A new report from the Electronic Frontier Foundation (EFF) has revealed that many Android apps, even those that do not explicitly request location, are transmitting precise geolocation data to a network of advertising companies. The problem lies not in the apps themselves, but in the third-party software development kits (SDKs) integrated into them, which collect and share location data with invasive default settings.
According to the investigation, these advertising SDKs collect user location via GPS, Wi-Fi, and cell towers, and send it to servers belonging to companies specializing in advertising profiling. Even when the user has not granted any location permission to the app, SDKs can access the data through indirect permissions or fingerprinting techniques. The EFF documented cases where location data is shared with dozens of companies, creating an invisible surveillance ecosystem for the end user.
The root cause is the default configuration of the SDKs, which have location data collection enabled by default. Developers have the option to disable this feature, but they must actively review each SDK's settings and choose to opt out of unnecessary data sharing. Unfortunately, many do not, due to lack of time or awareness, leaving active a functionality that violates user privacy.
Sponsored Protocol
How the location data leak happens
Advertising SDKs collect location data through multiple sources. GPS provides precise coordinates, while Wi-Fi and cell towers offer an approximate estimate. By combining this information, SDKs can track user movements with accuracy down to a few meters. This data is then aggregated and sold to advertisers who use it to send contextual advertising based on location. The user might receive ads for nearby stores, but the price paid is their privacy, without explicit consent.
The EFF tested several popular apps, including weather, navigation, and utility apps, and found that most of them include at least one advertising SDK with data collection active. In some cases, data is transmitted to servers in countries with less stringent privacy laws, increasing the risk of abuse. The report highlights that this practice is widespread and systematic, affecting millions of Android users worldwide.
Sponsored Protocol
Developer responsibility and solutions
App developers play a crucial role in protecting user privacy. They must review the settings of the SDKs they integrate, disabling location data collection where it is not functionally necessary. Google's privacy guidelines require that SDKs respect user permissions, but many do not. The EFF suggests using static code analysis tools to identify which SDKs access location and to implement explicit opt-out policies.
Users, for their part, can limit the damage by checking app permissions and revoking location access for apps that do not need it. Additionally, they can use privacy-focused apps that block ad trackers. However, the most effective solution requires upstream intervention: app stores and device manufacturers should enforce stricter standards for SDKs, as already discussed in the context of the GPAI and foundation models for the EU AI Act.
Sponsored Protocol
The problem is not new, but it has grown in proportion with the increasing reliance on apps for location-based services. As highlighted in a previous article on data storytelling for revenue, data has become a valuable asset, and tech companies often exploit it without transparency. This story also recalls the importance of proactive cybersecurity, as demonstrated by the Vangelis Stykas case, who discovered compromised networks through ethical hacking techniques.
In conclusion, location data leakage is a problem that needs immediate attention from developers, platforms, and users alike. Only through a collaborative approach can we ensure that our favorite apps do not become tools of covert surveillance.
Source: https://www.androidauthority.com/apps-location-sdk-privacy-3695043
