EFF Report Reveals How Mobile Ad SDKs Betray User Location Privacy by Default

Featured image: Photo by Dustin Konrad on Pexels.

The Electronic Frontier Foundation (EFF) has released a significant report revealing how many mobile advertising Software Development Kits (SDKs) are designed to automatically collect and share users’ precise location data by default, often without users’ knowledge or meaningful consent [1, 2]. This investigation sheds light on a pervasive issue within the mobile app ecosystem, where developers integrating these SDKs for monetization purposes may inadvertently expose their users to extensive location tracking by a network of ad tech companies and data brokers. The report highlights how privacy-invasive defaults, financial incentives, and ambiguous documentation contribute to this widespread betrayal of user privacy [1, 2].

The Pervasive Threat of Default Location Sharing

Mobile apps frequently incorporate third-party advertising SDKs to generate revenue. While developers might assume they control the data shared by their apps, the EFF’s findings indicate that many SDKs are pre-configured to collect location data automatically once an app has been granted location permissions by the user [1, 2]. This means that if a user grants an app permission to access their location for a legitimate function, the embedded advertising SDKs gain the same access and can immediately begin collecting and transmitting this sensitive information. This happens without any additional prompt or specific consent from the user regarding the SDK itself [2].

The collected location data then enters a complex pipeline involving advertisers, ad tech companies, and location data brokers [2]. These data brokers specialize in aggregating and selling precise movement patterns of billions of individuals, often without their explicit knowledge or consent. A significant mechanism for this data leakage is “real-time bidding” (RTB), where ad space is auctioned off, and user data – including location – is broadcast to thousands of potential advertisers. Location data brokers exploit these auctions not just to bid on ads but specifically to harvest personal information contained within bid requests [2]. The EFF points to incidents, such as the 2025 hack of Gravy Analytics, where many app developers were surprised to learn their apps were sources of location data for brokers, underscoring their lack of awareness regarding SDK practices [2].

Financial Incentives Drive Data Collection

A core driver behind these privacy-invasive defaults is financial incentive. Advertising SDKs and developers are often encouraged to collect and share location data because it can significantly increase the bid prices for an app’s ad space, leading to higher revenue [2]. The EFF report details how SDK documentation frequently highlights these financial benefits, nudging developers towards enabling or maintaining location sharing. This commercial pressure, combined with default settings that favor data collection and documentation that can be unclear or difficult to navigate, makes it all too easy for developers to inadvertently compromise user privacy [2].

Developers, particularly those who do not meticulously scrutinize every line of an SDK’s configuration, tend to stick with default settings [2]. If an advertising SDK is designed to transmit location data by default, users’ precise location can end up in advertising systems and with data brokers without the developer ever intentionally enabling location sharing. This default behavior, therefore, shifts the burden of privacy protection from the SDK provider, who benefits from the data, to the developer, who might not even be fully aware of the extent of data collection [2].

Key Offenders: SDKs Sharing Location by Default

The EFF’s investigation specifically highlighted four advertising SDKs that engage in particularly egregious practices by collecting users’ location data by default for ad targeting whenever an app has been granted location permissions [1, 2].

InMobi’s Revenue-Driven Defaults

InMobi, a widely used advertising SDK reaching billions of users, explicitly states in its documentation that its SDK “automatically forwards location signals when available” [2]. While it provides an opt-out setting, InMobi actively recommends keeping location sharing enabled, emphasizing that “location-enriched impressions typically yield higher revenue” [2]. Furthermore, InMobi encourages developers to request precise location permissions and even Wi-Fi network information, which can be used for highly accurate location tracking [2]. This isn’t InMobi’s first encounter with privacy concerns; in 2016, the company settled with the FTC over charges of bypassing user location permissions and tracking precise locations via Wi-Fi data [2].

BidMachine’s Evolving Documentation

BidMachine, claiming over 600 million direct SDK users, initially revealed its default location data collection on an “Advanced Settings” page, stating the SDK “can automatically track user device location to serve better ads” if app permissions are granted [2]. Notably, the EFF’s technical analysis of apps using BidMachine, such as QR Scanner and GPS Speedometer, contradicted BidMachine’s previous Google Play Store privacy details, which claimed precise location data was “not collected.” These apps were observed sending precise location coordinates to a BidMachine domain [2]. After the EFF reached out, BidMachine updated its documentation to clarify its practices and acknowledge precise location collection, though its default collection behavior remained unchanged, and instructions for opting out were still not clearly presented [2].

