Mobile App Ad SDKs Expose User Location Data by Default, EFF Warns
Featured image: Photo by Dan Nelson on Pexels.
A recent investigation by the Electronic Frontier Foundation (EFF) has revealed a concerning trend in the mobile app ecosystem: many advertising Software Development Kits (SDKs) are designed to automatically collect and share users’ precise location data by default. This occurs whenever an app, into which these SDKs are integrated, has been granted location permissions by the user. The EFF warns that this practice funnels sensitive personal information into the vast networks of location data brokers, often without users’ knowledge or meaningful consent, posing significant privacy risks [1, 2].
How Advertising SDKs Leak Location Data
Mobile apps frequently rely on third-party advertising SDKs to monetize their services. While these tools are designed to facilitate ad delivery, the EFF’s probe found that some are configured in ways that prioritize data collection over user privacy. Once a user grants an app permission to access their location, any SDKs embedded within that app gain the same level of access. This means advertising SDKs can then automatically collect precise location data and share it in bid requests for real-time bidding (RTB) ad auctions [2].
The problem is exacerbated by several factors: privacy-invasive default settings, financial incentives for developers to enable location sharing, and often unclear or misleading documentation. Many developers, particularly those who don’t scrutinize every setting, might inadvertently expose their users’ location information simply by sticking to an SDK’s default configuration [1, 2]. While apps can estimate approximate location from an IP address without specific permissions, location permissions grant access to far more accurate and revealing data, sometimes pinpointing within 10 feet [2].
The Data Broker Ecosystem and Its Dangers
When an advertising SDK collects and shares location data, it doesn’t just go to advertisers; it becomes part of a larger, opaque ecosystem that includes ad tech companies and location data brokers. These brokers specialize in compiling and selling information on the precise movements of billions of people, often without their direct knowledge or explicit consent. This data is primarily sourced from mobile apps [2].
Location data brokers participate in RTB auctions not only to bid on ad space but also to harvest personal information contained in bid requests. This indiscriminate data sharing can lead app developers to unknowingly contribute to the vast databases of location data brokers. The implications of this data collection are severe. Location information sourced from the advertising industry has been implicated in various harmful uses, including immigration enforcement investigations, global surveillance tools, the outing of a gay priest, tracking union organizers, and monitoring U.S. military personnel [1, 2].
Identified Culprits: SDKs Sharing Location by Default
The EFF’s investigation specifically highlighted four advertising SDKs that publicly acknowledge collecting and sharing users’ location by default when integrated into Android apps with location permissions. These examples illustrate how design and documentation choices can facilitate widespread location data sharing [1, 2].
InMobi Encourages Location Sharing for Revenue
InMobi, a popular advertising SDK claiming to reach over 2 billion users globally, explicitly states in its documentation that its SDK “automatically forwards location signals when available.” While it offers an opt-out setting, InMobi actively recommends sharing location data, highlighting that “location-enriched impressions typically yield higher revenue.” The SDK even encourages developers to request precise location permissions and Wi-Fi network information, both of which enhance location tracking capabilities [2]. InMobi has faced scrutiny for similar practices in the past, settling with the FTC in 2016 over charges of bypassing user location permissions to track precise locations via Wi-Fi data [2].
BidMachine’s Documentation Updates After EFF Scrutiny
BidMachine, which claims over 600 million “direct SDK users,” originally stated in its “Advanced Settings” that the “SDK can automatically track user device location to serve better ads” if developers request location permissions. Before the EFF’s report was published, contact with BidMachine led to updates in their documentation. Initially, their Google Play Store privacy details claimed only coarse location data was collected and precise location was “not collected.” However, the EFF’s technical analysis of apps using BidMachine, such as QR Scanner and GPS Speedometer, revealed that precise location coordinates were indeed being sent to a BidMachine domain [2]. Following the EFF’s outreach, BidMachine corrected its documentation to acknowledge the collection of precise location data when app-level permissions are granted, though it still emphasizes developer responsibility for consent flows [2].
Verve’s HyBid: Defaults vs. Public Statements
Verve’s HyBid SDK (formerly Pubnative HyBid) is embedded in over 10,000 apps and reaches 1.5 billion users. Its configuration guide explicitly states that location tracking is “enabled by default,” noting, “If the user has given location permissions, HyBid SDK will use the available user location to provide better targeted ads.” However, Verve’s Google Play Data Safety Guidance presents a more cautious picture, claiming the SDK “does not collect or attempt to collect [location] information independently” and only collects it “after obtaining user’s explicit consent.” The configuration guide, in contrast, prioritizes financial incentives for developers to enable location permissions over clear instructions for obtaining user consent beyond basic app-level access [2]. Verve clarified that its SDK coarsens geolocation data to an accuracy radius of no less than 1,850 feet and only reads cached network-provider location, not GPS data. While this is a step towards privacy, even coarse, repeated location data can reveal private movements [2].
