Android app developers may be unwittingly sharing their users’ location data with advertisers

The core issue is that software development kits used for advertising automatically receive the same location permission granted to the host app. If the developer does not explicitly disable location collection within the SDK, the SDK will gather precise location data whenever the app accesses it. This default behavior means that even apps with legitimate location needs, such as weather or fitness tools, may be sending that data to advertisers without the developer’s awareness. The EFF’s findings highlight that the permission model does not distinguish between first-party and third-party use of location.

To reach these conclusions, the EFF analyzed network traffic from a selection of Android apps to identify which external services received location data. Although the SDKs they examined represent only a small fraction of the broader advertising ecosystem, the researchers noted that those SDKs claim to reach billions of users across tens of thousands of apps. This scale indicates that a significant volume of location information could be flowing through these channels. The two specific apps cited in the report had a combined download count exceeding 60 million installations.

Once collected, the location data is often sold to data brokers, who then resell it to various buyers, including militaries, governments, and intelligence agencies such as the FBI. The EFF warns that this creates both privacy and security risks, especially if the data is later compromised through a breach or theft. Some data brokers have already experienced such incidents, amplifying the potential harm to users whose location histories are exposed.

Because only one feed (TechCrunch) reported this investigation, there is limited independent corroboration of the findings in the provided material. Developers should therefore review the settings of any advertising SDKs they use and disable location collection unless it is strictly necessary for the app’s function. The EFF advises that meaningful consent for location sharing cannot be inferred from app-level permissions alone and calls for SDK providers to stop making personal data sharing the default.