EFF Finds Android Ad SDKs That Share Users’ Location by Default

Several advertising SDKs used in Android apps collect and share users’ location by default whenever the app has been granted location permission, according to an Electronic Frontier Foundation investigation published Aug. 4. Many developers may not know the setting is on.

The problem is architectural. “There are no SDK-specific location permissions,” the EFF wrote, so once a user lets an app see their location, any SDK embedded in it gets the same access. Ad SDKs can then include that location in real-time bidding requests, which can be broadcast to thousands of potential advertisers. Location data brokers have joined those auctions to collect the personal data in bid requests, according to the report.

Four SDKs named

After reviewing the public developer documentation of dozens of widely used ad SDKs, the EFF highlighted four that acknowledge sharing location by default:

• InMobi, which claims to reach “2B+ users across 150+ countries.” Its integration guide says the SDK “automatically forwards location signals when available” and tells developers that “location-enriched impressions typically yield higher revenue.”
• BidMachine, whose Android guide says the “SDK can automatically track user device location to serve better ads.” The EFF’s network-traffic analysis of two apps using it, QR Scanner and GPS Speedometer, observed precise location data going to BidMachine, contradicting the company’s earlier documentation. BidMachine updated its documentation after the EFF reached out, but not its default.
• Verve’s HyBid, whose configuration guide says location tracking is “enabled by default,” even as its Google Play data-safety guidance stresses user consent.
• Huawei’s Petal Ads, whose guide recommends that developers request location permission to increase revenue before noting that sharing happens by default.

Neither of the two BidMachine-using apps showed a notice or asked for consent before sharing precise location, and neither listed location as shared data in its Play Store “Data safety” section, the EFF said. TechCrunch reported that the apps the EFF found sharing location included two with a combined 60 million downloads.

Bill Budington, a senior staff technologist at the EFF, told TechCrunch that the SDKs examined are a small share of the ad ecosystem but claim to reach billions of users across tens of thousands of apps.

“Defaults matter, not just for users, but for app developers as well. If app developers don’t pay close attention to the location-sharing settings of their advertising tools, they could inadvertently expose users’ location information,” EFF staff technologist Lena Cohen said in the group’s press release. The EFF urged developers to check their SDK settings and turn off location sharing they don’t need, and said ad SDKs should not make sharing location data the default.