EFF Warns Android Apps May Be Sharing Users’ Location Data by Default

Some Android app developers may be unknowingly sharing their users’ precise location data with advertisers and data brokers because of the way certain third-party software development kits (SDKs) are configured by default, according to new research from the Electronic Frontier Foundation (EFF).

The findings suggest that when users grant an app permission to access their precise location, embedded advertising SDKs can automatically inherit the same permission unless developers actively turn off the feature. As a result, developers may be transmitting sensitive location information to third parties without realising those settings are enabled.

The EFF said the issue is not necessarily caused by malicious app developers but by default SDK behaviour that many developers may overlook when integrating advertising and analytics tools into their Android applications. The organisation is urging developers to review these settings carefully and turn off unnecessary location collection wherever possible.

Location permissions can extend beyond the ap.p

Many mobile applications legitimately require access to auser’ss precise location. Weather apps rely on location to provide accurate forecasts, while fitness apps need GPS information to record walking, cycling or running routes.

However, according to the EFF, users may not realise that granting permission to an app can also allow third-party advertising SDKs inside that app to collect the same location data. The organisation noted that Android does not currently offer SDK-specific location permissions, meaning users cannot separately approve or reject location access for embedded advertising software.

Because of that design, location information can be shared with advertising companies and data brokers once permission has been granted to the host application.

Data brokers profit from location histories

The EFF warned that advertising SDKs are commonly promoted as a way for developers to monetise free applications, but the trade-off can be extensive collection of users’ location histories. Data brokers frequently sell those datasets to commercial customers and, in some cases, government agencies, military organisations and law enforcement bodies, including the FBI.

The organisation also noted that large repositories of location data create additional privacy and security risks because they can themselves become targets for hackers. Several data brokers have experienced data breaches in recent years, exposing sensitive information collected from mobile devices.

As part of its research, the EFF analysed network traffic generated by Android applications to determine which external services were receiving users’ location information. Among the apps examined were two Android applications that together had accumulated approximately 60 million downloads.

Researchers call for changes to default settings.

Bill Budington, a senior staff technologist at the EFF, said the SDKs examined in the research represent only a small portion of the broader mobile advertising ecosystem. Even so, those SDK providers collectively claim to reach billions of users across tens of thousands of applications, illustrating the potential scale of location data collection.

The EFF argued that app-level location permissions alone do not provide meaningful consent when third-party SDKs automatically receive the same access. The organisation said advertising SDK providers are commercially incentivised to collect more user data and should not enable the sharing of highly sensitive information, such as precise location, by default.

Instead, the nonprofit is encouraging both SDK providers and app developers to minimise unnecessary data collection and give users clearer control over how their location information is shared.