What location data do apps actually collect?

The permission prompt asks a small question. What follows is usually larger than the question implied.

The short answer: with permission an app receives a latitude, a longitude, an accuracy radius and a timestamp every time it asks, and if you granted Always it keeps asking while the phone is in your pocket. No single reading matters much. What matters is that readings are stored, and that a stored sequence rarely stays with the app that collected it.

What arrives with a location

When an app receives a position, it receives a small record: latitude and longitude, an accuracy radius, a timestamp, and frequently altitude, heading and speed. Some apps also read motion separately through CoreMotion, which counts steps and classifies whether you are walking, cycling or driving.

The accuracy radius is the field people skim, and it carries more than it looks like it does. A fix good to a few metres came from satellites; one good to tens of metres from the Wi-Fi around you; one good to kilometres from a cell tower, or from the approximate mode you can set per app. Stored next to the position, it tells an app roughly how you were located, not only where.

Some Core Location features report rarely and cost an app almost nothing to leave running. Region monitoring reports when you cross a boundary the app drew on a map. The visit API hands over an arrival time and a departure time, so dwell is a field iOS supplies rather than something the app has to calculate. Either can run for months while the app looks idle.

None of that is alarming in isolation. The timestamp is what changes it.

How often, and who asked

Collecting your location covers two very different arrangements. An app asking once because you tapped the locate button is not the same animal as an app holding Always permission and taking readings for six months while you never open it.

iOS marks the difference quietly. The status bar arrow appears while location is being read, and in the Location Services list a hollow arrow means an app may receive your location under certain conditions, usually a geofence. Always also earns you a second prompt a few days later, with a map of where that app collected from in the meantime. It is the most informative screen the phone offers on this, and the one people dismiss fastest. What each level actually grants is worth five minutes.

The pattern, not the point

One coordinate says where a phone was once. A few thousand, timestamped, say something quite different:

• The place it rests every night is where you live.
• The place it rests on weekday afternoons is where you work.
• A weekly stop at the same building says something about your faith, your health, your politics or your recovery.
• Two phones that repeatedly rest in the same place overnight are two people with a relationship.

This is why "it is just a coordinate" undersells it. The coordinate is not the product. The pattern is.

Two more things fall out of a timestamped history. Once a few weeks are on file, a Tuesday unlike the previous ten Tuesdays stands out. And the history resists anonymising: take the name off it and the place it sleeps and the place it spends weekdays still point at one household and one employer.

The parts that are not satellites

Core Location is not a GPS reader with a wrapper on it. It fuses several sources:

• Wi-Fi. The access points in range resolve to a place, which is how a phone has a position indoors and within a second of unlocking.
• Cell towers. Coarse, nearly always available, enough for a neighbourhood.
• Bluetooth beacons. Transmitters in shops an app can range against with permission, for positioning at aisle scale.

An app never sees the Wi-Fi list itself: iOS resolves it internally and returns a coordinate, and reading the name of the network you are joined to needs location permission of its own. Revoking location takes away a lot at once. The exception is your IP address, which needs no permission and gives a rough region for free, and which a VPN moves while moving nothing else.

Where it goes afterwards

An app that collects location may keep it, or may pass it to an advertising or analytics SDK bundled into the app. Those SDKs frequently aggregate across many apps, which is how a company you have never installed anything from ends up holding a history of your movements.

The mechanics are duller than the phrase data broker implies. A developer adds an SDK for ads, crash reporting or attribution, and it arrives with its own network behaviour. Location, where the app has it, is a field that SDK can be configured to include. Ask most developers exactly what leaves their app and the honest answer is that they know what they wrote and take the rest on trust.

How to look at your own phone

App Privacy Report, in Settings, Privacy and Security, logs which apps touched location, camera, microphone and contacts, and which network domains they and their SDKs contacted. The domain list is the interesting half.

Significant Locations, under Location Services then System Services, is Apple's own record rather than any app's: the places your phone decided matter to you, with dates and visit counts. Apple states it is end-to-end encrypted and that Apple cannot read it. It is still an unsettling summary of your last few months, and the fastest way to see what a year of coordinates looks like arranged by place instead of by time.

What I cannot tell you

What an API makes possible is knowable, and most of this page is that. What a company does with what it received is not, and I would rather say so than guess. App Store privacy labels are the usual proposed answer, and developers fill those in themselves, so a label is intent rather than evidence. Retention periods, who a privacy policy's third parties resolve to, and whether a deletion request reaches the backups are things I have not tested, because from a phone there is no way to.

What you can actually turn off

• Precise Location, per app. Settings, Privacy and Security, Location Services, choose the app. Approximate is enough for weather and a store locator and not enough to find your house.
• Always versus While Using. Very few apps need Always. iOS periodically reminds you which ones have it, and that prompt is worth reading rather than dismissing.
• The recent-access list. The same screen shows which apps used location lately. The surprises are the useful part.
• Significant Locations. The screen that shows the history also clears it, and switches off building any more.

None of that makes an app that already holds your history forget it. Those change what happens next, which is worth doing and worth not overrating. The longer walkthrough and the wider picture are both here.

And the more general point: an app that receives a plausible location behaves normally, while an app that receives nothing often nags or degrades. That gap is the reason simulated locations exist at all, rather than people simply switching location off.

Where a simulated location helps, and where it does not

We make a location spoofer, so read this with that in mind. A simulated location changes the contents of the record. It does not change whether a record exists: the app still gets a timestamp, still learns how often you open it, and still sends what it sends to the same places. Feeding a marketing profile another city makes it wrong rather than absent, and a wrong profile on your account is still a profile.

It earns its place in narrower cases: showing one service a city you are not in, testing regional behaviour, or keeping one person's view of you general rather than exact. For the broad problem on this page, the effective tools are the boring ones, and all of them are in Settings.