Despite no ACCESS_BACKGROUND_LOCATION permission, my app is thought to be using background location, what could be the cause?

user_226958 0
Viewed 190

My app (code on GitHub) was rejected by Google Play with reason:

Please remove the background location permission requested and submit an update to your app.

However, my app does not declare the ACCESS_BACKGROUND_LOCATION permission:

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.READ_SYNC_SETTINGS" />
<uses-permission android:name="android.permission.READ_SYNC_STATS" />
<uses-permission android:name="android.permission.REORDER_TASKS" />
<uses-permission android:name="android.permission.WRITE_SYNC_SETTINGS" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS" />
<uses-permission android:name="android.permission.GET_ACCOUNTS" />
<uses-permission android:name="android.permission.USE_CREDENTIALS" />
<uses-permission android:name="android.permission.MANAGE_ACCOUNTS" />
<uses-permission android:name="com.google.android.apps.photos.permission.GOOGLE_PHOTOS" />
<uses-permission android:name="android.permission.SET_WALLPAPER"/>
<uses-permission android:name="android.permission.FOREGROUND_SERVICE" />

I first suspected Mapbox, as my app includes these libraries:

implementation 'com.mapbox.mapboxsdk:mapbox-android-sdk:9.1.0'
implementation 'com.mapbox.mapboxsdk:mapbox-android-plugin-localization-v8:0.11.0'
implementation 'com.mapbox.mapboxsdk:mapbox-android-plugin-scalebar-v9:0.4.0'
implementation 'com.mapbox.mapboxsdk:mapbox-android-telemetry:6.1.0'

However my app checks location only when the app is running fully visible on the screen.
Also, the merged manifest shown by Android Studio does not include ACCESS_BACKGROUND_LOCATION:

Merged manifest Android Studio

It seems that setting android:minSdkVersion="29" would circumvent the issue, but I can't do it as I have thousands of important users below that.

I also tried adding a popup disclaiming that the app uses location in the background (even though it does not), but that gets rejected too, with this reason:

It is possible to deliver a similar experience without access to location in the background.

Question: What could be making someone think that I use location in the background?

android-permissions google-play android-manifest geolocation android
1 Answers

From the official Privacy changes in Android 10

Access granted automatically when targeting Android 9 or lower

If your app runs on Android 10 or higher but targets Android 9 (API level 28) or lower, the platform applies the following behavior:

  • If your app declares a <uses-permission> element for either ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION, the system automatically adds a element for ACCESS_BACKGROUND_LOCATION during installation.

  • If your app requests either ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION, the system automatically adds ACCESS_BACKGROUND_LOCATION to the request.

Access when device is upgraded to Android 10

If a user grants your app access to device location – either ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION – then upgrades their device from Android 9 to Android 10, the system automatically updates the set of location-based permissions granted to your app. The set of permissions that your app receives after the upgrade depends on its target SDK version and its defined permissions, as shown in the following table: here

In other words, it all depends on your Target platform version.

user_6340940
Related