“Some apps legitimately need location access, and once that’s granted there’s little that can be done to protect you”