The information is stored on all iOS4 devices, in an unencrypted, unprotected file – consolidated.db. Apparently the file contains a permanent, continuously updated record of latitude and longitude along with timestamps.
There’s no evidence this information ever gets sent to Apple, but it is transferred when you migrate to a new iPhone / iPad, implying the data gathering is intentional. Apple is remaining silent about why it’s tracking users movements. With the file being easy to access the obvious privacy risk comes from someone getting hold of the phone, or accessing the file remotely.
Interestingly, the authors of the article have created a free OSX application that lets you visualize the data stored about you on a map – iPhoneTracker. They’re created some videos showing it in action. Here’s one animating someone’s Amtrack journey from Washington DC to New York.