transient blockage). None of these works leverages beamforming for localization. Localization in 5G and beyond. A plethora of recent works target localization for 5G and beyond networks, including mmWave networks with beamforming capabilities – see [21], [28], [16] for a comprehensive coverage of the topic. [15] presents ISLA, a system enabling IoT devices to localize using ambient 5G signals without coordination with base stations. A number of schemes combine ML techniques and/or compressive sensing with mmWave signals to enhance accuracy, especially in NLOS environments [7, 17–19, 27]. [29] discusses the practical implementation of these techniques, demonstrating the effectiveness of using existing 5G infrastructure for cost-effective localization solutions. These approaches require advanced signal processing and hardware modifications, and the evaluations of most of them rely on simulations. In contrast, we propose a practical system for 5G mmWave networks, which only requires access to SSB indices – a piece of information readily available at the lower layers of the protocol stack in commercial off-the-shelf smartphones, and demonstrate its feasibility and practicality via an extensive measurement campaign. Indoor mmWave-based localization. A number of works have specifically focused on indoor mmWave localization leveraging the beamforming capabilities of 802.11ad WiFi APs in the 60 GHz band [5, 11, 23–26]. Most of these works [11, 24–26] evaluate the proposed systems via simulations or focus on theoretical performance metrics. [5] explores the practical implementation of a localization system using commercial off-the-shelf (COTS) 60 GHz APs, addressing the limitations and performance of consumergrade hardware in indoor scenarios. [23] discusses a comprehensive mmWave localization system designed for simultaneous communication and localization on consumer-grade devices, focusing on indoor environments and controlled testbed setups. Similar to most works proposed for 5G and beyond mmWave networks, these approaches require advanced signal processing techniques to obtain accurate AoA estimates. In contrast, mm-NOLOC achieves high Charlotte Boston e (1-10) e (11-20) e (21-30) Boston (1-10) (11-20) (21-30) ton ton Bos Bos rlott rlott Cha Cha rlott Cha CDF CDF