Open the location settings on almost any phone we’ve tested in the office over the past year and you’ll find at least one app with “always allow” switched on that has no business knowing where you sleep. Usually it’s something harmless-looking, a torch app, a weather widget, a game you downloaded for a long-haul flight and forgot about. None of this means your phone has been hacked. It just means more apps can see your location than you probably realise, because permissions pile up quietly and almost nobody goes back and tidies them.
That’s the job for this afternoon. It takes about twenty minutes, costs nothing, and the payoff is concrete: fewer apps building a timeline of your movements, less data sitting on servers you’ve never heard of, and one less thing to worry about if that company ever has a breach. We’d argue this is more useful than installing another security app, because it deals with a problem you already have rather than one you might get.
Why it matters which apps can see your location
Here’s the bit that doesn’t always get explained properly: location data isn’t just a pin on a map. It’s a pattern. An app that knows where your phone is every few minutes can work out where you live, where you work, what time you leave for the gym, and whether you were at a medical clinic on a Tuesday afternoon. None of that requires your name attached to it, because the pattern itself is identifying enough.
The Office of the Australian Information Commissioner (OAIC) treats location data as personal information under the Privacy Act when it can be linked back to an individual, which in practice is almost always. Apps are supposed to collect only what they need and say what they’re doing with it in a privacy policy. In our experience most Australians have never read one of those policies in full, and honestly, neither have we for every app on our phones. That’s exactly why checking the permission itself, rather than trusting the fine print, is the more useful habit.
Checking location permissions on iPhone
On an iPhone running a current version of iOS, go to Settings, then Privacy & Security, then Location Services. You’ll see every app that has ever asked for your location, sorted with a little arrow icon next to each one showing whether access is set to Never, Ask Next Time, While Using the App, or Always.
That last one, Always, is the setting worth scrutinising. It means the app can track you even when it’s closed, running quietly in the background. For a maps app or a find-my-phone service, that’s the whole point. For a shopping app or a social network, it’s rarely necessary and mostly serves advertising.
Apple also shows a small purple or grey arrow in the status bar when an app has recently used your location, and there’s a “Location Services” history you can tap into for each app to see roughly how often it’s checking in. We’d recommend working through the list app by app and asking a simple question for each one: does this app need to know where I am right now to do its job, or only while I’m actively using it? If the honest answer is “only while I’m using it”, switch it down from Always to While Using. If the answer is “not really at all”, switch it to Never.
Checking location permissions on Android
Android phones vary a bit by brand, Samsung’s Galaxy range and Google’s Pixel line present this slightly differently, but the path is broadly the same. Open Settings, then Location, then look for “App permissions” or “App location permissions”. You’ll get the same four-tier system: Allow all the time, Allow only while using the app, Ask every time, and Don’t allow.
Google has also built in an automatic reset feature on recent Android versions: if you haven’t opened an app in several months, its permissions get revoked on their own. That’s a genuinely sensible default and one we wish more platforms copied, but it only catches apps you’ve abandoned, not ones you still use weekly and simply over-trust.
Worth a specific mention: Android also shows a “Recently accessed” section at the top of the location permissions screen, which lists the apps that have asked for your location in the last 24 hours. If something surprising shows up there, a game, a flashlight, a PDF reader, that’s your cue to dig into its individual settings and wind the access back.
The apps that don’t need it at all
We’ll say something mildly unpopular here: most apps asking for your precise location don’t need precise location. They need a postcode-level guess, at most, to serve relevant ads or show the right weather. Precise GPS tracking, the kind accurate to a few metres, is genuinely required for maps, navigation, ride-share, food delivery while an order is in progress, and fitness apps that track a run. Almost nothing else qualifies.
Social media apps are the ones we’d push back on hardest. Several major platforms request “always” access by default during setup, and plenty of users tap through without reading the prompt. There’s rarely a good reason a social app needs to know your location when it’s sitting closed in the background. If you use one for check-ins occasionally, “while using” covers that completely, you just open the app, let it grab your location for that one post, and it’s done.
Both iOS and Android also let you grant “approximate” rather than “precise” location to apps that insist they need something. Approximate gives a rough area, several kilometres wide, which is plenty for a weather app or a news service that wants to localise content, and it’s a sensible middle ground if you don’t want to flatly refuse an app but also don’t want it pinpointing your street.
A quick pass through your browser too
It’s not just apps. Chrome, Safari and Firefox all ask websites to request location permission separately, and that list builds up the same way app permissions do, one “allow” click at a time, usually because a site wanted to show nearby stores and you were in a hurry.
In Chrome, that’s Settings, then Privacy and Security, then Site Settings, then Location. Safari on iPhone keeps it under Settings, Safari, Location. Give that list the same five-minute once-over. We’ve found old retailer websites and long-defunct services sitting in there with permanent access, which is a bit pointless given you probably haven’t visited in years but the permission never expired on its own.
What to do if something looks wrong
If you find an app with location access you genuinely didn’t grant, or one you don’t recognise at all, that’s a different situation to routine permission creep and worth treating more seriously. Our guide on how to tell if your phone has been hacked walks through the broader warning signs, unexpected battery drain, data usage spikes, apps you didn’t install, and what to do about each one.
For most people, though, what turns up during this check is mundane: apps you installed once, granted broad access to without thinking, and never looked at again. That’s not a security incident. It’s just digital housekeeping that nobody schedules because there’s no reminder for it the way there is for, say, a car service.
If you do find something that looks like deliberate tracking, a stalking-type app hidden under a generic name, unusual background processes you can’t explain, that’s worth reporting. The Australian Cyber Security Centre’s ReportCyber service takes reports on this kind of thing, and the eSafety Commissioner has specific guidance for tech-based stalking and coercive control if that’s the concern.
The bigger picture on location data and privacy
We keep coming back to this point in our coverage of smart home privacy in Australia: the individual pieces of data an app collects, one GPS ping, one Wi-Fi network name, one timestamp, look harmless in isolation. Stitched together over months, they describe a life in uncomfortable detail. Advertising networks buy and sell exactly this kind of aggregated location data, legally, in ways most users never see because it happens several steps removed from the app itself.
This is also why we rate location permission checks above most of the paid “privacy” tools on the market. A VPN hides your internet traffic from your internet provider, not your phone’s own apps, which is a distinction that gets blurred in a lot of marketing. If an app has permission to read your GPS coordinates directly, no VPN in the world stops that.
None of this requires panic, and we’d gently push back on anyone telling you to delete every app that’s ever asked for location access. Plenty of the requests are genuinely reasonable. The goal is matching access to actual need, not stripping it to zero.
Making this a habit, not a one-off
Set a reminder, literally, a calendar note every few months, to run through this same check again. New apps get installed, old ones get updated with new permission requests buried in the changelog, and defaults have a habit of resetting after major operating system updates. We treat this the same way we treat checking your home router settings, not a single fix but routine maintenance that takes less time each round because you’re mostly confirming nothing’s changed.
If you manage a phone for an older relative, this is also a kind, low-friction thing to do on their behalf next time you’re helping them with something else. Most people have never been shown this screen exists. Five minutes on their phone, with their permission obviously, often turns up three or four apps with access they’d happily switch off once it’s explained what “always” actually means.
Our take, for what it’s worth: the fact that this setting is buried two or three menus deep on both major platforms is a bit of a design failure. It should probably surface itself with a prompt every six months or so, the way password managers now nag you about reused passwords. Until that happens, the onus is on us to go looking.
— Em Castellano, Security Writer, Tech Geek
Featured image: AI-generated illustration.
