Fourth paragraph of the article explains it:

> This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission

Users had to have the app open and grant the permission. They weren’t recording secretly in the background.

edit: ah yes, I was wrong here, they were disclosing

Here's a better article on this: https://www.techrepublic.com/article/how-one-spanish-soccer-...

there wasn't anything to "discover", the app literally was telling users that was what it was doing.

edit: I was wrong, they were pretty up front with users about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-...)

From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga."

Sounds like they were spying while using microphone permissions, which is what the discussion is about.

And they prompted people to opt-in (with somewhat leading language) into this system to search for unauthorized playback. So there was no need to "discover" that the app did that, because the app literally said it had a system to do so. There is a range between "secretly" (= would need research attention to discover it happens) and "done correctly legally".

Thanks for this! Found another article where this is better explained: https://www.techrepublic.com/article/how-one-spanish-soccer-...