According to a 2023 Mozilla Foundation report, 80 percent of the most popular apps on the Google Play Store share or sell user data to third parties, and most users have never once opened their location permissions settings.

That number stopped me cold when I first read it. Not because it is surprising in theory, but because of what it means in practice: right now, on your phone, apps you downloaded and forgot about are almost certainly watching where you go. Not guessing. Knowing.

I dug into the actual research so you do not have to. Here is what I found.

Did You Know: The average smartphone user has 80 apps installed. A 2022 study by Incogni found that 45 percent of those apps request location access, and fewer than half of those have any functional reason to need it.

1. “Always On” Location Access Is the Setting Nobody Audits

Most people grant location access once, during setup, when they are eager to get the app working. They never go back. Think of it this way: it is like handing a contractor your house key to fix the sink, and then forgetting you gave it to them. The job is done. The key still works. The contractor can still come back anytime they want.

“Always On” location permission means an app can track your precise GPS coordinates continuously, even when the app is closed and sitting in your background. Not your neighborhood. Not your city. Your precise coordinates, updated in real time.

Ask yourself why they do not advertise this part.

2. Life360 Is the Most Visible Example of a Bigger Problem

Life360 markets itself as a family safety app. Parents use it to track their kids. That part is visible and consensual. But in 2021, a joint investigation by The Markup and Motherboard revealed that Life360 was selling precise location data from its users, including minors, to a network of data brokers, including companies in the auto insurance industry.

Do you actually know which apps on your phone right now have Always On location access?

The company has since updated its data-sharing practices following public pressure, but the incident exposed something the app industry would prefer you not think about: the product was never really the family tracking feature. The product was the location data itself. Convenient, right?

Quick Fact: Data brokers in the U.S. operate in an almost entirely unregulated market. A 2023 report by the Federal Trade Commission found that major data brokers collected location data from hundreds of millions of devices without consumers’ knowledge.

3. Coupon and Retail Apps Are the Sneakiest Offenders

Here is what this actually means for you: that grocery coupon app you downloaded for one shopping trip two years ago, yes, those still ask for location, and many have it set to Always On by default. These apps have no functional need for your real-time GPS. A coupon does not require the app to know you are sitting in your car in a parking lot at 11pm.

A 2023 analysis by Privacy International identified retail and coupon apps as among the highest-risk categories for unnecessary background location access. The data gets sold. Your shopping habits, your daily routes, your home address, all of it gets reconstructed from location pings.

4. The Precise vs. Approximate Location Distinction Actually Matters

Both iOS and Android now give you the option to share only your approximate location with apps, rather than your precise GPS coordinates. Approximate location places you within a roughly 3-kilometer radius. Precise location can put you within a few meters.

Most apps default to requesting precise location. Most users accept it without reading. For weather apps, food delivery, and navigation, precise location makes sense. For a news app, a fitness tracker running in the background, or a retail loyalty card? It does not. Switching these apps from precise to approximate is a one-tap fix that meaningfully reduces your exposure without breaking any functionality you actually use.

Warning: When you download a new app and it immediately asks for location access before you have even seen the interface, that is a red flag. Legitimate apps ask for permissions at the moment they need them, not upfront as a condition of entry.

5. Bluetooth and Wi-Fi Scanning Can Track You Without GPS

This one catches people off guard. Even with location services turned completely off, some apps use Bluetooth and Wi-Fi scanning to triangulate your position. Your phone detects nearby networks and devices, compares that data to known signal maps, and produces a surprisingly accurate location estimate.

Android has a specific setting, buried under Location > Wi-Fi and Bluetooth Scanning, that controls this separately from your main location toggle. On most phones it is enabled by default. The scanning runs even when Wi-Fi is off. That is not a bug. That is a design choice.

6. App Permissions Reset When Apps Update

This is the one that trips up even careful users. You audit your permissions, revoke what you do not want, and feel good about it. Then the app pushes a major update, and in some cases, permissions you previously denied get quietly re-requested or re-enabled through new feature prompts.

Android is more susceptible to this than iOS, but neither platform is immune. The practical fix is simple: after any significant app update, check whether your permission settings for that app have changed. It takes twenty seconds. Most people never do it.

7. The Permission Audit Most People Have Never Done

A full location permission audit takes about eight minutes. Here is how to do it on each platform.

On iPhone (iOS 14 and later):

Step 1: Open Settings, then scroll to Privacy and Security. Step 2: Tap Location Services. Step 3: Review every app in the list. Any app showing “Always” that you did not deliberately set to Always is worth questioning. Step 4: Tap the app, then change the setting to “While Using” or “Never,” and switch Precise Location off unless the app has a clear need for it.

On Android (varies slightly by manufacturer):

Step 1: Open Settings, then tap Location. Step 2: Tap App Permissions (sometimes labeled “App Location Permissions” depending on your device). Step 3: You will see three categories: Allowed all the time, Allowed only while in use, and Not allowed. Open “Allowed all the time” first. Step 4: Work through each app in that list. For any app that does not have an obvious background need (navigation, safety, or health monitoring), tap it and change the setting to “Allow only while using the app” or “Deny.” Step 5: Return to the main Location screen and check whether Wi-Fi and Bluetooth scanning are enabled under the additional location settings menu. Turn them off unless you have a specific reason to keep them on.

The whole process takes under ten minutes, and it immediately reduces your passive data exposure in a way that no privacy policy reading or app store rating will ever accomplish.

Your Next 3 Steps

You have the information. Here is how to use it before this tab closes and real life takes over.

Step 1: Open Location Services right now, before you open another app today, and screenshot every entry marked “Always.” That screenshot is your baseline. You will want it in 90 days.

Step 2: Revoke “Always” access from every app that has no legitimate background need. Start with games, coupon apps, retail loyalty apps, and anything you downloaded once and rarely open. Do not overthink it: if you cannot name a reason it needs your location while closed, remove it.

Step 3: Set a 90-day calendar reminder titled “Permission Audit” for today’s date, three months out. Apps update. Permissions reset. New apps slip through. One recurring reminder closes the gap that one-time audits always leave open.

Eight minutes today. Twenty seconds after every major update. One reminder on the calendar. That is the entire system. And it works better than anything a privacy app will sell you.