Why does my location need to be on to sync.

[AprilD]

This is my second charge hr. I updated less than 3 months ago and I want to know why  does my location need to be on to sync?. I have never had to have it on before to sync until bout 2 weeks ago. I am very unhappy bout this. If it does have to be on all the time to sync than I have wasted money on something that I can't use. 

[Weeeaaahhh]

A bit of a necro-post, but: I'm running android 6.0 on a Xperia xa1 and I have no problems syncing when Gps and location services are switched off. Yes, the app says "enable location to sync" but it sync's anyway. Turn off GPS, location services, bluetooth scanning AND wifi scanning, but leave BT & wifi switched on. You may lose some functionality from your device (find my phone etc.) but you will gain a little more privacy.

[Rich_Laue]

We have noticed that some phones will do a background sync .

[ChristinaRae]

Fitbits response does not make sense location is not required to be on to use the Bluetooth on any of the device I own even the newest ones which was purchased in the last week

[Rich_Laue]

Fitbit never said location needs to be on to use Bluetooth, @ChristinaRae, they simply are reminding the user what Android now requires..

As mentioned above, you can write to the Android developers and ask them to provide a difference fix  to prevent someone else from taking control of your phone because you wanted to sync your Fitbit tracker.

Google said that, with Android 6 and up, if an app needs to know the MAC address of a connected device, then the Android OS needs to have Location Services enabled. Having Location services enabled, doesn't mean that the app gets your location, Fitbit and the Oas never requests the location during a sync. 

We don't understand the details of this change that Android  made, but we know that it was changed when Android closed a security hole that would  allow an untrusted nearby phone or PC to take over your phone during a sync of the tracker, when the app requested the MAC.

If you do a search of different devices you will see that a Garmin along with several others, including one scale, also needs location services turned on to simply sync their devices. 

Enabling a service would be equivalent to unlocking the front door of a house, it does not mean that a person will walk through, it simply means that they will, if wanted to, could open the door. During a sync nobody requests the location, and this can be easily verified.

Also if it was a move Fitbit made, why does Fitbit not require it on Android 5, windows phones, and Apple phones?

If your looking for details then you may see what calls require location services to be turned on by going to the Android documentation.

Best practices for unique identifiers | Android Developers

https://developer.android.com/training/articles/user-data-ids

May 8, 2018 ... As a result, as of Android M, local device MAC addresses (for example, Wifi and Bluetooth) are not available via third party APIs. The WifiInfo

[jseglem]

if this is all associated to the MAC address then why is it not an issue with a bluetooth headset or other devices?

[Rich_Laue]

Because apps do not need to communicate with headsets or speakers. An app also does not need to know the Mac Address.

If a user wants to sync a Garmin through android, yes they need location turned on. I've also seen where one brand of smart scale requires location.

[jseglem]

I have a smart watch that doesn't require location and it does communicate. Why does the app need the mac address?

[Rich_Laue]

I'm not sure what model smart watch you have our off it is connected with an online account that tracks data of some type.

In reality there app does not need to know the MAC, but the Fitbit server in the cloud uses the MAC to identify which account the data should go. into 

[jseglem]

So the requirement for location services to be on comes down to the cloud service needing the mac address....

[Rich_Laue]

Sort of, android needs location services to be on, not fitbit, before the OS  will respond to a Bluetooth MAC address.

This was added during an Android update that closed a open door which allowed others to have access to and takes over control of an unsuspecting phone during the request for the MAC. 

[jseglem]

Google/Android is requiring location services because of the MAC address. If the Cloud Services did not require the MAC address then location would not be needed. It comes down to the cloud services needing the MAC address to sync. If we could disable cloud services (which I wouldn't use) then the need for the MAC address is void.

I am probably over simplifying this, but it seems to me it should be pretty simple. Since there is a real issue with running location services day in and day on a device that is used regularly I would think that Fitbit would look at a solution. What I read here is Fitbit blaming Samsung or Google to pretty much sidestep working on it or that Fitbit is more concerned with their Cloud Services.

[Rich_Laue]

Fitbit isn't blaming anyone, they simply are reminding the user of the requirements out in by Android..

