Privacy Tools Guide

Many Android apps track your location in the background even when closed, including weather apps, fitness trackers, social media platforms, and navigation services that maintain background location permission. You can audit which apps access location with “Allow all the time” permission in Android Settings and deny background location access individually per app. Understanding how background location differs from foreground location and which apps are tracking you enables you to reclaim location privacy.

Background Location vs Foreground Location

Android differentiates between foreground location access (when the app is actively displayed on screen) and background location access (when the app runs without visible interaction). Apps with background location permission can access your coordinates even when minimized, in the app drawer, or completely closed. This distinction matters because background tracking consumes significantly more data about your movements and often occurs without explicit user awareness.

When you grant “Allow all the time” location permission in Android 10 and later, you explicitly permit background location access. Android displays a warning dialog explaining that the app can access your location even when you’re not using it—a transparency measure that many users approve without fully understanding the implications.

Common Categories of Background Location Trackers

Several app categories exhibit particularly aggressive background location behavior:

Weather applications frequently maintain background location access to update forecasts based on your current position. While this provides genuine convenience, the continuous access generates detailed location histories that may extend beyond what users expect.

Fitness and health apps require background location for tracking runs, walks, and cycling sessions. These apps often accumulate years of location data creating movement profiles.

Social media platforms represent some of the most aggressive background location collectors. Applications like Facebook, Instagram, and TikTok have faced scrutiny for accessing location data in the background for advertising targeting and user profiling purposes.

Shopping and retail apps increasingly request background location to monitor store visits, track shopping habits, and deliver location-based advertising. Major retail applications have been documented collecting location data even when users explicitly denied permission.

Navigation and ride-sharing apps naturally require background access for turn-by-turn directions and driver matching. However, these apps may retain location data long after the ride ends.

News and content aggregation apps sometimes request background location to deliver geographically targeted content and advertising, despite having no obvious location-dependent functionality.

Technical Implementation of Background Tracking

Android provides developers with several APIs for implementing background location access:

// Request background location permission after foreground permissions
if (ContextCompat.checkSelfPermission(this, Manifest.permission.ACCESS_BACKGROUND_LOCATION)
    != PackageManager.PERMISSION_GRANTED) {
    ActivityCompat.requestPermissions(this,
        arrayOf(Manifest.permission.ACCESS_BACKGROUND_LOCATION),
        BACKGROUND_LOCATION_REQUEST_CODE)
}

The ACCESS_BACKGROUND_LOCATION permission requires that the app already holds either ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION. Once granted, background location updates continue until explicitly revoked through device settings.

Location updates in the background arrive through the LocationCallback mechanism:

locationCallback = object : LocationCallback() {
    override fun onLocationResult(locationResult: LocationResult) {
        // Process location data
        val latitude = locationResult.lastLocation.latitude
        val longitude = locationResult.lastLocation.longitude

        // This executes even when app is not visible
        sendLocationToServer(latitude, longitude)
    }
}

Developers must declare the android:foregroundServiceType="location" permission in their manifest when requesting location updates from a foreground service—a requirement introduced in Android 10 to provide users visibility into actively running location services.

Auditing Which Apps Track Your Location

Android provides built-in tools for auditing background location access:

  1. Privacy Dashboard (Android 12+): Navigate to Settings > Privacy > Privacy Dashboard to view which apps recently accessed location data, including timestamps and access duration.

  2. Location Permissions Page Settings > Location > App Permission Settings displays each installed app with its current location permission level. Apps permitted for “Allow all the time” appear at the top with a location icon.

  3. Permission Manager Settings > Privacy > Permission Manager > Location provides granular control over individual app permissions.

For developers and power users seeking deeper insights, the adb command reveals precise permission states:

adb shell dumpsys package com.example.app | grep -A 10 "android.permission.ACCESS_BACKGROUND_LOCATION"

This command displays the permission grant state, last access timestamp, and frequency of background location access for any installed application.

Practical Mitigation Strategies

Revoking background location access while maintaining foreground functionality represents the most practical balance between privacy and utility:

// Check if app has background location permission
fun hasBackgroundLocationPermission(context: Context): Boolean {
    return ContextCompat.checkSelfPermission(
        context,
        Manifest.permission.ACCESS_BACKGROUND_LOCATION
    ) == PackageManager.PERMISSION_GRANTED
}

Users can downgrade permissions from “Allow all the time” to “Allow only while in use” through Settings > Location > App Permission Settings by selecting the specific app and choosing the appropriate option.

Work Profile creation provides additional isolation. Android work profiles create a separate container where apps operate with distinct permissions, allowing you to grant background location to work apps while restricting personal applications.

Third-party firewall applications like NetGuard or Island (for Samsung devices) can block network connections from specific applications, preventing location data from transmitting even when the app possesses background location permission.

For applications that genuinely require background location, reducing location accuracy to “Coarse location” rather than “Precise” limits the data collected while maintaining basic functionality:

<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />

What Developers Need to Know

Building privacy-respecting location features requires intentional design decisions:

  1. Request background location as a secondary step after establishing foreground necessity—users should understand why background access is needed before granting it.

  2. Provide clear explanations in permission rationale dialogs describing exactly when and why background location will be used.

  3. Implement geofencing as an alternative where possible—Android’s Geofencing API triggers callbacks only when entering or exiting defined regions, reducing continuous tracking.

