The Electronic Frontier Foundation, a digital rights group, is warning that advertising code hidden inside Android apps can quietly send your precise location to advertising companies — using the permission you gave to the app, without asking you again.

The EFF published its findings in July 2026 in a report called "Developers beware: Ad libraries betray your users' location privacy" on the organization's Deeplinks blog. The report explains how pieces of advertising code, built into apps by their developers, can take advantage of the app's location permission and send your location to outside advertising services. This happens unless the developer has specifically turned off the data collection (TechCrunch).

The EFF's key finding is simple: there are "no SDK-specific location permissions." In plain terms, when you say yes to an app's request for your location, every piece of code inside that app — including code from outside advertising companies — gets the same access. The organization concluded that "App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs" (TechCrunch).

A useful way to think about this: imagine giving your house key to a plumber you hired. Without your knowledge, the plumber makes a copy of that key and hands it to a marketing company down the street. You gave permission to the plumber to enter your home — not to the marketer. But the plumber had the key, and no one stopped the handoff.

To reach these conclusions, EFF researchers watched the data flowing out of certain Android apps to see which companies were receiving users' location information. Among the apps they found quietly sharing location data, two had been downloaded a combined 60 million times (TechCrunch).

Bill Budington, a senior staff technologist at the EFF, noted that the advertising code they examined represents only a small slice of the broader advertising world. Even so, those code libraries claim to reach billions of users across tens of thousands of apps (TechCrunch).

The EFF urged app developers to turn off unnecessary data collection whenever possible. The organization stated that advertising code should not make sharing personal data the default, especially for something as sensitive as a person's location (TechCrunch).

This is not a one-time problem. Research presented at the FTC's PrivacyCon 2019 by J. Reardon et al. showed that Android developers regularly add outside code for things like crash reports, usage tracking, and social media features, and that this code can get around Android's permission system entirely (FTC). The EFF also maintains on its "Location Data Brokers" issue page that dozens of data brokers collect information about the precise movements of hundreds of millions of people without their consent (EFF).

The problem has been hard to fix. The Markup reported in February 2022 that Google and Apple had tried to crack down on location data brokers, but that brokers were shifting to new collection methods that are harder for the platforms to catch (The Markup). In March 2026, the EFF separately reported that the online advertising industry has built what the organization called a massive surveillance system that the US government can use for its own purposes, citing Customs and Border Protection as an example (EFF).

The root of the issue lies in how Android handles permissions. Android gives location access to an entire app at once. When you allow an app to see your location, every piece of code running inside that app gets the same access — including advertising code from outside companies. The operating system has no way to tell the difference between the app's own code and a third-party advertising library.

What the EFF's investigation shows is that this is not just a possibility. The advertising code is actively sending the data. Developers who include advertising code to make money from their apps may not realize that their users' location data is flowing to advertisers automatically. And the permission popup the user sees — which names the app — never names the outside companies that end up receiving the data.

In this author's view, the practical takeaway for developers is straightforward: any outside code included in an app that requests location permission should be treated as a potential pipeline sending data to third parties, unless the developer has checked the documentation or tested the network traffic to confirm it does not transmit location data. The EFF's recommendation to disable unnecessary collection is the minimum responsible step. Developers who both use advertising code and ask for location access should see those two decisions as potentially in conflict, and should check what data is actually flowing out.

The broader context here is one of accountability failures stacking up across the system. Platform vendors have tightened location permissions on paper. Data brokers have adapted. Ad code continues to operate within the permissions it inherits. And the consent that users believe they are giving — to a single app, for a single purpose — ends up distributed to parties they will never see named.