Developers Beware: Ad SDKs Are Exposing User Location Data

• Many mobile advertising Software Development Kits (SDKs) collect and share user location data by default, often without developer or user awareness.
• Location data harvested through ad networks is frequently sold to brokers, enabling tracking for invasive surveillance, military monitoring, and ICE investigations.
• Real-time bidding (RTB) auctions broadcast user location to thousands of potential advertisers, facilitating data leaks.

Identified High-Risk Ad SDKs

• InMobi: Encourages location sharing by highlighting that "location-enriched impressions" generate higher revenue, and enables location forwarding by default.
• BidMachine: Automatically tracks location by default; EFF technical analysis confirmed it was collecting precise coordinates despite initial claims on the Google Play Store that it did not.
• Verve (HyBid): Enabled location tracking by default but clarified via documentation updates that it collects only coarse, network-derived location data.
• Huawei (Petal Ads): Recommends developers enable location permissions to boost revenue, with location sharing occurring by default; opting out is poorly documented.

Risks and Consequences

• Lack of Meaningful Consent: When users grant an app location permissions, embedded third-party SDKs gain the same access, often without separate disclosures or user consent.
• Invisible Data Pipeline: Developers are frequently unaware that their ad partners are leaking data to third-party brokers, as seen in the 2025 Gravy Analytics breach.
• Incentivized Privacy Invasion: Many SDKs use dark patterns, financial incentives, and confusing documentation to pressure developers into enabling broad data collection.

Recommendations for Change

• For Developers: Audit third-party SDKs, disable unnecessary data collection, and move away from ad libraries that treat invasive tracking as the default.
• For Regulators: Hold SDK providers accountable for designing products that facilitate mass data leaks, rather than placing the burden solely on app developers.
• For Legislators: Enact federal privacy laws that prohibit the broadcast of location data via RTB and ban behavioral advertising to remove the primary incentive for tracking.