Could the Mobile Push SDK be unneededly tracking user's location?

Question

my company uses Mobile Push and, in the last 24 hours, two of our applications received this warning from the Apple Store after our submissions:

"Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSLocationAlwaysUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting spring 2019, all apps submitted to the App Store that access user data will be required to include a purpose string.If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy)."

Since our apps don't actively track or need the user's location we investigated the SDKs we're using and found out that Mobile Push is the most likely to be doing something like investigating the user's location.

---

Addendum: we initialize the SDK via the following call, so we don't expect the SDK to track any kind of location...

[[ETPush pushManager] 
    configureSDKWithAppID:exactTargetDebugAppID 
    andAccessToken:exactTargetDebugAccessToken 
    withAnalytics:YES 
    andLocationServices:NO 
    andProximityServices:NO 
    andCloudPages:NO 
    withPIAnalytics:YES error:&error];

Answer 1

As the statement says, the Apple Store only checks for the presence of location services anywhere in your compiled code, much like you could do "Find in Files" to find files that contain a piece of text.

Unlike at least Android OS apps (I don't know enough about Microsoft to comment), where the app can request optional location services later, Apple's solution to protecting privacy is to use the most basic heuristic to determine if there's any possibility that location services could be accessed, instead of a static analysis or something like that.

Even if you initialize it without location services, the Apple Store isn't smart enough to know that this is your intent and instead simply requires the warning, even though you're not using it ("While your app might not use these APIs, a purpose string is still required.").

There isn't a non-location-aware version of the SDK that I'm aware of. The only solution I can see would be to modify the SDK's contents to remove all reference to those methods and delete the methods themselves.