EFF Report: How Mobile Ad SDKs Secretly Leak User Location Data by Default

Featured image: Photo by Dan Nelson on Pexels.

A recent investigation by the Electronic Frontier Foundation (EFF) has brought to light concerning practices within the mobile advertising industry. The report reveals that certain software development kits (SDKs), commonly used by app developers to monetize their applications, are automatically transmitting users’ precise location data to advertising systems and location data brokers by default. This occurs often without users’ explicit knowledge or meaningful consent, posing significant privacy risks to millions globally [1], [2]. The EFF’s findings underscore a critical issue where privacy-invasive defaults, coupled with financial incentives and unclear documentation, facilitate widespread leakage of sensitive personal information.

The Hidden Pipeline: How Ad SDKs Leak Location Data

Mobile advertising SDKs are essentially code packages that developers integrate into their apps to display ads. While these tools offer a straightforward way for developers to generate revenue, the EFF’s analysis shows a darker side: they can become conduits for location data sharing. Once a user grants an app permission to access their location, any SDK embedded within that app gains the same access. This means that advertising SDKs can automatically collect users’ location data and include it in ad requests, even if the app developer didn’t intentionally enable such sharing [2].

This process feeds into a larger, opaque ecosystem involving ad tech companies and location data brokers. These brokers aggregate and sell precise movement data of billions of people, often without their knowledge. While some apps directly partner with data brokers, many unknowingly leak user data through advertising SDKs involved in real-time bidding (RTB) auctions. In these auctions, ad tech companies broadcast user data to thousands of potential advertisers, including data brokers who may participate not to bid on ads, but solely to collect personal information like location [2]. The indiscriminate sharing through RTB means that developers can inadvertently expose their users’ location to numerous third parties, many of whom they may not even be aware of.

Privacy-Invasive Defaults and Financial Incentives

A key finding of the EFF report is that “defaults matter” significantly in the context of location data sharing. Many advertising SDKs are configured to collect and share location data by default whenever an app has been granted location permissions. This design choice dramatically increases the likelihood of users’ precise location data ending up in advertising systems, even if developers are not actively seeking to share it [1], [2].

Developers and advertising SDK providers also face strong financial incentives to share location data. Location-enriched ad impressions typically yield higher revenue, encouraging developers to not only keep location sharing enabled but also to request precise location permissions from users. This creates a powerful drive towards more invasive data collection, often at the expense of user privacy [2].

Identified SDKs and Their Practices

The EFF investigation highlighted four specific advertising SDKs that exhibit particularly egregious practices by collecting user location by default for ad targeting when an app has location permissions: InMobi, BidMachine, Verve’s HyBid, and Huawei’s Petal Ads [1]. While these are not the only SDKs with such issues, their practices illustrate the broader problem.

• InMobi: This SDK, reaching over 2 billion users, explicitly states that its SDK “automatically forwards location signals when available.” While offering an opt-out, InMobi’s documentation strongly recommends sharing location data, emphasizing that “location-enriched impressions typically yield higher revenue.” They even encourage developers to request precise location permissions and Wi-Fi network information, which can be used for highly accurate location tracking [2].

• BidMachine: With over 600 million direct SDK users, BidMachine’s documentation initially stated that it collects location data by default if an app has permissions. After the EFF reached out for comment, BidMachine updated its documentation to clarify this practice. However, the updated guide still failed to clearly explain how developers could opt out of location tracking. Furthermore, the EFF’s technical analysis contradicted BidMachine’s previous claim on the Google Play Store that it only collected coarse location data, finding evidence of precise location collection in apps using the SDK [2].

• Verve’s HyBid: This SDK, active in over 10,000 apps, clearly states in its configuration guide that location tracking is “enabled by default.” Despite this, Verve’s Google Play Data Safety Guidance presented a more cautious narrative, claiming the SDK does not independently collect location and only does so with explicit user consent. However, the configuration guide itself lacked clear instructions for obtaining such consent beyond app-level permissions, instead highlighting financial benefits for developers who enable location tracking. Verve clarified that its SDK coarsens geolocation data to an accuracy radius of no less than 1,850 feet and only reads cached network-provider location, not GPS data. While an improvement, even coarsened, repeatedly collected location data can still reveal sensitive movements [2].

