A security researcher has discovered that the iPhone 11 Pro still collects location data, even when the user has set it not to. Apple told the researcher that this is “expected behavior.”
KrebsOnSecurity identified the issue and reported it to Apple. Apple’s response implies that “certain system services” continue to collect location data, even when the user has selected “Never” for all individual apps and services.
One of the more curious behaviors of Apple’s new iPhone 11 Pro is that it intermittently seeks the user’s location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds with the company’s own privacy policy […]
The policy [says in part]: “You can also disable location-based system services by tapping on System Services and turning off each location-based system service.” But apparently there are some system services on this model (and possibly other iPhone 11 models) which request location data and cannot be disabled by users without completely turning off location services, as the arrow icon still appears periodically even after individually disabling all system services that use location.
If the user turns off Location Services completely, the iPhone does not collect location info. However, if you go into the Settings app and go to “Privacy” -> “Location Services” and individually toggle off the setting for every single app, and then scroll down to System Services and toggle all of those off too, your iPhone will still check your location occasionally.
Apple responded to the security researcher, saying there are system services that don’t have a switch in the Settings app that will access you location occasionally.
“We do not see any actual security implications,” an Apple engineer wrote in a response to KrebsOnSecurity. “It is expected behavior that the Location Services icon appears in the status bar when Location Services is enabled. The icon appears for system services that do not have a switch in Settings.”
This is a bit surprising, as Apple’s own privacy policy and the Settings app itself implies iPhone users can get granular control over sharing their location.
A video demo below, created by Krebs, shows how even though individual location toggles were turned off, the iPhone still access the user’s location when it connects to Wi-Fi and mobile data.