4

Some apps say they track location in “data linked to you” in their app privacy label.

For example, the game Roblox.

enter image description here

But, these apps (like Roblox) don’t always appear in the Settings -> Privacy & Security -> Location Services list of apps with permission to see the device location.

enter image description here

Does that mean the app can’t access the device location? (Then why is “location“ listed in the privacy label?)

Or, does this mean the app has some other way of accessing device location that does not require user permission?

If you can cite an authoritative source (like the iOS SDK or other apple developer documentation) in your answer, I would appreciate it

Improve this question
5
  • Can you show your Location Services App list where Roblox should be listed?
    – Allan
    Dec 31, 2022 at 20:17
  • Yes. Screenshot added. Since you asked, I’ll try to anticipate your next questions. 1)yes, i installed Roblox and 2) yes, I logged in and played a few minutes just to verify.
    – PaulH
    Dec 31, 2022 at 20:24
  • First, try turning off the main (global) location services. Run the App. It will force the App to prompt you to turn it on. If it doesn’t, then it’s not using location services
    – Allan
    Dec 31, 2022 at 20:31
  • I can confirm that with location services off, the app does not prompt for permissions. That still leaves me with my original questions 1) why does the app privacy label say it records location and 2) are their ways of getting location that don’t trigger the prompt? (e.g. cellular mnc/mcc, or other voodoo)
    – PaulH
    Dec 31, 2022 at 20:39
  • The app “privacy label” is what the dev says it may track (“may” means they could track you, not that they actually do).
    – Allan
    Dec 31, 2022 at 20:42

1 Answer 1

Reset to default
1

The app isn’t using iOS’s Location Tracking services though it can track you in different ways (none of which have anything to do with iOS or Apple)

Does that mean the app can’t access the device location? (Then why is “location“ listed in the privacy label?)

If you disable Location Services globally then run the App and it doesn’t prompt you to enable them, it’s not using Location Services on your device.

The label, as you described it, is nothing more than a disclosure by developer detailing what they could potentially track, not what they are actually doing. If they say they track something, but don’t, then no harm no foul. If they don’t disclose something but actually engage in an activity, they can be sanctioned by Apple. Why the developer said they track you/your device but not actually track using Location Services is up to them.

Or, does this mean the app has some other way of accessing device location that does not require user permission?

Yes, they can track you in other ways such as your public IP address or SSID (iOS 13 and older). Neither of these are part if Location Services - they will know your IP simply from the request from the App to the server; you can’t block that. In fact, it can be argued that it’s the developers right to know where the server requests are coming from.

If they know your SSID and BSSID (which they will if they access Networking) they can look up that value in a database to pin point your location. Granted, it won’t be precise, but generally within a few hundred meters.

Cross referencing the geo-IP with the geo-SSID and then linking it to your account, the developer can have a fairly good idea of where you are and track you with a fairly good degree of certainty.

Below is an SSID map for the Fort Lauderdale area as of this posting. Using the search tools on this website, anyone can determine a device’s relative location with a known SSID and BSSID.

enter image description here

Even if they can’t get your SSID (iOS 14 and newer), the IP alone is more than enough to reasonably track your general location and associate it to an account. Remember, large companies (malls, airports, hospitals, government entities, etc.) that offer free Wi-Fi access to the Internet often have their own public IP address that map right to their physical location - meaning it’s pretty accurate!

None of this requires your permission and it all happens on the server (back end) well outside of your device and iOS.

Improve this answer
2
  • 1
    SSID is only available to apps with precise location permission: developer.apple.com/forums/thread/…. OP shows Roblox doesn’t have this.
    – grg ♦
    Dec 31, 2022 at 21:34
  • Good to know @grg. I wasn’t aware that changed. I will update to reflect.
    – Allan
    Dec 31, 2022 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .