App SDKs may be sharing user location data with third parties by default

Some applications are inadvertently sharing users' precise location data with third parties, including advertisers and data brokers, due to default settings within software development kits (SDKs), as first reported by TechCrunch.

New findings from the Electronic Frontier Foundation (EFF) reveal that many app developers may be unaware that the third-party code they integrate into their applications can automatically collect and share user location data once granted permission by the user. These SDKs, often used for app monetization, can inherit the app's location permissions by default unless explicitly disabled. This collected data is then shared with data brokers, who may sell it to entities like governments and intelligence agencies, posing significant privacy and security risks, especially if data breaches occur. The EFF identified several Android apps, with a combined 60 million downloads, that were quietly sharing this sensitive information. While the SDKs examined represent a fraction of the advertising ecosystem, they reach billions of users, highlighting the broad scale of this data collection practice. The EFF urges app makers to disable unnecessary data collection and emphasizes that app-level location permissions alone do not constitute meaningful consent for third-party data sharing.

Source: TechCrunch