THIS IS A STUDY IN DISINFORMATION. Each paragraph in this article contains facts, but the overall story is A LIE. Find the simple truth at the end of this article. Would you be fooled otherwise?
Today, I encountered a curious thing. I was driving down the highway nearby Warsaw Chopin Airport when I received a push notification from Fligthradar24. It was welcoming me to the airport as if I had walked through the main gates. Well, that’s a funny glitch, I thought. But then I wondered – how did they do it? I have Flightradar24 background app refresh disabled, I have location access set to “While Using” and the app was not in the recently active apps. I also have a habit of always manually closing location apps after use. Technically, this should not have happened. Or the iOS Settings app is misleading me to think I disabled something I did not.
After asking on HN and some Googling, I encountered these two tweets. Apparently, Flightradar24 “[uses] a service from Apple which allows [them] to predefine areas (airports) and when your device is in the area, the notification is sent automatically. You can disable these alerts under Alerts in the [Flightradar24] app.”
Hmm… so this means, allowing an iOS app to use your location only “While Using”, unexpectedly also allows it to track you in the background, but only in specific locations defined by geographic circles.
It’s a “feature” of Core Location called monitoring user’s proximity to geographic regions that Apple offers to iOS developers. Each app installed on your iPhone, with at least “While Using” location access, can define up to 20 geographic circles of a given radius – in short, use geofencing.
Moreover, since this service has limited capacity, Apple advises developers to follow user’s location from one region to another.
What’s the edge case? Technically, with a good learning algorithm, Flightradar24, or any other app that has “While Using” location access, could discover and monitor 20 significant locations per every single one of their users! I mean, when you think about it, do you even have more than 20 locations you visit frequently?
Now, in the iOS Settings > Privacy > Location > System Service there’s also an option called Location-Based Alerts but that does not impact third-party apps like Flightradar24. With Location-Based Alerts disabled, but “While Using” location access, Flightradar24 still has access to that Core Location proximity monitoring.
My problem is basically semantic. I mean, yes, Flightradar24 explicitly states that location access will be used to “show you nearby flights and airports” among other things. But as you can see below, wouldn’t you expect this to happen only “While Using the App” ? I mean, this is what I selected. Instead, it happens in the background.
The Apple documentation seems to contain a mistake or a misinterpretation here. With Background App Refresh disabled Flightradar24 was still able to send me a notification. Even if I did not launch it in the last few days.
Some may argue that the iOS Settings UI is indeed semantically correct here. Giving “While Using the App” access, and then having that app relaunched in the background by iOS system to handle region boundary crossings is, in fact, “While Using the App”. Just not by you, but by the System.
I’m not saying this is pure evil. It is not, I gave Flightradar24 access to my location when I’m using the app. However, I did not give access to monitor my presence in specific locations unknown to me that could change and be personalised according to my movements. If I wanted that, I’d give Flightradar24 an “Always” location access and ride the tracking train blissfully.
What I’m saying is, this is sneaky. But sadly, very expected on the Internet today. Threats to privacy have already been clear a decade ago but consumerism is a hell of a drug. Moreover, this behaviour is not very in line with Apple’s privacy focus campaign. Or is it just a marketing stunt after all?
The truth is in fact far simpler. Flightradar24 app has scheduled a trigger condition that causes a notification to be delivered when the user’s device enters a specified geographic location. Called UNLocationNotificationTrigger, this trigger operates on the iOS system level, if you give location access to the iOS System. It is fired locally without contacting Apple servers and without notifying Flightradar24. Once the notification appears, the user has a choice to either open it, launch Flightradar24 and give it location access as a result; or ignore the notification and keep the location private. A positively sneaky solution, indeed. Nice job, Apple.
