Default data leaks: How advertising SDKs lead developers to track

Smartphone users often assume that granting location access to an app serves only the core function of that application. When allowing a navigation service, weather app, or QR code scanner access to GPS data, users typically expect their position to be used solely for the intended purpose. However, according to a recent analysis by the U.S.-based digital rights organization Electronic Frontier Foundation (EFF), many software development kits (SDKs) automatically forward location data to ad-tech systems. These systems then pass movement profiles into the hands of data brokers who create comprehensive surveillance profiles. The study by EFF researchers Lena Cohen and Bill Budington highlights the central role of real-time bidding (RTB) in this data flow. Once an app receives location permissions at the operating system level, third-party SDKs can access these data as well. During RTB auctions, advertising networks send data packets to thousands of potential advertisers. According to the investigation, data brokers frequently exploit these auctions to intercept movement data included in bid requests. The extent of this issue was demonstrated through the data breach involving broker Gravy Analytics, which revealed that many affected developers were unaware their apps had been used as data providers. Standard settings act as data traps. The problem intensifies due to how advertising SDKs are designed. Developers tend to adopt default settings without scrutiny. The EFF identified four widely used development kits that automatically collect and forward location data once the app permission is granted. For instance, InMobi has forwarding enabled by default and explicitly recommends granting precise GPS and Wi-Fi information to increase ad revenue. Similarly, the advertising service BidMachine initially claimed in its developer documentation that it did not collect precise location data. However, after inquiries from the EFF, the company corrected its documentation. Technical analyses of apps such as “QR Scanner” and “GPS Speedometer” showed otherwise. Likewise, the SDK HyBid from Verve and Petal Ads from Chinese manufacturer Huawei utilize pre-set location permissions and emphasize financial benefits for developers. While Verve stated they process approximate location data upon request, even imprecise location information allows conclusions about movement patterns with continuous collection. Huawei does mention monetization but hides the option to disable data collection deep within specific compliance documents. The risks extend beyond targeted advertising. According to the EFF, the issue goes far beyond these examples. If location data circulates through the advertising market, it creates risks beyond targeted ads. In the past, such datasets have already been used for law enforcement investigations, global espionage tools, tracking union organizers and military personnel, and exposing individuals. Granting location access at the operating system level does not constitute effective consent for sharing with third parties. Therefore, the EFF calls for a shift in thinking at all levels: developers must critically examine advertising SDKs and deactivate data collection. Regulatory authorities should hold not only programmers accountable but also creators of SDKs that undermine data protection. Activists advocate for stricter laws and a ban on behavior-based online advertising to eliminate the financial incentive for trading movement profiles.