I'm not sure why having location services enabled is an issue if the security on the phone is under control.

Enabling location services is like having a front door that can be opened from the inside. Disabling would be like looking the inside latch with a key. 

In either case if an app doesn't request location services then it doesn't matter. Those that say having location services on burns up the battery are using this mode to stop the many apps that have been given access permission by the user.

I guess Fitbit could turn off their location services, but then the user will only be able to access their data through whatever phone app that the data synced through with no access through the web. No challanges, no interface with any other app, no awards like Walgreens, no leaderboard. Of course since sleep is calculated I'm the cloud for most of the trackers let's remove this also.

Come now, everyone knows fitbits are a connected device

[SunsetRunner]

Don't listen to Rich.

The only time that Bluetooth requires Location Services to be enabled is if the app is using routines that do a scan that returns all of the nearby Bluetooth devices. The logic is that one could have a database that maps Bluetooth devices to their location, and by finding all of the nearby Bluetooth devices, one could determine the location of the phone. Hence the app now requires location services to be enabled if it scans to find all of the nearby Bluetooth devices. Why the Fitbit app needs to scan to find all of the nearby Bluetooth devices instead of just connecting to your Bluetooth device (i.e. your Fitbit tracker) , outside of the initial setup of the tracker, is anyone's guess and Fitbit's secret.

[Rich_Laue]

Nobody data that you have to listen to rich, but a simple search of the internet will confirm what rich says.

https://issuetracker.google.com/issues/37066866

https://stackoverflow.com/questions/33045581/location-needs-to-be-enabled-for-bluetooth-low-energy-s...

https://android.stackexchange.com/questions/160479/why-do-i-need-to-turn-on-location-services-to-pai...

And it is not just Fitbit

https://support.garmin.com/en-US/?faq=JSE6dDSzTc5zoVYU5lRcW5

Let's think about this, why would Fitbit only require location services to be on for android and not iOS or windows phones? Can you answer.

[jseglem]

Everyone is trying to build a database now... cloud services...

[jseglem]

We should have the option to turn the cloud services off. I could care less about other apps or any of the challenges. I have a bed that tracks how I sleep if I want to use it.

its about user options and less control over what the devices we purchase. I switched back to iPhone so I don’t have to use location.

[Rich_Laue]

When setting up a Fitbit accounta everyone does have the option.

Don't agree to the terms of service and return the tracker. It might be too late if a user already agreed to what they failed top read

[jseglem]

I did agree and switched to iPhone. You make the point again that there is little concern with what a user wants.

[SunsetRunner]

If you actually stopped and read the content at those first three links they all discussing that Location Services are required to be enabled to use the functions that scan to find all of the nearby external Bluetooth (or WiFi) devices contrary to what you have tried to claim above. 

It would probably make sense, given how adding a device works in the Fitbit app, that it scans to find all of the nearby external Bluetooth devices at that time. Probably doesn't do so at any other time, and as @Weeeaaahhh pointed out, location services do not need to be enabled to sync the tracker with your phone.

Your nonsense about turning off location services and the user only being able to access their data through whatever phone app that the data synced with is pretty outrageous, even by your standards.

Fitbit only requires location services to be enabled for Android and not for iOS because iOS allows an app to scan for all of the nearby external devices without location services being enabled. That is all.

[Rich_Laue]

Your correct location services would not be needed to sync a tracker to the phone, but the tracker does not sync to a phone. It syncs through a phone or through a computer, to the Fitbit cloud services. A successful sync requires the data to go from the tracker, to the cloud services, where the data is processed then dropped into the users online account.

I understand about iOS and Apple, I do not understand why Android now requires location services to be enabled, but this is a result of android closing a very vulnerable open door security snafu in Bluetooth.

If you want to go back to pre Android 6 removing the security patch, ppening the phone up tovhacking by a third party, locationservices may then  be turned off

This thread is simply a discussion among Fitbit users and most likely will never influence any decision made by the Dev team. For that the user would want to add their vote to the feature suggestion, however after 19 months I see only 27 votes.

Android sync without "enabling location"