Brian Krebs found that the phone collects data about a user's position even if location sharing has been turned off in every individual app.
However, the user could avoid being tracked if the entire system was set to never share location.
Apple said it was "expected behaviour" and denied it was a security problem.
The company has made big play of the fact that it allows users granular control over sharing their location - so for instance they can have location switched on for Maps but off for everything else.
Mr Krebs found users could disable all location services entirely via Settings>Privacy>Location Services, but if they chose the individual controls, they might still be tracked.