You can get historical city / state location from GSM operators but not real time tracking or exact location, if you have physical access to the phone you can install android malware, most of them do have this function already.
NinjaNet
Vendor of: Private Cyber Tool & Private Cyber Service
you can hijacking the victim from the url then you get the GEO of the victim but preparing this type of attack need knowledge in web development like you can simply done in some basic languages like (PHP,C# asp,Python django) + you need a hosting service like the server can listen or receive income connection from outside on yiur networks area.