SMS specifications include "Type 0" messages, also known as Silent SMS. These messages don't trigger any even on the phone when received, but they do send back an ACK that includes IMSI metadata. Silent SM, are literally defined in the RFC and primarily used to covertly track user locations without judicial oversight.
GSM, SS7, etc. are massive privacy holes _by design_.
GSM, SS7, etc. are massive privacy holes _by design_.