Your favorite Android apps might be leaking your location

Using a niche weather, navigation, or similar location-hungry app? Your location data might inadvertently be going places you never signed up for.

No, this isn’t necessarily nefarious behavior on the app or its developers’ part. Instead, the culprit might be third-party advertising software quietly pulling the strings behind the scenes, as highlighted in an alarming new report from the Electronic Frontier Foundation (EFF).

For reference, app developers use software development kits (SDKs) to add pre-built functionality to their apps. This helps because it eliminates the need to write code from scratch.

One type of SDK that developers often use is an advertising SDK. It allows said app to serve ads to its users, all while giving its developers the necessary tools to measure ad performance and monetization. Most of the apps that serve you ads likely make use of such SDKs.

According to the EFF’s report, many such advertising SDKs that are used by developers are now being flagged for collecting and sharing users’ precise location data.

Sharing that data with whom, you may ask? With a network of advertising companies and systems that “location data brokers use to track people.”

In the past, location information obtained from the advertising industry has been used for tracking US military personnel, ICE investigations, spy tools, and more, making the EFF report’s revelation all the more concerning.

The main issue at hand

The problem with app location privacy is the fact that one permission applies to all. In this case, let’s say the app in question is a weather app. You grant it location access to get precise weather data. Using your precise location, the app gives you the exact weather information in your immediate area. That’s a virtual handshake between you and the app, but there’s a third hand that you can’t see that wants to secretly join the conversation.

The same precise location is also shared with third-party SDKs integrated into the app, all without user knowledge. This is where permission settings become blurry for users. You share your location for a useful feature, only for the software embedded within the app to harvest your data because of developers’ naivety.

This makes choosing apps a tricky process, even if you’re an otherwise privacy-conscious user.

It, however, isn’t all doom and gloom. Developers can take steps to prevent location data harvesting. Developers have the option to review and disable unnecessary data collection settings before integrating SDKs and shipping them with their apps.

Said settings, however, need to be actively looked for and aren’t immediately visible. That’s the main issue at hand. Developers who don’t carefully review SDKs are unintentionally allowing sensitive location data to be collected and shared.

“Users can take extra steps to defend their location privacy, but they shouldn’t have to. Developers, regulators, and legislators must act to stop apps from leaking users’ location data to advertising companies and data brokers,” said EFF Staff Technologist Lena Cohen.

In its analysis, the EFF highlighted four advertising SDKs that collect and share user location data by default, including InMobi, BidMachine, Verve’s HyBid, and Huawei’s Petal Ads.

It’s very likely that there are other advertising SDKs out there that are collecting user location data but weren’t flagged.

The EFF urges developers to carefully evaluate all third-party SDKs that are integrated into their apps. It also urges regulators to scrutinize companies whose SDKs encourage data harvesting.