Why do I need to turn on location services to pair with a Bluetooth device? Whenever I try to connect my Samsung Galaxy S6 with Android 6.0.1 to a Bluetooth enabled device, it tells me to enable "location services".

When I complained about this, the software vendor replied: "Recent updates to the Google Android API affecting Bluetooth LE technology requires location permissions to be granted in order to use the app."

I fail to see the need for this.

This discussion talks about this. The technical reference says the apps need to have certain permissions, not that location services be active.


  To access the hardware identifiers of nearby external devices via
  Bluetooth and Wi-Fi scans, your app must now have the
  ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION permissions


Question: Does this mean the software vendor's statement is incorrect?
My understanding of Bluetooth is that applications using Bluetooth have direct access to the device MAC address for the purpose of pairing. I will assume this for this answer. 

If you can read MAC addresses of WiFi or Bluetooth transmitters, you can locate a device. This is how WiFi/Bluetooth location works; you listen for MAC addresses of transmitters and look these up in a giant global database. 

Therefore, any application using Bluetooth and a data connection is theoretically capable of locating your device. I am not sure this is practically possible; Bluetooth does not have the same range and semi-permanent access point infrastructure as WiFi. 

By requiring location services to access Bluetooth, you ensure that the user understands their location information may leak when they use Bluetooth. In versions of Android prior to Marshmallow, the user could use Bluetooth without location services enabled, but location information could leak. In these older versions, you could also run WiFi scans to find MAC addresses without location services enabled, which again meant that your location information could leak. The requirement to allow location services to use Bluetooth is about ensuring that someone who disables location keeps their location private. 

I would characterize this issue as a design problem and not a bug. A bug is presumably fixable, but it's not clear to me you can use Bluetooth at all without potentially leaking location information. Bluetooth was created before anyone considered WiFi and Bluetooth location services.