Android apps sharing users' location data without consent
What's the story
A recent report by the Electronic Frontier Foundation (EFF) has flagged a major privacy issue in the Android app ecosystem. The study found that some apps are unknowingly sharing users' precise location data with third parties, including advertisers and data brokers. This happens when developers use third-party code snippets, known as software development kits (SDKs), without realizing they could be collecting user location data by default.
Data collection
Developers unaware of automatic sharing
The EFF warns that unless developers actively disable this data collection feature, these SDKs will inherit the app's permissions and collect users' precise location data.
This is especially concerning as many developers may not even be aware of this automatic sharing.
The foundation has urged app makers to turn off unnecessary data collection wherever possible to protect user privacy.
Monetization risks
Location data sold to militaries, governments, and intelligence agencies
While advertising SDKs are often seen as a way for developers to monetize their apps, they come with a major downside.
The location histories of users are sent to data brokers who monetize that information.
This data is then sold to militaries, governments, and intelligence agencies.
Notably, it also poses a security risk if the data is hacked or stolen from these brokers.
Investigation findings
Two apps with a combined 60 million downloads were involved
The EFF's investigation uncovered that two Android apps with a combined 60 million downloads were quietly sharing users' location data.
They made these discoveries by analyzing the apps' network traffic and identifying which services were receiving this sensitive information.
Bill Budington, a senior staff technologist at the EFF, told TechCrunch that while these SDKs represent a small part of the larger advertising ecosystem, they still claim to reach billions of users over tens of thousands of apps.
Report insights
EFF concludes report with recommendations for developers
The EFF's report highlights that there are "no SDK-specific location permissions," meaning once a user gives permission for their location data to be shared with an app, it is also shared with advertisers.
The entities offering these SDKs are usually commercially incentivized to get their customers to collect more data.
The EFF concluded, "Advertising SDKs should not make sharing personal data the default, especially for data as sensitive as a person's location."