> it doesn't request location permissions anywhere, despite the claims in the article
The article does not claim the app requests the location. It claims it can do it with a single JS call.
> The article does not claim the app requests the location. It claims it can do it with a single JS call.
so can ... any other code anywhere on a mobile device? That is how API work...
It can request with a JS call. It can't passively collect it without you approving first. The article is written like calling that JS function will turn on location tracking without consent.