EFF Location-Data Warning: Some Mobile Ad SDKs Share Precise Location by Default
The Electronic Frontier Foundation says some advertising SDKs can pass app users' location data into ad-tech and broker systems when developers leave risky defaults in place.
Quick takeaways
- EFF says its investigation found advertising SDKs that publicly acknowledge collecting and sharing users' location by default when embedded in Android apps with location permission.
- The user-facing risk is that a harmless-looking app can become a route into the wider location-data broker ecosystem if developers do not audit SDK defaults and documentation.
- A VPN can mask your IP address from websites and local networks, but it cannot stop an app from handing GPS or device-derived location data to an SDK after you grant permission.
What happened?
The Electronic Frontier Foundation published an investigation warning that some mobile advertising software development kits can encourage or enable location-data sharing by default. EFF says developers use these SDKs to monetize apps, but the same code can feed users' location data into advertising systems and location-data broker pipelines when an app has location permission.
EFF's press release says its review of public developer documentation highlighted InMobi, BidMachine, Verve's HyBid and Huawei's Petal Ads as examples of SDKs that collect and share a user's location by default for ad targeting when the host app has been granted location access. TechCrunch also covered the findings, noting that the warning is aimed partly at developers who may not realise third-party code inside their apps can share location data.
Why it matters for ordinary app users
Most people think about location permission one app at a time: a weather app needs a forecast, a map app needs directions, or a shop app wants nearby offers. The harder question is what happens after the app receives that location. If advertising libraries inside the app can reuse or share that signal, the permission decision becomes much broader than the screen that asked for it.
Location data is sensitive because it can reveal where someone sleeps, works, worships, seeks medical care, attends protests or meets other people. EFF points to past harms involving location information sourced from the advertising ecosystem, including investigations, spy tools and tracking of sensitive groups. Even when a single data point looks harmless, repeated location signals can build a revealing pattern.
What you can do now
Review location permissions on your phone and remove always-on access from apps that do not genuinely need it. Prefer 'while using the app' or approximate-location modes where your operating system offers them, and delete apps you no longer use. If an app needs location for one feature, check whether you can enter a postcode, city or address manually instead.
On Android and iOS, periodically use the privacy dashboard or app-permission screen to see which apps accessed location recently. Developers and product teams should audit every advertising, analytics and attribution SDK in their apps, read the location-sharing defaults, and document whether location is collected for core functionality or monetisation.
Where a VPN helps — and where it does not
A VPN can reduce IP-based tracking by websites and apps, hide your traffic from a local Wi-Fi operator, and make your apparent network location less precise. That can be useful when you browse on public Wi-Fi or want to limit what your ISP and local network can observe.
But a VPN is not a GPS-permission firewall. If an app has device location access, or if an SDK receives location from the app itself, the VPN cannot rewrite that permission decision or stop the app from sharing the data. For this story, permission hygiene, app choice and developer accountability matter more than changing your IP address.
VPN Rocks view
The practical privacy lesson is simple: treat app permissions as data-sharing decisions, not one-time pop-ups to dismiss. If an app asks for location and its business model depends on ads, assume the permission deserves extra scrutiny unless the developer clearly explains what is collected and who receives it.
A good VPN is still useful for network privacy, especially away from home, but it is only one layer. Pair it with a permission audit, fewer ad-heavy apps, browser and OS privacy controls, and a habit of saying no when location is not essential.
Sources and further reading
VPN Rocks adds plain-English analysis and practical advice. Source links are included so readers can check the underlying guidance directly.