EFF Warns Android Apps Unwittingly Share Precise Location Data with Advertisers

The Electronic Frontier Foundation (EFF) has issued a critical warning that Android app developers are frequently and unwittingly sharing their users' precise location data with advertisers through embedded third-party code. This significant finding underscores a systemic vulnerability where Software Development Kits (SDKs), integrated for various functionalities like analytics or advertising, can inherit an app's location permissions by default, subsequently feeding this sensitive information to ad systems and data brokers without explicit user consent for third-party sharing. The EFF's investigation identified several advertising SDKs, including those from InMobi, BidMachine, Verve, and Huawei, which publicly acknowledge collecting and sharing location data, often highlighting financial incentives for developers to keep such sharing enabled.

This practice carries profound implications for user privacy, extending far beyond the nuisance of targeted advertisements. Location data, when aggregated and analyzed, can reveal deeply personal patterns, including an individual's home, workplace, medical facility visits, religious affiliations, or participation in protests. The risks are tangible: this information can be exploited by hackers for tailored phishing attacks or even by government agencies for warrantless surveillance, as evidenced by reports of Customs and Border Protection (CBP) using commercially available location data for tracking phones. Despite app-level permissions, users often lack granular control over how their data is further distributed by these hidden SDKs, leading to a significant breach of trust. Children and minors are particularly vulnerable, with growing legislative efforts in 2026, such as those in Connecticut, to expand sensitive data definitions to include neural data and enhance protections for users under 16.

For the mobile app industry, the EFF's findings amplify an already intense regulatory and reputational pressure. Developers, often unaware of the full data-sharing capabilities of the SDKs they integrate, face increasing scrutiny and potential legal repercussions. Google, as the operator of the Android ecosystem, has attempted to address these concerns through its Google Play Developer Program policies and the Data Safety section in the Play Store, which requires developers to disclose what data their apps and integrated third-party SDKs collect and share. Android 14 has even enhanced visibility, displaying details about location data collection and sharing practices directly in runtime system permission dialogues. Google also explicitly prohibits linking persistent device identifiers (like IMEI) to personal and sensitive user data or resettable device identifiers, and requires developers to ensure their SDK providers do not sell personal and sensitive user data. However, the effectiveness of these disclosures is often debated, with some users expressing skepticism about the completeness of information and many missing critical details due to complex interfaces.

The regulatory landscape is rapidly evolving, making compliance a moving target. Comprehensive privacy laws, such as the GDPR in Europe and the CCPA in California, have set a precedent for strict data handling requirements. In 2026, the U.S. is seeing an aggressive wave of new state privacy laws, with Indiana, Kentucky, and Rhode Island implementing full consumer privacy frameworks. Notably, Oregon's amended Consumer Privacy Act, effective January 1, 2026, bans the outright sale of precise geolocation data, defined as pinpointing a device within a 1,750-foot radius, without any opt-in exception. This escalating legal environment means that the app publisher remains the primary data controller, responsible for all data processing, even within third-party libraries. Regulators are increasingly employing technical verification, using network monitoring and SDK decompilation, to ensure actual runtime compliance, not just interface declarations.

Compared to Android, Apple's iOS ecosystem has generally adopted a more privacy-by-default approach. Features like App Tracking Transparency (ATT), introduced in 2021, require apps to explicitly ask users for permission to track their activity across other apps and websites, leading to a reported 24% decrease in GPS data post-iOS 13. While both platforms offer privacy labels (Apple's Privacy Nutrition Labels and Android's Data Safety section), a 2024 study indicated that iPhones sent significantly fewer requests to third-party servers compared to Android devices, with a much larger proportion of iOS requests directed to Apple itself (60% vs. 24% for Google on Android). This suggests a more tightly controlled third-party ecosystem on iOS, though both systems rely on developer self-reporting for label accuracy.

Looking ahead, the trajectory is clear: increased transparency, stricter enforcement, and a fundamental re-evaluation of data monetization strategies. Developers must move beyond mere surface-level compliance, adopting "privacy by design" principles and implementing continuous auditing of all third-party SDKs to understand their data collection and sharing practices at a technical level. This includes building robust, granular consent flows that are contextual, specific, and easily revocable for users, moving away from broad, one-time permissions. The ad-tech industry, in turn, will be forced to innovate, shifting away from invasive cross-app tracking towards privacy-preserving APIs, such as those being developed under Google's Privacy Sandbox initiative, and greater reliance on contextual advertising. Users, empowered by new opt-out mechanisms and more visible privacy controls, will increasingly demand greater control over their digital footprint. Ultimately, the future of mobile app development and advertising hinges on a paradigm shift: from passive disclosure to active, verifiable privacy protection that truly respects user autonomy.