EFF report says Android apps may share location via ad SDKs

A new report from the Electronic Frontier Foundation has revealed that many Android app developers may be unknowingly sharing users' precise location data with advertising companies and data brokers. The privacy issue stems from third-party advertising software development kits (SDKs) that automatically inherit an app's location permissions unless developers actively disable the feature.

The EFF's investigation, detailed in a report released this week, found that several advertising SDKs collect or share location information by default when the host app has been granted permission. The analysis highlighted SDKs from InMobi, BidMachine, Verve, and Huawei's Petal Ads. Documentation from some providers, like InMobi, encouraged developers to retain the default setting, noting that location-based advertising can generate higher revenue.

Researchers identified specific apps sharing data through these SDKs by analyzing network traffic. Two apps, QR Scanner and GPS Speedometer, were found to be transmitting precise location data via the BidMachine SDK without displaying a separate notice or obtaining specific user consent for that transfer. According to the EFF, these apps had been...