EFF: ad SDKs quietly share Android users' location by default

Many apps have a legitimate reason to request a device’s precise location — a weather app needs it for a local forecast, a fitness app for tracking a running route. But new findings from the Electronic Frontier Foundation (EFF) show that some apps are also inadvertently sharing that location data with third parties, including advertisers and data brokers, because the app developer may not realize the data-sharing setting is enabled by default.

The EFF’s research targets third-party code — known as software development kits, or SDKs — that developers embed in their apps to add features or monetize through advertising. According to the EFF, these SDKs inherit whatever location permission a user has granted the host app, and will collect that location data unless the developer actively disables it. The organization says many developers may not realize they’re sharing user location with third parties by default, and urged app makers to disable unnecessary data collection wherever possible.

Advertising SDKs are marketed to developers as a monetization tool, but the EFF says the trade-off is that users’ location histories flow to data brokers, who resell that information — including, per the EFF, to militaries, governments, and intelligence agencies such as the FBI. That data also carries security and privacy risk if a broker is hacked or its data stolen, something some brokers have already experienced. Among the Android apps the EFF identified sharing location data this way were two that had been downloaded a combined 60 million times.

The EFF tested by analyzing the apps’ network traffic to see which services received users’ location data. Bill Budington, a senior staff technologist at the EFF, told TechCrunch that the SDKs examined account for a small percentage of the broader advertising ecosystem but nevertheless claim to reach billions of users across tens of thousands of apps. The EFF’s report states there are “no SDK-specific location permissions,” meaning that once a user allows an app to access location, that data is also shared with the app’s advertising SDKs by default. “App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs,” the EFF wrote, adding that such SDKs “should not make sharing personal data the default, especially for data as sensitive as a person’s location.”

Why it matters

The gap between what users think they’ve consented to and what SDKs actually collect means app-store permission prompts aren’t doing the job regulators assume they are — putting pressure on Google and developers, not just advertisers, to close a default-sharing loophole that reaches billions of app installs.