Popular Android Apps May Be Sharing Your Location Without You Realizing, EFF Warns

Android users may be unknowingly exposing their precise location to advertising companies through trusted mobile apps, according to a new report by the Electronic Frontier Foundation (EFF). The digital rights organization says the issue is not necessarily caused by the apps themselves but by third-party advertising software development kits (SDKs) integrated into many popular applications.

SDKs are pre-built software components that developers use to add features such as advertisements, analytics, and monetization tools without writing code from scratch. While they simplify app development, the EFF warns that some advertising SDKs are configured to collect and share users’ precise location data by default, often without developers fully understanding the privacy implications.

The report explains that users typically grant location permission to apps such as weather, navigation, or local services because those features depend on accurate positioning. However, the same permission may also allow embedded advertising SDKs to access and transmit that data to advertising networks and location data brokers, which can use the information for targeted advertising and user profiling.

According to the EFF, location data obtained through the advertising ecosystem has previously been linked to investigations involving military personnel, law enforcement operations and commercial surveillance tools, highlighting the broader privacy risks associated with uncontrolled data sharing.

The organization stressed that many developers may be unintentionally exposing user data because these location-sharing options are often enabled by default and are not always clearly presented during SDK integration. Unless developers manually review and disable unnecessary data collection settings, users’ location information could continue to be shared with third parties.

To address the issue, the EFF has urged app developers to carefully examine every third-party SDK included in their applications and opt out of unnecessary location collection wherever possible. It also called on regulators and lawmakers to increase oversight of companies whose advertising software facilitates large-scale location data harvesting.

The report specifically identified InMobi, BidMachine, Verve’s HyBid and Huawei’s Petal Ads among the advertising SDKs that collect and share location data by default. However, the organization noted that other SDKs may also engage in similar practices.

Users can reduce their privacy risks by limiting location permissions and reviewing app settings; however, the EFF argues that the primary responsibility lies with developers and advertising technology providers to ensure personal location data is not shared without clear user awareness and consent.

Also read:

Gemini Lock-Screen Flaw Raises Fresh Questions Over AI Access to Private Messaging Apps