Changing an app's location permission controls what it can obtain from your phone next. Deleting information already held by a data broker requires a separate request. The distinction applies to location trails around medical visits and other sensitive places.
US phone users can review app permissions. California residents also have a centralized broker-deletion system, DROP.
What each control does
| Control | What it addresses | What remains separate |
|---|---|---|
| App location permission | Whether an app can access the phone's location | Information already held elsewhere |
| Approximate location | How precisely a permitted app receives location | Whether that app has permission at all |
| California DROP request | Matching, non-exempt records held by participating data brokers | First-party records and legal exemptions |
Review iPhone permissions app by app
On an iPhone, open Settings, then Privacy & Security, then Location Services. Tap an app to review its access and the reason it gives for requesting location. Apple's current iPhone guide describes these controls.
If an app needs your general area without an exact position, turn off Precise Location for that app. Ask Next Time makes the app request access again when it next attempts to use your location. These settings let you change individual apps without disabling location across the phone.
Apple warns that switching off Location Services entirely stops many important features from working. Also distinguish a privacy control from an alert's appearance: hiding the map in Location Alerts removes the map from those notifications. It does not turn off location access or stop the alerts.
Check Android's background access
On Android, open Settings, Location, then App location permissions. Google's permission instructions group apps by their access, including permission all the time, only while in use, or no permission. Tap an app to change its setting.
An app that needs location only during use can be restricted accordingly. For an app you do not want receiving location, select Don't allow. Where supported, Use precise location controls whether an allowed app receives an exact or approximate location. Menu wording can vary by device and Android version.
Turning off the phone's location setting has a different scope. Google's device location guidance says apps and services cannot receive the device's location when that setting is off, but an IP address can still produce local results and ads. Emergency services or a mobile carrier may also send location to emergency responders. A disabled location switch is therefore no guarantee that every service has lost every clue to your whereabouts.
California's deletion route and its limits
California residents can use DROP after verifying eligibility. Enter your name, date of birth and ZIP code. Optional identifiers, including email addresses and mobile advertising IDs, can improve matching. Save your private DROP ID to check status.
The agency says brokers have up to 90 days to report how they processed a request. Its broker instructions explain the current timing: brokers download requests at least every 45 days and report results within 45 days of downloading them. That is not a promise of deletion 45 days after you submit.
Brokers must delete matching, non-exempt information, including inferences, and direct their service providers and contractors to do the same. The process also requires continuing checks for new matching data. The agency identifies a shorter processing interval taking effect January 1, 2027; the current timetable should not be confused with that future change.
DROP excludes first-party information you supplied directly to a business, exempt records and public data. Deleted covers non-exempt information; Exempted means a broker may retain all its records. Opted-out allows retention without selling or sharing. Record not found can reflect insufficient matching identifiers. You can add information to your profile. Pending means the request has not been processed.
What enforcement and research establish
A June 25 court order in the FTC's Kochava case restricts sales and transfers of sensitive-location data, including information associated with medical facilities. Its provisions include an exception involving a direct consumer relationship, affirmative express consent and a directly requested service. That order governs specified defendants; it is not a blanket prohibition applying to every location-data business.
Independent research also gives reason to read deletion outcomes carefully. A study submitted in May examined transparency disclosures from 522 registered California brokers and request interfaces from a stratified sample of 250. Only 9% met its full transparency-reporting standard. That figure does not mean only 9% honored deletion requests.
The researchers assessed 2025 practices before DROP's operational rollout. Their work cannot establish the success rate of today's DROP requests.
