I don't know if this is true, because my android phone helpfully pops up my grocery rewards card in a notification while I'm walking through the store with my phone locked and 0 apps open.

I don't know whether Android has adopted the same protocol, but on iOS, that's https://en.wikipedia.org/wiki/IBeacon: basically an API where apps can register an OS event-handler plugin to run in response to the detection of [basically, but not exactly] specific Bluetooth MACs.

The scary thing is, iBeacon handler don't have to do the cute "hey you're in this store, click to open the app!" sort of thing. They can run completely in the background, just reporting "hey boss, they're in the shoe section of Store #3313 now! Now they're in the produce section! Now they're gone." And, as far as I know, there's no way to turn off the tracking behaviour while keeping the helpful "activation suggestion" behaviour.

I would think that to be false based n sports trackers. Or do they work in some different manner that's not suitable here?

On iOS, when location updates are engaged via CLLocationManager#startUpdatingLocation (assuming all required permissions are in-place, eg NSLocationAlwaysAuthorization, UIBackgroundModes), an iOS app will remain running in background indefinitely until #stopUpdatingLocation is executed, when iOS will immediately put the app to sleep.

The fitness app [Human](http://human.co/) sits in the background and provide a map of where the user has moved throughout the day, and a timeline of when they moved (for example, that there was a walk from 10-10:30 AM, a jog from 2-:2:14, etc). When apps like this are backgrounded, the iOS permission dialog asks if the user wants to allow the app to continue using their location in the background.

I have no idea what APIs they use, so I'm not sure how hard it is to get this information, but it is at least possible.

On iOS an app can ask to access the GPS from the background. You can allow or deny that request, and if you go into the settings you can set its GPS permissions to never, always, only when running

yes, you can. I created a plugin for Cordova/React Native/NativeScript that does this:

https://github.com/transistorsoft/cordova-background-geoloca...

https://github.com/transistorsoft/react-native-background-ge...

Here I am driving around Iceland with my sample app, completely in background. Tracking engages automatically when device is detected to be moving.

http://www.transistorsoft.com/lab/iceland

How do these games prevent location spoofing? Or do they?

Ingress has some heuristics, but is not infallible. Plenty of cheaters have figured out how to avoid detection.

It is fairly clear that there are no such heuristics in PoGo.

The reality is, Niantic is a small company, and does not have the resources to throw at detecting/banning/dealing with the appeals.