Background location usage is justified and minimized
Why it matters
Background location is the single most scrutinised permission on both iOS and Android. Apple manually reviews every app that requests 'Always' location access, and Google Play requires a separate background location declaration form plus a valid use-case explanation. Under GDPR Art.5(1)(c), collecting precise background location when coarse foreground location would suffice violates the data-minimisation principle (CWE-359). CCPA §1798.100 treats geolocation as sensitive personal information requiring explicit disclosure. Apps that silently collect location in background services or push notification handlers — without user-visible features justifying it — face rejection, removal, and regulatory exposure.
Severity rationale
Medium because background location without justification triggers manual review on both platforms and violates GDPR data-minimisation, but exploitation requires a device already running the app.
Remediation
If background location is not genuinely needed, downgrade from 'Always' to 'When in Use' in Info.plist and remove ACCESS_BACKGROUND_LOCATION from AndroidManifest.xml. If background location is required, write a specific usage description that names the feature:
<key>NSLocationAlwaysAndWhenInUseUsageDescription</key>
<string>Your location is used in the background to send alerts when you arrive at or leave saved places.</string>
For Android, submit the background location declaration form in Play Console (App content → Sensitive app permissions). Remove the permission from the manifest if the feature does not exist — its presence alone triggers scrutiny.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
- gdpr · Art. 5(1)(c) — Data minimisation
- gdpr · Art. 5(1)(b) — Purpose limitation
- ccpa · §1798.100 — Right to know about personal information collected
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated