34

Whenever I try to connect my Samsung Galaxy S6 with Android 6.0.1 to a Bluetooth enabled device, it tells me to enable "location services".

When I complained about this, the software vendor replied: "Recent updates to the Google Android API affecting Bluetooth LE technology requires location permissions to be granted in order to use the app."

I fail to see the need for this.

This discussion talks about this. The technical reference says the apps need to have certain permissions, not that location services be active.

To access the hardware identifiers of nearby external devices via Bluetooth and Wi-Fi scans, your app must now have the ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION permissions

Question: Does this mean the software vendor's statement is incorrect?

Improve this question
3
  • The permission system is definitely completely borked with the MM restructuring (explanations say they had "Bluetooth beacons" in mind which could be used to locate you). To my understanding, your doubt is justified and the vendor's statement incorrect: Apps need the permission in order to access Bluetooth. But if they need a location service to find the hardware ("turn right on the second solder joint, pass the transistor at gate 3…"), I'd be surprised. I very much doubt location services need to be enabled for that, but I have no MM device to verify.
    – Izzy ♦
    Oct 21, 2016 at 15:42
  • Can't add an "answer" so here it is as a "comment": I run Android 11 on a Galaxy and have a Huawei watch, but it probably is the case in general: It seems that Location is required to pair >>or connect without pairing<<, and the app (Huawei Health) does the latter, it never pairs (on Bluetooth level), so location is required every time. To fix that: revoke location permission from the app and toggle bluetooth off and on to disconnect; install "NRF Connect" from Play Store, start it, enable location, find your device in the list, tap three dots and then "bond". Now it connects without location.
    – EvgEnZh
    May 24, 2021 at 17:34
  • [the above comment continued] The app (Huawei Health) keeps complaining about requiring location, but connects and works anyway when location is disabled. The side effect is that bluetooth icon stays in the status bar and the watch appears in the list of bluetooth devices in Android settings, which doesn't happen when connecting through the app without pairing. I normally see that icon only when connecting BT headphones so I'm a little annoyed it no longer indicates that.
    – EvgEnZh
    May 24, 2021 at 17:42

6 Answers 6

Reset to default
11

My understanding of Bluetooth is that applications using Bluetooth have direct access to the device MAC address for the purpose of pairing. I will assume this for this answer.

If you can read MAC addresses of WiFi or Bluetooth transmitters, you can locate a device. This is how WiFi/Bluetooth location works; you listen for MAC addresses of transmitters and look these up in a giant global database.

Therefore, any application using Bluetooth and a data connection is theoretically capable of locating your device. I am not sure this is practically possible; Bluetooth does not have the same range and semi-permanent access point infrastructure as WiFi.

By requiring location services to access Bluetooth, you ensure that the user understands their location information may leak when they use Bluetooth. In versions of Android prior to Marshmallow, the user could use Bluetooth without location services enabled, but location information could leak. In these older versions, you could also run WiFi scans to find MAC addresses without location services enabled, which again meant that your location information could leak. The requirement to allow location services to use Bluetooth is about ensuring that someone who disables location keeps their location private.

I would characterize this issue as a design problem and not a bug. A bug is presumably fixable, but it's not clear to me you can use Bluetooth at all without potentially leaking location information. Bluetooth was created before anyone considered WiFi and Bluetooth location services.

Improve this answer
4
  • 1
    How does Apple bypass this requirement?
    – Quintin Balsdon
    Jan 8, 2021 at 16:18
  • Also, if this is MAC related, why can I have Wifi on and Bluetooth off?
    – Quintin Balsdon
    Jan 8, 2021 at 16:23
  • 2
    This sounds more like a fatal flaw with conflating a service that provides direct access to that information with the notional possibility that information provided by that service could become available. Disabling location services doesn't, I presume, disable textboxes labelled "where are you?" so disabling bluetooth only accomplishes a half-baked version of the design intent. It uses an on/off user request to merely shrink the attack surface for adversarial apps attempting to infer location without permission, without eliminating it all.
    – Will
    Apr 12, 2021 at 17:13
  • There is still a difference between the "Location permission" (the user accepts that the app can access the location, via the Bluetooth device MAC address) and the "Location Services" (the user accepts that any technology - GPS, WiFi, Bluetooth, LTE... - can be used to determine the Android device location by any app). The former just means your location may be disclosed because one may know where the Bluetooth device is, the latter literally means that the Android device can use the GPS to determine where a Bluetooth device is located.
    – Vince
    Jul 24, 2021 at 18:34
4

The vendor is correct, you need to enable location services to scan for WiFi or Bluetooth LE devices.

See bug #185370 for details. Google said they have fixed it in a 'future release' but according to comments on the bug, it's still not fixed in Android 7.

Edit: I previously said location services are only required when the App starting the scan is running in the background. The source code indicates this is only true if the API-Target is < Android M.

Improve this answer
4
  • If it's an Android bug, why would the vendor be right? They should have replied: "It's an Android bug"
    – GUI Junkie
    Oct 23, 2016 at 12:43
  • Is it possible to link the device to bluetooth outside the App?
    – GUI Junkie
    Oct 23, 2016 at 12:45
  • 1
    You asked if the vendor's statement is incorrect. It is not incorrect, you do need to grant location permissions to the app. Additionally, due to the bug, you need to enable location services.
    – jomo
    Oct 23, 2016 at 13:07
  • It is exactly how @jomo writes. And Google is definitely here the one to blame... Luckily, things seem to move in a positive way after 5 years.
    – Petr Bodnár
    Jul 4, 2021 at 10:16
3

The OP asked about Pairing (the original, privacy-safe Bluetooth method to define a new, trusted relationship by confirming a code sent from the other device). For pairing, an app DOES NOT need:

  1. Scan for a MAC address
  2. "Location Services"
  3. ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION (not 100% sure on this)

I believe the Bug #185370 is unrelated. There is no bug; there are dishonest vendors.

A MAC address has a manufacturer ID and device ID, and usually a model number. Android 6.0 castrated a feature which previously allowed a manufacturer's app to scan for MAC addresses to link to their own products, to save you the trouble of Pairing and other fun things.

However, many apps abused it to find all WiFi & Bluetooth products in your home, what car you drive, your data providers, etc, and figure out out where you work, what your friends have or who they are, how often you visit, which stores you go to, etc. (think marketing, election meddling and "free" games from other countries).

From Google: "To provide users with greater data protection, starting in this release, Android removes programmatic access to the device’s local hardware identifier for apps using the Wi-Fi and Bluetooth APIs. The WifiInfo.getMacAddress() and theBluetoothAdapter.getAddress() methods now return a constant value of 02:00:00:00:00:00."

Again, Location services are not needed for "Pairing". This is from my new Bluetooth "BlueDriver" ODBII vehicle code scanner (i.e., check engine light):

Location Services
BlueDriver can use the Bluetooth Location service to scan for
nearby BlueDriver sensors. Instead, if you wish, you can pair
a sensor in the Bluetooth settings of your phone.

(At first glance of their Privacy Statement I freaked: they will upload to their servers, the VIN (includes mfr, model, ID, etc.) of every car I service, plus all of the car's data with driving habits, etc.; I can't opt-out of ADS pouring into my email. Then I read it to the end. I found they have very strict policies about keeping it private and NOT sharing it. Very unusual!)

Location Services can be legitimate. The Fitbit app doesn't need it to connect to my Fitbit, but it may help them gather all the data they want from me. And believe me, it's plenty more than they need to check my heart rate and count my steps, and the mapping is optional.

Improve this answer
0
3

I will need to add my two cents to this -- being an app developer who needs to scan for Bluetooth LE health devices. I also need to do this in the background so the app can re-connect to the device without the user having to engage with the app.

The fact that Android requires FINE location and background permissions to do this on the latest version has proven to be a great headache. The idiots reject my app because of this, yet the app does not need location info or care about location. The app also filters the scans to assure it only exposes health devices that it can support (there are a lot of proprietary devices out there).

I can background discover SPP and HDP (pre-10 Android killed HDP in version 10) without these permissions. Working with Bluetooth is hard enough for many people, especially the elderly who are not particularly tech savvy. Android is making using their platform more and more impossible to use in remote patient monitoring situations.

So my answer to the original question. The app developer is not 'lying'. Android forced this!

Improve this answer
8
  • Yes, this is a big headache. But the problem is because Google collects everyone's WiFi SSID, now they can be used to determine exact location. Bad Google. Bad.
    – RockPaperLz- Mask it or Casket
    Dec 6, 2020 at 3:49
  • I am not scanning for WiFi; I am scanning for Bluetooth Low Energy health devices. I don't need location information to do this task. Scanning for BTLE devices involves listening for connectable device advertisements. In those advertisements there can be service UUIDs which tell what the device supports. If the UUID supports a health device service that my app can work with, I pass that information up to the user and ask them if they want to connect. If yes, I connect. No location involved. But Google requires location permission for that scan. Why???
    – Brian Reinhold
    Dec 7, 2020 at 9:32
  • First, my apologies. I have no idea how I got to writing about WiFi, when you clearly wrote "Bluetooth LE". Sorry about that. Yes, I agree it's inappropriate of Google to require this permission. The only thing I can think of (not defending Google, by any means) is that doesn't Bluetooth LE use the same APIs as Bluetooth? If so, well, technically, Bluetooth (not so much Bluetooth LE) can kinda sorta be used to provide a fine location in very certain circumstances. In all those cases, someone would have to know the exact location of the Bluetooth device. Continued...
    – RockPaperLz- Mask it or Casket
    Dec 8, 2020 at 11:25
  • What I consider a bigger issue for Bluetooth is that I think it's possibly to more or less uniquely identify a person using Android's Bluetooth APIs. And AFAIK, Google has no permissions to specify, "this app can identify you". To make the world better for devs and consumers, Google could (and should, IMHO) provide an additional limited API for Bluetooth that will never provide data that could be used for identification purposes. That would likely be sufficient for most apps, without any privacy implications for users (and problematic issues like you are experiencing for devs).
    – RockPaperLz- Mask it or Casket
    Dec 8, 2020 at 11:31
  • Generically restricting the content of a Bluetooth communication would defeat its purpose. It is agnostic to the content. I can understand demanding an app indicate if it does so. My app does not expose or use location information. It only works with peers it understands. Those peers follow standards. If they don't it wont work! Why require location permission? I use SPP Bluetooth, too for the same purpose. No location permission for that!
    – Brian Reinhold
    Dec 9, 2020 at 12:17
2

For making a Bluetooth connection, the dependency on location can be related as below -

If an App can scans for known Bluetooth beacons, then it can also figure out the location from the available beacon. So if an app gets access to use Bluetooth in your phone, it is likely that it can also retrieve your location. So it makes sense that an app asks for location access when it try to scans for Bluetooth devices.

So the dependency on location for Bluetooth is added in Android 6 (Marshmallow) onwards. Moreover in recent Android version (10 onwards) they have further restricted the use of location based on whether you are using the app (foreground access) or your app is running in background.

One more note is - this dependency on location and related permission is not specific to Android but also added in iOS.

Improve this answer
2
  • There are a lot of nefarious uses one can dream up. Given Bluetooth's short range that would take a damn lot of beacons to track your position. That being said one could do the same crap with standard Bluetooth if you had a correctly designed peer. But there are no location permissions for that.
    – Brian Reinhold
    Dec 10, 2020 at 14:16
  • With BLE. location can be inferred by good and bad actors. Also location can be derived from an IP Address (excl VPNs) I'm confused in the world of security. Encryption is supposed to be our saviour, yet location, cookies and browser history does a pretty good job at tracking our behaviours. Why is it that Google "pretend" to be secure, while at the same time use cookies and save our search history? Sounds to me like they want to be the custodians of this info for their own benefit, while preventing others gleaning information under the guise of "security" .... whose security?
    – user924272
    Sep 18, 2021 at 23:34
2

Permission to location, and location services being on should be two separate things. If I agree this app can use low accuracy location data wifi etc. VS this app uses or requires the phone gps to be enabled.

Example i keep gps on my phone off, but I cant sync my fitbit because they say that not only do i need to give the app location permission the phones gps also has to be on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .