What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view?
(Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)
If an app that uses bluetooth can get my location via beacons or etc., then bluetooth should be wrapped in location privileges. An app that I do not want having my location should not be allowed to use bluetooth, and I have to accept that any app that does use bluetooth could get my location.
While it does mean that apps that use bluetooth now have a slightly easier way of getting location (i.e., via phone GPS, not just bluetooth), we shouldn't obfuscate that bluetooth is another way to get that information. In the end, you are trusting the app developer with the privilege of knowing your location. If you don't trust them with that, then they can't be allowed to use bluetooth, full stop.
Because Google is notorious for coming up with bogus explanations whenever they get caught red-handed. Every month there is a bunch of news articles, where high-ranked Google employee claims to spy on everyone to "protect people from electric pigs", "lower the danger of Confucian Jihad", "enrich e-mail UX with hefty data-harvesting" or something along those lines.
> If an app that uses bluetooth can get my location via beacons or etc., then bluetooth should be wrapped in location privileges.
There is no reason why apps have to be able to "get location from beacons" in order to connect with another phone over Bluetooth. Same for P2P Wi-Fi API — pairing with another device already requires exchanging tokens via graphical dialog with explicit user approval on both devices. Removing ability to read scan results from API would be enough to fix the underlying data leak. Once two devices are paired, they should be able to exchange data without need for any permissions or user actions.
Instead Google forces users to keep Location enabled long after initial connection is made. Even if there is no underlying bad intention, they should be ashamed of forcing such garbage UX upon people.
What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view?
(Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)