Huawei’s Petal Ads: Revenue Over Privacy Default
Huawei’s Petal Ads SDK is integrated into more than 85,000 apps. Its integration guide recommends that developers obtain location permissions to increase app revenue and acknowledges that location sharing will happen by default in apps with location permissions. A separate “Use of Location Data for Ads” page reiterates this default sharing. However, neither of these prominent pages clearly mentions the method developers can use to disable this default collection, burying such information in a separate compliance guide [2]. While Huawei states the SDK will not store precise location and only uses it for approximate device location, it does not clearly define its distinction between approximate and precise data [2].
Beyond the Defaults: The Broader Problem
The EFF stresses that these four SDKs are illustrative examples, and the underlying issues extend far beyond them. Many other advertising SDKs have been criticized or sued for collecting location data without valid user consent [1, 2]. Studies have consistently shown that advertising SDKs often employ “dark patterns” and design choices that nudge developers towards increased data collection. Developers often have minimal influence over an SDK’s data transmission, leaving them with the difficult choice of either accepting invasive data collection or avoiding the SDK entirely [2].
The Perils of Unconsented Location Data
The core issue is that location data sharing frequently occurs without users’ knowledge or meaningful consent. For instance, neither of the apps observed sharing precise location data with BidMachine (QR Scanner and GPS Speedometer, downloaded over 50 million and 10 million times respectively) displayed a notice or requested specific consent for this sharing. Their Google Play Store “Data safety” sections also failed to disclose that location data might be shared with third parties [2].
Users granting app-level location permissions for core functionality, such as a GPS speedometer, likely do not expect this data to be automatically shared with third-party advertisers and data brokers. Many are unaware that granting an app location access extends the same permissions to embedded SDKs. App-level permissions alone are insufficient for signaling meaningful consent to third-party sharing, highlighting a significant transparency and control deficit for users [2].
Fighting Back: A Call to Action
The EFF’s findings underscore that advertising SDKs don’t just enable location data sharing; they actively encourage it through default settings, financial incentives, and ambiguous documentation, making it the path of least resistance for developers [2]. To address this systemic issue, action is needed from multiple stakeholders:
For Developers
Developers must exercise extreme caution when integrating third-party SDKs. They have a responsibility to meticulously evaluate all SDKs and disable any unnecessary data collection, regardless of default settings. Protecting user privacy should not depend on finding obscure documentation. Advertising SDKs should never make sharing sensitive personal data like location the default [1, 2].
For Regulators
Regulators should continue to hold app developers accountable for unlawful data sharing. Critically, they must also scrutinize the SDK companies whose designs and defaults encourage these privacy-invasive practices at scale. This would prevent SDK providers from shifting responsibility and consequences solely onto app developers [1, 2].
For Legislators
There is an urgent need for comprehensive federal legislation in countries like the U.S. to protect location privacy, without preempting stronger state laws, and including a private right of action for individuals. Such legislation should address the root cause by considering a ban on online behavioral advertising, which would eliminate the primary incentive for companies to track and share personal data, including precise location information disseminated through RTB auctions [1, 2].
Key Takeaways
- Mobile ad SDKs frequently collect and share users’ precise location data by default when apps have location permissions [1, 2].
- This data is often funneled to location data brokers, leading to serious privacy risks and potential misuse [1, 2].
- Privacy-invasive defaults, financial incentives, and unclear documentation encourage developers to share location data [2].
- Specific SDKs like InMobi, BidMachine, Verve’s HyBid, and Huawei’s Petal Ads demonstrate these problematic practices [2].
- Users often lack knowledge or meaningful consent regarding third-party location data sharing [2].
- Developers must carefully evaluate SDKs, while regulators and legislators need to enact stronger protections and hold SDK companies accountable [1, 2].
Sources
- [1] Mobile Ad Software Encourages Location Data Sharing, EFF Report Finds (www.eff.org)
- [2] Developers: Beware of Ad Libraries that Betray Your Users’ Location Privacy (www.eff.org)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
