Location permissions in the Android system allow applications to transmit users' precise coordinates to advertisers and data brokers. This occurs through advertising SDKs embedded in applications, as revealed by an investigation by the digital rights association Electronic Frontier Foundation (EFF), based in the United States.
According to this organization, some of these advertising packages are configured by default to access and transmit GPS data immediately after the user grants permission to the application. EFF claims that such tracking can happen even without the developers' knowledge, creating a privacy gap.
SDKs are code modules that developers use to add features to applications; in the case of advertising, they are used to display ads and generate revenue. However, Android lacks a specific location permission for these SDKs. Consequently, if an application receives authorization to access precise location data, integrated third-party libraries can theoretically also obtain this information.
EFF analyzed the documentation and network traffic of Android applications to determine which services receive location data. One example is the BidMachine system, which stated in its Play Store listing that it only collected approximate location. Nevertheless, the foundation discovered the transmission of precise coordinates in applications such as QR Scanner and GPS Speedometer, both of which have over 60 million downloads.
After being asked, the company updated its documentation, acknowledging the collection of precise location. The text states: 'The SDK never requests location permissions: it reads the device location only if the application has already received user permission.' However, the company did not specify how developers can disable this feature.
The investigation also mentions companies such as InMobi, described as the tenth most popular advertising library on Android, as well as Verve (responsible for HyBid SDK) and Huawei (Petal Ads SDK). All of them view location as a resource capable of increasing advertising revenue, which, according to EFF, creates a commercial incentive to maintain data collection.
Activist Bill Budington, a member of EFF, explained to TechCrunch that the analyzed SDKs represent 'a small part of a wider advertising ecosystem,' but this ecosystem already covers billions of users and tens of thousands of applications.
It is widely known that data collected by applications can be used for targeted advertising. It is not uncommon for people to encounter situations where, after searching for something, they are bombarded with similar offers, or see advertisements for local businesses while in another city.
However, EFF states that tracking precise location allows this information to be sold to governments and intelligence agencies, jeopardizing users' privacy. Currently, this data obtained by the advertising industry has been 'used for ICE (Immigration and Customs Enforcement) investigations [...] and US military tracking.'
The organization cites the Gravy Analytics leak in 2025 as an example of the scale of the problem. At the time, this company had contracts with giants such as Uber, Apple, and the U.S. government, which used the data to monitor potential illegal immigrants.
Advertising SDKs should not share sensitive data by default. Until governments worldwide establish specific rules, EFF advocates for data collection to be disabled, and for developers to always disable any unnecessary transmission when possible.