Verve’s HyBid: Defaults vs. Disclosure

Verve’s HyBid SDK (formerly Pubnative HyBid), embedded in over 10,000 apps, also states that location tracking is “enabled by default” if the user has given location permissions [2]. Interestingly, Verve’s Google Play Data Safety Guidance presents a more cautious narrative, claiming the SDK “does not collect or attempt to collect [location] information independently” and only does so “if the publishers allows its app to collect location data from users after obtaining user’s explicit consent” [2]. However, the configuration guide itself lacks recommendations for obtaining explicit user consent beyond app-level access and instead highlights financial incentives for developers to add location permissions [2]. While Verve clarified that its SDK coarsens location data to an accuracy of no less than 1,850 feet and only reads network-provider location, even coarse data, when collected repeatedly, can reveal private movements [2].

Huawei’s Petal Ads: Incentives First

Huawei’s Petal Ads SDK, found in over 85,000 apps, also begins its integration guide by recommending developers obtain location permissions to increase app revenue and acknowledges that location sharing will happen by default [2]. A separate “Use of Location Data for Ads” page reiterates this default collection. Crucially, neither of these prominent pages clearly mentions the method developers can use to disable this default collection, burying this information in a less accessible “Ads SDK Compliance Guide” [2]. Huawei’s privacy statement regarding location data also lacks specific definitions for “approximate versus precise location data,” creating ambiguity for developers and users [2].

Beyond Explicit Consent: The Illusion of Privacy

The core problem identified by the EFF is that app-level location permissions alone cannot signal meaningful consent for data collection and sharing by third-party advertising SDKs [2]. Users granting an app permission for its core functionality, such as a GPS speedometer, are unlikely to expect their precise location data to be quietly siphoned off and shared with numerous third parties for advertising purposes [2]. The report found that apps like QR Scanner and GPS Speedometer, which use BidMachine, shared precise location data without additional notice or consent, and their Google Play Store “Data safety” sections did not disclose this third-party sharing [2]. These two apps alone have been downloaded tens of millions of times, illustrating the scale of this silent data leakage [2].

The risks associated with location data sharing extend far beyond “creepy ads.” Location information sourced from the advertising industry has been repurposed for sensitive and potentially harmful applications, including ICE investigations, global spy tools, outing individuals, and tracking union organizers or military personnel [1, 2]. This underscores the critical need for robust protections and transparent practices, as users are often unaware of the profound implications of granting seemingly innocuous app permissions [1, 2].

Widespread Problem, Systemic Issues

The EFF emphasizes that the issues of privacy-invasive defaults, financial incentives, and unclear documentation are not isolated to the four highlighted SDKs but are systemic within the ad tech industry [2]. Numerous studies corroborate this, revealing that advertising SDKs often employ “dark patterns” to steer developers towards greater data collection, exhibit discrepancies between their stated policies and actual data collection, and leave developers with minimal control over data transmission, forcing them to either accept invasive practices or forgo the SDK entirely [2]. This indicates a broader industry problem where the design of these tools inherently encourages and facilitates widespread location data leakage.

A Call to Action for Location Privacy

The EFF’s report serves as a stark reminder that the current ecosystem of mobile advertising SDKs often encourages, rather than merely allows, the sharing of sensitive user location data [2]. To counteract these pervasive practices, action is required from multiple stakeholders:

Developers

Developers bear a significant responsibility to carefully evaluate every third-party SDK they integrate into their applications. They must go beyond default settings and actively disable any unnecessary data collection, regardless of the SDK’s default configurations [2]. Protecting users’ location data should be a paramount concern, not an optional setting dependent on navigating complex documentation [2].

Regulators

Regulators must continue to hold app developers accountable for unlawful data sharing. Critically, their scrutiny must extend to the SDK companies themselves whose tools encourage these harmful practices at scale [2]. Without holding SDK providers responsible for their default designs, these companies can continue to shift accountability to developers while profiting from invasive data collection [2].

Legislators

The EFF calls for robust legislative action, advocating for a federal law in the U.S. that unequivocally protects all Americans’ location privacy, without preempting stronger state laws, and includes a private right of action for individuals to sue violators [2]. Similar legislation is needed globally to ensure location privacy as a universal human right [2]. Ultimately, legislators could address the root cause by banning online behavioral advertising, thereby eliminating the primary incentive for companies to track and share personal data,

Sources

1. [1] Mobile Ad Software Encourages Location Data Sharing, EFF Report Finds (www.eff.org)
2. [2] Developers: Beware of Ad Libraries that Betray Your Users’ Location Privacy (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.