Android app developers may be unwittingly sharing their users’ location data with advertisers

Among the Android apps that the EFF identified that were quietly sharing users’ location data included two that had been downloaded a combined 60 million times to date.

The EFF ran its tests by analyzing the apps’ network traffic and seeing which services are receiving the users’ location data.

Bill Budington, a senior staff technologist at the EFF, told TechCrunch that the SDKs they examined account for a small percentage of the broader advertising ecosystem but nevertheless claim to reach billions of users over tens of thousands of apps. That gives some sense of the scale of this type of location data collection. 

The EFF’s report said that there are “no SDK-specific location permissions,” meaning that once the user allows their location data to be shared with the app, their location data is also shared with advertisers. The entities offering those SDKs are generally commercially incentivized to get their customers to collect more data.

“App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs,” wrote the EFF. “Advertising SDKs should not make sharing personal data the default, especially for data as sensitive as a person’s location.”