Android app developers may be unwittingly sharing their users' location data with advertisers
The EFF found that third-party advertising SDKs in Android apps inherit the app's location permissions by default, silently sharing users' precise location data with advertisers and data brokers There are no SDK-specific location permissions on Android, meaning app-level consent does not constitute meaningful consent for third-party data collection Location data collected through these SDKs is sold to data brokers and subsequently shared with governments, militaries, and intelligence agencies in
Analysis
TL;DR
- The EFF found that third-party advertising SDKs in Android apps inherit the app's location permissions by default, silently sharing users' precise location data with advertisers and data brokers
- There are no SDK-specific location permissions on Android, meaning app-level consent does not constitute meaningful consent for third-party data collection
- Location data collected through these SDKs is sold to data brokers and subsequently shared with governments, militaries, and intelligence agencies including the FBI
- The EFF urges app developers to actively disable unnecessary data collection and calls for advertising SDKs to stop making data sharing the default behavior
- Affected SDKs reach billions of users across tens of thousands of apps, with some identified apps downloaded 60 million times combined
Why It Matters
This finding exposes a critical privacy gap in the mobile app ecosystem where users' sensitive location data is being silently harvested and commodified through third-party SDKs without meaningful consent. For AI and app developers, it highlights the urgent need to audit SDK dependencies and implement privacy-by-design principles, as regulatory scrutiny and user trust are increasingly tied to transparent data practices.
Technical Details
- The EFF analyzed Android app network traffic to identify which third-party services were receiving users' precise location data, revealing that advertising SDKs automatically inherit app-level location permissions
- Android lacks SDK-specific location permissions, creating a permission inheritance model where any third-party code embedded in an app gains access to the same location data the user granted to the host app
- Advertising SDKs are commercially incentivized to maximize data collection, and the data flows from users to data brokers who resell it to government agencies, militaries, and intelligence communities
- The scale is significant: the examined SDKs claim reach across billions of users and tens of thousands of apps, with some individual apps accumulating 60 million combined downloads
- The EFF recommends that developers proactively disable unnecessary data collection in SDK configurations rather than relying on default settings
Industry Insight
- App developers should conduct regular SDK audits and implement granular permission controls, as default SDK behaviors pose legal and reputational risks under evolving privacy regulations like GDPR and state-level laws
- The absence of SDK-specific permissions represents a systemic design flaw that regulators may soon address, making proactive compliance a competitive advantage rather than a reactive burden
- Organizations relying on location data for AI training or analytics should establish clear data provenance chains and avoid ingesting data from SDKs with opaque collection practices to mitigate downstream liability
Disclaimer: The above content is generated by AI and is for reference only.