Developers Beware: Ad SDKs Are Exposing User Location Data
Many mobile advertising Software Development Kits (SDKs) collect and share user location data by default, often without developer or user awareness. Location data harvested through ad networks is frequently sold to brokers, enabling tracking for invasive surveillance, military monitoring, and ICE investigations. Real-time bidding (RTB) auctions broadcast user location to thousands of potential advertisers, facilitating data leaks. Identified High-Risk Ad SDKs InMobi: Encourages location sharing by highlighting that "location-enriched impressions" generate higher revenue, and enables location forwarding by default. BidMachine: Automatically tracks location by default; EFF technical analysis confirmed it was collecting precise coordinates despite initial claims on the Google Play Store that it did not. Verve (HyBid): Enabled location tracking by default but clarified via documentation updates that it collects only coarse, network-derived location data. Huawei (Petal Ads): Recommends developers enable location permissions to boost revenue, with location sharing occurring by default; opting out is poorly documented. Risks and Consequences Lack of Meaningful Consent: When users grant an app location permissions, embedded third-party SDKs gain the same access, often without separate disclosures or user consent. Invisible Data Pipeline: Developers are frequently unaware that their ad partners are leaking data to third-party brokers, as seen in the 2025 Gravy Analytics breach. Incentivized Privacy Invasion: Many SDKs use dark patterns, financial incentives, and confusing documentation to pressure developers into enabling broad data collection. Recommendations for Change For Developers: Audit third-party SDKs, disable unnecessary data collection, and move away from ad libraries that treat invasive tracking as the default. For Regulators: Hold SDK providers accountable for designing products that facilitate mass data leaks, rather than placing the burden solely on app developers. For Legislators: Enact federal privacy laws that prohibit the broadcast of location data via RTB and ban behavioral advertising to remove the primary incentive for tracking.
EFF Deeplinks ·