Apple explains why the iPhone 11 is requesting location data without permission

Apple has finally clarified a peculiar and unsettling privacy issue with its newer iPhone 11 and iPhone 11 Pro models regarding location tracking. After security expert Brian Krebs revealed earlier this week that the latest iPhones request location data even when a user has toggled the appropriate privacy settings to avoid sharing that information, Apple is now telling TechCrunch that the culprit is its new ultra wideband technology. The company says it will provide a way to disable that in a future update, TechCrunch reports.

“Ultra wideband technology is an industry standard technology and is subject to international regulatory requirements that require it to be turned off in certain locations,” an Apple spokesperson said in a statement to TechCrunch. “iOS uses Location Services to help determine if iPhone is in these prohibited locations in order to disable ultra wideband and comply with regulations… The management of ultra wideband compliance and its use of location data is done entirely on the device and Apple is not collecting user location data.”

With the introduction of the iPhone 11 back in September, Apple said it had included a new U1 chip in the phone and its Pro variant so that it could do localized communication with other U1 devices without needing to bounce a signal to cell towers or satellites. “Think GPS at the scale of your living room,” Apple has described it. “So if you want to share a file with someone using AirDrop, just point your iPhone at theirs and they’ll be first on the list.”

It’s effectively a better form of Bluetooth, and it’s the foundation of some new features in iOS like the more precise, location-dependent AirDrop. It’s highly likely that the U1 chip will also enable the rumored Apple Tag, a Tile-like device for finding lost objects that is supposedly coming soon.

It’s also, however, causing the latest iPhones to request location data even when the user has explicitly said they do not want to share it, as Krebs found. According to his blog post, Krebs reached out to Apple in November after coming across the discrepancy with the intention of reporting it as a bug. Krebs says Apple’s response was a curious one:

This week Apple responded that the company does not see any concerns here and that the iPhone was performing as designed.

“We do not see any actual security implications,” an Apple engineer wrote in a response to KrebsOnSecurity. “It is expected behavior that the Location Services icon appears in the status bar when Location Services is enabled. The icon appears for system services that do not have a switch in Settings” [emphasis added].

Apple has not yet responded to follow-up questions, but it seems they are saying their phones have some system services that query your location regardless of whether one has disabled this setting individually for all apps and iOS system services.

Now, to clear up the matter, TechCrunch has Apple on the record saying this is all due to the ultra wideband-focused U1 chip. It’s not immediately clear what Apple means when it says “international regulatory requirements that require it to be turned off in certain locations.” But Apple is saying that it’s not collecting or storing this info and that this check is happening on the device itself only. TechCrunch reports that the company will include some sort of toggle to turn this off in the future, although that would seem to be difficult if it gets in the way of “international regulatory requirements.”