Location permission distinguishes between always/when-in-use/never
Why it matters
Requesting always-on background location when only foreground location is needed is one of the most common grounds for App Store rejection and a clear GDPR Art. 5(1)(c) data-minimisation violation. Apple's location always permission (NSLocationAlwaysAndWhenInUseUsageDescription) triggers a two-step authorization flow that explicitly warns users their location is tracked in the background — users decline this at far higher rates than when-in-use. On Android 10+, background location requires an additional ACCESS_BACKGROUND_LOCATION permission that triggers a separate, more alarming system dialog. Apps requesting always-on location for features like map display or restaurant search — where when-in-use is sufficient — face Google Play policy strikes and user complaints.
Severity rationale
High because requesting always-on location for features that only need foreground location violates GDPR Art. 5(1)(c), triggers heightened Apple and Google review scrutiny, and causes significantly higher permission denial rates.
Remediation
Default to LOCATION_WHEN_IN_USE for all location features. Only escalate to LOCATION_ALWAYS when a documented background feature (fitness tracking, delivery tracking, geofencing) specifically requires it.
import { request, PERMISSIONS, RESULTS } from 'react-native-permissions'
// Default: request when-in-use
const foregroundResult = await request(PERMISSIONS.IOS.LOCATION_WHEN_IN_USE)
// Only if a background feature genuinely exists:
if (userEnablesBackgroundTracking) {
const backgroundResult = await request(PERMISSIONS.IOS.LOCATION_ALWAYS)
}
In app.json, only add NSLocationAlwaysAndWhenInUseUsageDescription if your app has an active background location feature. Remove the key entirely if the app only needs foreground location — its presence alone triggers additional scrutiny during App Store review.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Permissions & Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-272 — Least Privilege Violation
- gdpr · Art. 5(1)(c) — Data minimisation
- external · apple-location-always — Apple: Requesting Always Authorization for Location Services
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-permissions-privacy·automated