Location Without the Location Permission
Declining the location permission stops an app from reading your GPS coordinates. It does not make you unlocatable, because several signals that imply roughly where you are require no permission at all: the IP address every request arrives from, your device’s time zone, and your language and region settings. Together those normally place you in a city or region, and nothing in the permission system gates any of them.
This is not a loophole. It is the ordinary consequence of connecting to a server, and understanding it prevents a specific false confidence.
The three signals nobody prompts for
Each is available to any server you connect to, or any app running on your device.
Your IP address is attached to every request by the network, not by the app. Commercial geolocation databases map address ranges to locations with accuracy that varies from a neighbourhood to a country — usually good at city level on fixed broadband, vaguer on mobile networks where addresses are shared across wide areas. There is no way to send a request without one.
Your time zone is a device setting any app can read. It narrows you to a band of longitude and, combined with an IP range, is usually confirmatory.
Your locale: language, region format, currency, calendar. These are set at the device level and readable without permission. A region setting is often a stronger signal of where someone actually lives than their current IP address is.
Together these are enough for the purposes most apps have: showing prices in the right currency, complying with regional rules, routing to a nearby server, and populating analytics with a country and city. None of that needs GPS, which is why declining location access rarely breaks anything.
What the permission actually adds
The location permission gates precision and continuity, and those are the parts worth withholding.
Precise coordinates, accurate to metres rather than kilometres. That is a categorically different thing from a city — it identifies an address.
Background access, meaning a movement history rather than a point. This is the genuinely sensitive grant and it is a separate choice on both platforms.
Approximate mode. Both platforms now offer to give an app a deliberately coarsened location instead of a precise one. For an app with no legitimate need for your address, this is the right answer when you want a location feature to work at all.
A companion app generally has no need for any of it. If one asks, the request is worth a second look, along with the rest of the permission surface described in what a permission prompt actually grants.
Why “we don’t collect your location” can be true and misleading
An operator can accurately say it does not request the location permission while its logs contain an IP-derived city for every session, because those are different things in both engineering and policy terms.
Read policies for the word “inferred”. Language about approximate or derived location, or about IP address processing, covers this. A policy that discusses location only in terms of device permissions is describing a subset.
Analytics providers do this by default. A standard analytics integration resolves IP to a country and city with no configuration, which means the data exists whether or not the operator thought about it. This is ubiquitous across the entire web and app ecosystem, not a property of this category.
What a VPN does and does not change
A VPN substitutes its exit address for yours, which changes the IP-derived location and nothing else.
Your time zone and locale still say where you are. An app seeing an IP in one country and a device time zone from another has a visible inconsistency, and some services treat that as a signal in itself.
A logged-in account is still your account. Changing your apparent network location does not change who the operator knows you are, so this affects network-level observers and geographic gating rather than what an operator can associate with you.
Region-based pricing and availability are usually tied to your store account, not to your current IP, so a VPN typically will not change them. That is a store policy rather than a technical limitation.
Treat a VPN as a tool for hiding destinations from a network operator, which it does well. It is not a privacy measure against a service you are signed into.
Verifying it yourself
Two checks are available and both are quick.
The privacy log will show whether an app actually accessed location, as opposed to having permission to; see reading your phone’s privacy dashboard. An app with the permission that never uses it is a different situation from one that samples continuously.
Turning the network off demonstrates how much of the app depends on contacting a server at all, and by extension how often it is in a position to attach an IP address to anything. That test is described in what airplane mode tells you about an app.
What this does not tell you
Location inference tells you that a rough position is unavoidable. It does not tell you what any given operator does with it, how long they keep it, or whether it is joined to anything else — those are retention and policy questions and there is no device-side way to answer them.
It also is not a reason to treat the location permission as pointless. The gap between a city and a street address is the entire distance between an anonymous session and an identified home, and refusing precise and background access closes it. Declining the permission is worth doing; believing it makes you invisible is the mistake.