Which apps track your location? A ten-minute family audit

The four levels of location permission

Before touching a settings screen it helps to know what you are choosing between, because the labels are similar and the differences are large.

• Never. The app cannot read location at all. Correct for the large majority of apps, including most games, shopping apps, banking apps and social media.
• Ask Next Time or Once. A single session of access, then it reverts. Useful for an app you need to find a nearby branch exactly one time.
• While Using. Location only when the app is open on screen. This is the right answer for most apps that genuinely need it, including maps, ride hailing and food delivery.
• Always. Location in the background, when the app is closed. Only justified for a small handful: a family locator, a fitness tracker that records routes automatically, and possibly a home automation app.

There is a second, separate control that matters just as much. Precise location, called precise on iOS and approximate on Android, decides whether the app receives your exact coordinates or a rough area a few kilometres across. A weather app, a news app and a store locator all work perfectly well with the approximate version.

An app gets background location only if it is useless without it. Everything else gets While Using, or Never.

The audit on iPhone

1. 1Open Settings, then Privacy and Security, then Location Services.
2. 2You will see every app that has ever asked, with its current setting listed beneath the name. Scroll the whole list once before changing anything.
3. 3Tap any app to change it. Each app's page shows the four options plus a Precise Location toggle at the bottom.
4. 4Look for a small arrow icon next to an app name in the list. A filled purple arrow means it used your location recently, a hollow one means it used it in the last day, and a grey arrow means it can use it under certain conditions.
5. 5At the very bottom of Location Services, open System Services and review that list too, then check Significant Locations inside it, which is a history of places you frequently visit stored on the device.

Significant Locations surprises almost everyone the first time. It is stored on the device and encrypted rather than sent anywhere, and it is what powers predictions like your commute time. You can look at the list, clear it, and turn it off, all from that screen.

The indicator dot

While you are using the phone, a small arrow appears in the status bar whenever an app reads your location live. It is easy to ignore because it is tiny, but it is the most honest signal on the phone. If it appears while you are doing something that has nothing to do with location, note which app you had open and check its permission afterwards.

The audit on Android

1. 1Open Settings, then Location, then App location permissions. Exact wording varies a little by manufacturer.
2. 2Apps are already grouped for you into Allowed all the time, Allowed only while in use, Ask every time, and Not allowed. The first group is the one that matters.
3. 3Tap any app to change the level, and use the Use precise location toggle on the same page.
4. 4Go back to the Location screen and open Location services to review Wi-Fi scanning, Bluetooth scanning and Google Location Accuracy, all of which improve accuracy and all of which collect more signals.
5. 5In Privacy, check the Privacy dashboard, which shows a timeline of which apps accessed location in the last 24 hours. This is the fastest way to catch something unexpected.

Android also shows a small green dot or icon in the top corner when location, camera or microphone is in use. Pulling down the notification shade while it is showing tells you which app is responsible.

One Android specific note. Some apps ask for Always access through a second dialog that appears after you have already granted While Using. If an app you barely use is sitting in the Allowed all the time group, it almost certainly got there through that second prompt, and you can move it down without breaking anything you care about.

Spotting the ones that should not be there

Once you have the list in front of you, most of the decisions make themselves. These are the patterns I look for first.

The reason to care is not that any single app is sinister. It is that background location produces a continuous record of where a person and their household are, and that record has commercial value, so it circulates. Reading an app's own disclosure about this is a separate skill, covered in how to read app privacy labels.

Doing it with your kids, not to them

Here is the part that decides whether this becomes an annual habit or a single tense evening. If you take a teenager's phone and go through their permissions alone, you have run a search. If you sit next to them and go through your own phone first, you have run a lesson.

Start with yours. Say out loud what you find, including the embarrassing bits, because there will be some. A parking app from a holiday two years ago with Always access is a better teaching example than anything I can write here.

1. 1Do the adult phone first, narrating the decisions and why.
2. 2Hand the phone over and let the child drive their own audit while you talk through the list.
3. 3Let them make the calls on borderline apps. If they want to keep a fitness app on Always because it tracks their runs, that is a correct decision and you should say so.
4. 4Agree the one exception together, which is the family locator, and be explicit about what it shows and to whom.
5. 5Put a repeat in the calendar for three months from now.

The fourth step is where credibility is won or lost. If you are asking a teenager to scrutinise other apps' access to their location, you should be able to explain your own app's access in one sentence. Ours is that the family sees each other's current location and recent history, everyone can see who is looking, and anyone can turn it off, which is spelled out in who can see my location.

What a family locator legitimately needs

A location sharing app is the rare case where Always access is the honest requirement. Arrival alerts, place notifications and a location that is current when someone actually needs it all depend on the app being able to report while it is closed. On While Using it would only update when someone happened to have it open, which defeats the purpose.

That is a real cost and it should buy real transparency. The tests I would apply to any family app, including ours, are these: can every member see who can see them, can any member turn sharing off without asking permission, is history visible to the person being tracked as well as the parent, and is the data sold. Be Closer is free to download, available in 13 languages, and reports with up to 95% accuracy in good conditions, and none of those numbers are the point. The point is that a family app earns its background permission by being legible to the people in it.

If you want a short set of household rules to go alongside the audit, one sentence privacy rules for families is the companion piece to this one.

Make it seasonal

Once a season is about right, and tying it to something you already do makes it stick: the start of a school term, the clocks changing, a holiday. Ten minutes, four times a year. After the first audit the later ones take five, because the list barely changes.