Android Flaw Shares User Location 60M Times, Data Goes to FBI

Two Android apps have had their users’ precise location data shared with advertisers a combined 60 million times. The developers likely had no idea it was happening.

That's the crux of new research from the Electronic Frontier Foundation (EFF), which found that common advertising software tucked inside apps is inheriting location permissions by default, feeding a data broker ecosystem that includes militaries and intelligence agencies like the FBI. According to TechCrunch, the problem stems from a critical Android design flaw: “There are no SDK-specific location permissions.” This means a user’s green light for a weather app is also a green light for any third-party code lurking within it.

The Inherited Permission Problem

The mechanics are simple, which makes them dangerous. A developer integrates a third-party Software Development Kit (SDK)—often for a legitimate function like analytics or ad monetization. When a user grants the host app permission to access their precise location, that permission automatically extends to the SDK.

The EFF’s Bill Budington told TechCrunch that the SDKs they examined, while a "small percentage of the broader advertising ecosystem," nevertheless "claim to reach billions of users over tens of thousands of apps."

“App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs,” the EFF wrote. “Advertising SDKs should not make sharing personal data the default, especially for data as sensitive as a person’s location.”

The developer’s intent is irrelevant. Their app becomes an unwitting conduit, funneling geocoordinates, timestamps, and device identifiers to external networks. For the user, a tool for checking the forecast silently morphs into a persistent tracking beacon, a risk that also exists on other platforms due to flaws in services like Apple's iCloud Private Relay.

Where Your Precise Location Travels Next

The EFF’s report pulls no punches on the final destination of this data stream. It’s not just about serving a marginally more relevant ad for sneakers.

The trade-off for developers using these monetization SDKs is that "the users’ location histories get fed to data brokers, who monetize that information, which then gets sold to militaries, governments, and intelligence agencies, like the FBI." The data is also flagged as a security risk, vulnerable to being "hacked or stolen," a fate some data brokers have already experienced.

This moves the issue far beyond commercial privacy. It creates a national security and personal safety risk. The precision of location data can reveal patterns of life, associations, and visits to sensitive locations—information that is immensely valuable far outside the ad-tech bubble.

Google’s Half-Measure and User Confusion

Android does provide some user-facing tools, but they are incomplete. A support page on how to check if Android apps share location data explains that users may see a prompt stating an "app may share location data with third parties."

However, the page includes a critical disclaimer: “If you do not see an information box, it does not mean that the app does not share location data.” The visibility of this warning depends entirely on whether the app store or device manufacturer supports and enforces data safety labels—a system that places the burden of accurate disclosure on the developers who are, as the EFF found, often in the dark themselves.

This creates a perfect fog of uncertainty. Users can’t rely on the prompts. Developers may not know their apps are sharing data. The SDK providers are "commercially incentivized to get their customers to collect more data." The result is a pipeline that operates on assumptions and obscured defaults.

The Development Debt Comes Due

For years, the mobile ecosystem has run on a hidden subsidy: user data collected under vague pretenses. This research signals that debt is being called in, and the liability is landing squarely on app developers.

They are the legally accountable "data controllers" in many regulatory frameworks like GDPR, even when the leak originates from a third-party SDK they chose. The EFF’s warning is essentially a call for developers to perform immediate forensic due diligence on their own apps:

1. Audit Network Traffic: As the EFF did, developers must analyze what data their app transmits and to which external domains.
2. Scrutinize SDK Contracts: Legal terms must be reviewed to understand data flow obligations and warranties.
3. Disable Default Collection: Proactively switch off any non-essential data collection within SDK settings.
4. Update Privacy Policies: If data is being shared, the public-facing privacy notice must reflect that reality—or become evidence in a deceptive practices claim.

This transforms a core part of the development stack from a time-saving tool into a potential legal and reputational landmine. It forces a costly choice: invest in deep technical and legal audits of every SDK, or risk regulatory action and user backlash. As cybersecurity threats grow more sophisticated, with firms like Horizon3.ai raising significant funds to probe for just such systemic weaknesses, the pressure on developers to secure every data egress point will only intensify. You can read more about the evolving scale of this challenge in our analysis of Horizon3's recent $250M cyber war chest.

The Coming Reckoning for Android’s Model

The EFF’s findings aren't just a privacy report; they are a trigger for structural change. The model of permissive, inherited permissions is now visibly broken. The immediate consequences will likely unfold in three areas:

• Regulatory Scrutiny: Data protection authorities will likely use this research to investigate the "controller vs. processor" chain. Fines could target both the app developers (for lack of control) and the SDK providers/ad networks (for processing without a lawful basis).
• Platform Enforcement Pressure: Google will face mounting pressure to overhaul the permission model. A potential fix could be an iOS-style granular consent system where SDKs must request their own permissions, moving beyond the current, flawed data safety labels.
• Developer Flight: If building for Android requires expensive audits and carries high liability risk, innovation may skew toward platforms with stricter, clearer data governance, altering the long-term app ecosystem balance.

The era of "unwitting" data sharing is ending. The 60 million downloads documented by the EFF are a sample of a much larger problem. Fixing it will require SDK providers to change their default settings, developers to reclaim control of their code, and Google to provide the technical means to do so. Until then, every location permission granted is a vote of confidence in a system that is leaking by design.

Impact Analysis

• This design flaw transforms routine apps into persistent tracking beacons, exposing sensitive user data by default.
• The data flows into a larger ecosystem that includes data brokers, militaries, and intelligence agencies, raising acute privacy and security risks. This dynamic mirrors the consequential data flow risks highlighted in Nvidia's security-focused AI alliance proposals.
• App-level permissions fail to signal meaningful consent, undermining user control and trust in mobile app ecosystems.