• Huawei’s Petal Ads: Embedded in over 85,000 apps, the Petal Ads SDK guide recommends obtaining location permissions to increase app revenue and acknowledges that location sharing happens by default. Crucially, the documentation highlighting these financial incentives and default sharing does not readily mention the method to disable default location collection; this information is buried in a separate compliance guide. Huawei’s privacy statement claims it only uses precise location to determine approximate device location but doesn’t define these terms clearly [2].

Lack of User Knowledge and Meaningful Consent

A significant concern raised by the EFF is that location data sharing often occurs without users’ knowledge or meaningful consent. When an app receives location permission, embedded advertising SDKs can then independently collect and share this data. Many users are unaware that granting an app location access extends the same privilege to third-party SDKs within it, or even that an app contains code from external companies. The report highlighted instances where apps using these SDKs shared precise location data without additional user notice or consent, and their Google Play Store “Data safety” sections did not disclose this third-party sharing [2].

For apps where location access is central to their functionality, like a GPS speedometer, users granting permission is understandable. However, this app-level permission cannot be construed as meaningful consent for third-party advertising SDKs to collect and share that location data for behavioral targeting or with data brokers [2].

Beyond These Four SDKs: A Systemic Issue

The EFF emphasizes that while their report focused on four specific SDKs, the privacy issues extend far beyond them. Many other advertising SDKs have been criticized for collecting location data without valid user consent. The problems of privacy-invasive defaults, strong financial incentives, and unclear documentation are systemic within the ad tech industry. Studies have consistently shown that advertising SDKs often use “dark patterns” to nudge developers towards greater data collection and that developers often have minimal influence over an SDK’s data transmission, leaving them with a choice to either accept invasive collection or avoid the SDK entirely [2].

Fighting Back Against Location Data Leakage

The EFF’s report makes it clear that users shouldn’t bear the sole burden of protecting their location privacy. A multi-pronged approach involving developers, regulators, and legislators is essential to curb these pervasive data leakage practices [1], [2].

• Developers: App developers must exercise greater scrutiny over the third-party SDKs they integrate. They have a responsibility to protect user data, regardless of an SDK’s default settings. Developers should disable any unnecessary data collection and advocate for SDKs that do not make personal data sharing the default [1], [2].

• Regulators: Regulatory bodies need to continue holding app developers accountable for unlawful data sharing. Critically, they must also scrutinize the SDK companies themselves, whose designs and defaults encourage these practices at scale. This prevents SDK providers from shifting responsibility and consequences onto individual developers [1], [2].

• Legislators: There is a pressing need for robust federal legislation in the U.S. and similar laws globally to protect location privacy. Such laws should empower individuals to seek redress for privacy violations and ideally ban online behavioral advertising altogether. Eliminating the primary incentive for companies to track and share personal data, especially precise location, would dismantle the pipeline to data brokers and safeguard user privacy [1], [2].

Until comprehensive legislative action is taken, developers must remain vigilant and wary of ad libraries that subtly betray their users’ location privacy.

Key Takeaways

• Mobile ad SDKs frequently collect and share users’ precise location data by default, even without explicit user or developer intent.
• This data feeds into a larger ecosystem of location data brokers, who sell sensitive movement information.
• InMobi, BidMachine, Verve’s HyBid, and Huawei’s Petal Ads are examples of SDKs identified for privacy-invasive defaults and financial incentives for data sharing.
• Users often lack knowledge and meaningful consent regarding third-party SDKs collecting their location data.
• The issue is systemic, with many SDKs designed to encourage increased data collection.
• Developers, regulators, and legislators must act to protect user location privacy, including potentially banning online behavioral advertising.

Sources

1. [1] Mobile Ad Software Encourages Location Data Sharing, EFF Report Finds (www.eff.org)
2. [2] Developers: Beware of Ad Libraries that Betray Your Users’ Location Privacy (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.