Android app developers may be unwittingly sharing their users’ location data with advertisers

Researchers at the Electronic Frontier Foundation examined network traffic from a sample of Android applications and found that several advertising SDKs inherit the app’s location permission without any additional opt‑in. In at least two popular apps—collectively downloaded about 60 million times—the SDKs transmitted exact user coordinates to third‑party servers. Bill Budington, senior staff technologist at the EFF, notes that while these SDKs represent a modest slice of the overall ad ecosystem, their reach spans billions of devices across tens of thousands of apps, indicating a non‑trivial privacy exposure. The core issue is the absence of SDK‑specific location controls; once a user accepts the app’s request, the same data flows to advertisers, data brokers, and potentially to government or intelligence customers.

This behavior reflects a broader pattern where monetization tools are baked into mobile apps with minimal transparency. Advertising SDKs have long been prized for delivering revenue to developers, yet they often operate under default settings that favor data collection. The EFF’s findings echo earlier concerns about “permission creep” in mobile platforms, where granular user consent is diluted by bundled third‑party code. Moreover, the fact that location data can be sold to entities ranging from commercial data brokers to law‑enforcement agencies underscores the commercial incentives driving this practice and raises questions about compliance with emerging privacy regulations such as the GDPR and California’s CCPA.

Developers now face a clear imperative: audit the SDKs they embed, explicitly disable location harvesting where it isn’t essential, and communicate any data sharing to users. Failure to do so could invite regulatory scrutiny, class‑action lawsuits, or reputational damage if a breach exposes the collected coordinates. Watch for increased pressure from app stores—particularly Google Play—to enforce stricter SDK disclosure policies, and for SDK vendors to introduce granular permission toggles that separate app‑level consent from third‑party data collection.