Android apps are leaking precise user location to third-party brokers

The issue stems from the way Android handles permissions. When a user grants an app access to their location—a standard requirement for tools like weather trackers or fitness apps—that permission is inherited by every piece of third-party code embedded within the application. These SDKs, often utilized to serve advertisements, begin harvesting movement history immediately upon installation.

Bill Budington, a senior staff technologist at the EFF, noted that while these specific SDKs represent a fraction of the advertising ecosystem, their reach extends to billions of devices across tens of thousands of applications. Because these tools are commercially incentivized to maximize data collection, they treat user movement as a commodity to be auctioned off. This information frequently ends up in the hands of intelligence agencies, including the FBI, or remains vulnerable to theft through data broker breaches.

The EFF’s analysis highlights a critical failure in the current mobile ecosystem: app-level permissions provide no mechanism for users to distinguish between the primary app and the third-party trackers siphoning their data. The organization is calling on developers to audit their code and manually disable default data collection settings, arguing that personal location data should never be shared as a standard business practice.