[monlockandkey]

How did were the apps able to collect geolocation even though location services were disabled?

[baggy_trough]

Probably from IP address geolocation.

[abound]

Indeed, the article notes that the lat/long wasn't "GPS exact", more like "postal code exact".

[xenic]

Doing that on the client side sounds pointless though, if you are already transmitting the ip.