Imagine giving the key to your house to a technician so they can fix your boiler. Now imagine that person passes a copy of the key to five others, and those to another hundred. Something similar is happening with the location of many Android phones: you allow an app to know where you are and, without you knowing, that information is shared with advertising and data companies.
This has been uncovered by the Electronic Frontier Foundation (EFF), an organisation that defends digital rights, in an investigation published at the beginning of August and reported by TechCrunch, one of the most read technology outlets in the world.
What has happened
The EFF has analysed the pieces of code that many apps use to show ads. It has identified four advertising tools that share your exact location with third parties without warning: BidMachine, InMobi, HyBid (from the company Verve) and Petal Ads (from Huawei).
These tools aren’t obscure. They’re used in tens of thousands of apps and, according to the EFF itself, reach billions of users around the world. Two of the apps analysed, a QR code reader and a car speedometer, have been downloaded more than 60 million times in total. And none of them warned that they were sharing their users’ location.
Why this happens
To understand it you need to know what an “SDK” is. An SDK is like a ready-made piece of code that programmers drop inside their app so they don’t have to write it from scratch. Many free apps include an advertising SDK to make money. That’s what allows the app to cost you nothing.
The problem is the following: when you give location permission to an app (for example, a maps app), Android grants that permission to the entire app, including the advertising pieces it carries inside. It’s as if the building doorman had the keys to all the apartments: in theory he should only open the ones he’s supposed to, but technically he can open them all.
The app creators should disable that location transmission by hand. But many don’t. They follow the basic instructions, the app works and nobody reviews what data leaves it. InMobi’s own documentation recommends keeping tracking enabled, because advertisers pay more when they know where you are.
Where your location ends up
And here’s the most sensitive part. The location the phone sends can be so precise that it points to your own house: up to 50 metres of margin, sometimes only 10. When an app sends that information to advertising auctions (where companies bid in real time to show an ad), it can reach thousands of advertisers at once.
Among those buyers there are “data brokers”, companies that buy personal information and resell it. The EFF reminds us that these companies have sold location data to governments, armies and intelligence agencies. The FBI, the US federal police, is a known buyer of this type of data.
What you can do
The EFF asks developers to disable location in advertising tools and to change the system: location sharing should be something you actively choose, not something that comes enabled without asking. Google, for its part, forces apps to declare what data they share, but it doesn’t audit every piece of code they carry inside.
In the meantime, as a user you can do something simple: check which apps have permission to know where you are. On Android this is done in Settings, then Privacy and then Location permissions. Revoke the permission from apps that don’t need your position to work. A maps app does need it; a flashlight or a game doesn’t. If an app stops working when you remove the permission, it really was using it.
It isn’t a hacker trick or a one-off bug. It’s a normal practice of the advertising industry, and it happens silently, every day, on millions of phones. Knowing about it is the first step to deciding which data you want to share and which you don’t.