  4. Respect user revocation by checking permission status before each background location operation and gracefully degrading functionality when access is removed.

  5. Minimize data retention by processing location data locally or deleting it promptly rather than accumulating extensive histories.

Detecting Hidden Location Access

Some apps have been documented requesting location permission but actually transmitting data through indirect methods:

Disabling WiFi scanning and Bluetooth when not actively used prevents these alternative tracking vectors.

Real-world examples show how major applications handle background location:

Social Media Applications

Facebook/Meta:

Instagram:

TikTok:

Fitness and Health Apps

Strava:

Apple Health:

Google Fit:

Google Maps:

Uber/Lyft:

Audit Process

Step 1: Android 12+ Privacy Dashboard Analysis

# Access Privacy Dashboard programmatically
# This shows which apps accessed location recently
adb shell dumpsys usage.UsageStatsManager

# Parse for location access records
adb shell dumpsys package | grep -A 5 "ACCESS_FINE_LOCATION"

Step 2: Permission Manager Deep Inspection

For each app with location permission:

# Detailed permission grant status
adb shell dumpsys permissionmgr | grep -A 10 "com.app.name"

# Check if permission is flagged as high-risk
# Apps with ACCESS_BACKGROUND_LOCATION should be manually reviewed
adb shell settings get secure location_providers_allowed

Step 3: Manifest Analysis for Third-Party Apps

If you have app source code or decompiled APK:

<!-- Check for these permissions in AndroidManifest.xml -->
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" />

<!-- Also check for less-obvious location methods -->
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
<!-- WiFi scanning enables coarse location without location permission -->

Step 4: Network Traffic Analysis

Monitor what data apps transmit after location collection:

# Capture and analyze network traffic
adb shell tcpdump -i any "tcp or udp" -w /sdcard/network.pcap &
# Use app for 5-10 minutes
# Kill tcpdump (Ctrl+C)
# Analyze with Wireshark on desktop:
wireshark network.pcap

# Look for:
# - API calls to location services (format: latitude,longitude)
# - Geohash encoding (typical: "u1234567890abc")
# - Server endpoints suggesting location analytics

Advanced Mitigation Strategies Beyond Permission Denial

Custom Location Spoofing

For apps that genuinely need location but you want to limit precision:

// Mock location provider (requires mock location permission)
// This spoofs location to a safe default address
val mockLocation = Location("MockProvider").apply {
    latitude = 40.7128  // NYC coordinates, generic
    longitude = -74.0060
    accuracy = 50f      // Rounded to 50 meters
}

Enable mock locations through Developer Options, then use apps like “Fake Locations” to spoof coordinates.

WiFi-Only Mode with Coarse Geolocation Degradation

# Force coarse location only (network-based, lower precision)
adb shell settings put secure location_providers_allowed -gps

# This disables GPS, forcing apps to use WiFi/cell tower location
# Accuracy degrades to 100-500 meters instead of 5-10 meters

Application-Level Network Blocking

Using NetGuard or similar network firewall:

# Block network access for high-risk location apps
# Example: YouTube app (tracks location for recommendations)
# Within NetGuard:
# Settings -> Apps -> YouTube -> Block internet access

This prevents location data transmission even if the app collects it.

Work Profile Isolation

Create a separate work profile for privacy-sensitive apps:

# Android 12+ step-by-step:
# 1. Settings -> Accounts and backup -> Work area
# 2. Create work profile
# 3. Install privacy-respecting apps in work profile:
#    - Maps: StreetComplete (OSM-based, no tracking)
#    - Navigation: Magic Earth (offline maps, no tracking)
#    - Fitness: Fittr or Strava with no location permission

Work profiles enforce separate permission sets, allowing strict isolation.

Building Privacy-First Location Workflows

Alternative Navigation

Instead of Google Maps (which logs all searches and routes):

Alternative Fitness Tracking

Instead of Strava (public activity exposure) or Google Fit:

Alternative Weather

Instead of Weather apps with background location:

Detecting Deceptive Location Claims

Some apps claim to need background location but actually use it for advertising:

# Apps that claim "weather" but request location:
# WeatherChannel, Weather.com, Weatherbug
# These all collect location for ad targeting

# Apps claiming "music" but request background location:
# Spotify, Apple Music, YouTube Music
# These track location for venue and concert recommendations

# Apps claiming "reading" but request location:
# Kindle, Apple Books, Wattpad
# These track location for targeted advertising

When an app’s declared purpose doesn’t justify background location access, deny it and use an alternative.

Permission Regression and Monitoring

Periodically audit whether apps have escalated permissions:

# Create a monthly permission audit
#!/bin/bash
# Save current state
adb shell pm list packages > installed_apps_$(date +%Y%m%d).txt
adb shell dumpsys package | grep -E "android.permission.ACCESS.*LOCATION" > perms_$(date +%Y%m%d).txt

# Compare to previous month
diff perms_$(date +%Y%m%d).txt perms_$(date -v-1m +%Y%m%d).txt
# Review any new background location grants

Run this monthly to catch silent permission escalations during app updates.

Understanding background location access enables you to audit which apps track you when not open and implement practical restrictions. Regular permission reviews, careful app selection, and using Android’s built-in privacy controls provide meaningful protection against unnecessary location surveillance while preserving functionality for applications that genuinely need it.

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides