EFF Finds Android Apps With 60 Million Downloads Leak Location Data to Advertisers by Default

The Electronic Frontier Foundation says it found that third-party advertising code embedded in Android apps is quietly harvesting users' precise location data by default, often without the app developers themselves realizing it's happening.

According to TechCrunch, the issue involves software development kits, or SDKs, small blocks of code that developers drop into their apps to handle things like ad monetization. When a user grants an app permission to access their location, any SDK bundled inside that app inherits the same permission automatically. There's no separate prompt, no separate opt-out, no separate anything.

Bill Budington, a senior staff technologist at the EFF, told TechCrunch that the SDKs his team examined represent only a small slice of the broader advertising ecosystem, yet still claim reach across billions of users and tens of thousands of apps. That's the scale problem in a nutshell: a handful of code libraries touching an enormous share of the phones in your pocket.

Two of the Android apps the EFF identified as sharing location data by default have a combined 60 million downloads, per TechCrunch's reporting. The EFF conducted its analysis by examining network traffic from the apps to see exactly which outside services were receiving user location pings.

Why This Happens

The core issue is structural, not necessarily malicious. Android's permission system asks whether an app can access your location. It does not ask whether every piece of embedded code inside that app can access your location too.

The EFF's report states plainly that there are no SDK-specific location permissions. Once a user says yes to the app, the SDK rides along for free. And the companies selling these SDKs to developers are, as the EFF put it, "commercially incentivized to get their customers to collect more data," not less.

That data doesn't stop with the advertiser who first collects it. It gets sold to data brokers, who repackage and resell it. Buyers have reportedly included militaries, government agencies, and intelligence services such as the FBI, according to TechCrunch's reporting on the broader data-broker trade. It's also a target for hackers, since some brokers have already had breaches.

The Fair Case for the Ad Industry

Before piling on, it's worth stating the ad industry's actual position clearly. Free apps exist because ad-supported monetization pays the bills. Weather apps, fitness trackers, and countless free utilities rely on location-based advertising revenue to stay free. If SDKs required separate, additional consent screens for every ad partner bundled into an app, users would face consent fatigue: screen after screen of permission requests until they just click "allow all" out of exhaustion, which defeats the purpose of asking in the first place.

The question is whether the current default, silent inheritance of location permission by embedded code, is the right way to solve it. The EFF argues it isn't, writing that "app-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs." Advertising SDKs, the EFF says, should not make data sharing the default, especially for something as sensitive as a person's real-time location.

What's Proven, What Isn't

What's documented: the EFF ran network traffic analysis and found specific SDKs transmitting location data to third parties by default in apps with tens of millions of downloads. What's not documented in this reporting: which specific apps, which specific SDK vendors, and which specific data brokers or government buyers received data from these particular SDKs. TechCrunch's writeup doesn't name the two apps with 60 million combined downloads, nor does it name the SDKs in question.

Without naming the specific culprits, users have no way to check whether an app on their own phone is one of the offenders. General warnings about "some SDKs" and "some apps" are useful for developers reading a technical report, but they don't give ordinary Android users anything actionable.

No Regulation Requires This to Change

There's no federal law in the U.S. mandating that advertising SDKs seek separate consent for location data. Google's Play Store policies govern some of this at the platform level, but nothing in the current reporting suggests Google has announced new enforcement action tied to this specific EFF finding. No investigation or regulatory inquiry has been announced in connection with this report.

The fix the EFF is pushing for is developer-side: turn off unnecessary SDK data collection manually, audit what's bundled into your app, and don't assume the ad partner's default settings are privacy-respecting just because they're the default. Whether developers actually do that, absent any legal requirement to, remains unclear.