Does this mean that if I refuse to provide the location to an app, the said app can still retrieve my location through Google Play Services?
To my understanding, there are 2 way to retrieve the current location from an Android developer's perspective:
The Android framework location API:
android.locationThis is "the old way" and developers are encouraged to adapt the newer API:
The Google Play services location API.
To access the former, an application has to request permissions to use them:
Unless noted, all Location API methods require the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions.
To access the latter, developers still have to request the same permissions:
Apps that use location services must request location permissions. Android offers two location permissions: ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION. The permission you choose determines the accuracy of the location returned by the API. If you specify ACCESS_COARSE_LOCATION, the API returns a location with an accuracy approximately equivalent to a city block.
So, no, the service does not offer a way to bypass permission checks. Both ways require the same permissions.
No, the service/libraries still require permissions requests just like everything else.
See the Play Services SDK documentation for more info. But some relevant excerpts:
...Once you’ve declared the APIs that you want to use ... ensure that you have the required permission before calling an API.
If the call returns false this means the permissions aren’t granted and you should use
requestPermissionsto request them.
... when you call
connect(), Google Play services validates that it has all the necessary permissions needed. ...
connect()fails when any permission groups needed by Google Play services itself are missing.