EFF warns Android app developers about inadvertent location data sharing with advertisers

Inadvertent Location Data Sharing Identified

The Electronic Frontier Foundation (EFF) has revealed that numerous Android applications are unintentionally transmitting users' precise location data to third-party advertisers and data brokers. This issue stems from the default configurations of software development kits (SDKs) integrated into these apps. When users grant location permissions to an app, the embedded SDKs automatically inherit these permissions and proceed to collect the user's location information.

Developer Awareness and Default Settings

Many app developers are reportedly unaware that these data-sharing settings are enabled by default within the SDKs they utilize. Unless a developer actively deactivates this collection, the SDKs will continue to gather and share precise location data. The EFF emphasizes that developers should proactively disable any unnecessary data collection to safeguard user privacy.

Implications for User Privacy and Data Monetization

While advertising SDKs offer a monetization avenue for developers, the consequence is that users' location histories are fed to data brokers. These brokers then monetize this information, potentially selling it to militaries, governments, and intelligence agencies. This practice also introduces security and privacy risks, as such data can be vulnerable to breaches or theft, as some data brokers have experienced.

Scale of the Issue

The EFF's analysis involved examining network traffic of various apps, identifying services receiving location data. They found instances where apps, with combined downloads reaching 60 million, were quietly sharing this information. A senior staff technologist at the EFF noted that while the examined SDKs represent a small portion of the broader advertising ecosystem, they claim to reach billions of users across tens of thousands of applications, indicating the significant scale of this type of location data collection.