The Electronic Frontier Foundation is warning Android app developers that third-party advertising SDKs — code libraries bundled into apps to serve ads — can silently collect and transmit users' precise location data, using the app's own location permissions without asking the user again.

In a report titled "Developers beware: Ad libraries betray your users' location privacy," published on the EFF's Deeplinks blog in July 2026, the digital rights organization explained how advertising SDKs operate within Android's permission model. Unless a developer actively disables the collection, the SDK inherits the app's granted permissions and sends the user's precise location to third-party advertising services (TechCrunch).

The EFF's central technical finding is blunt: there are "no SDK-specific location permissions." Once a user grants location access to an app, that permission extends to the advertising libraries bundled inside it. The organization concluded that "App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs" (TechCrunch).

Think of it this way: when you grant a weather app permission to see your location, you are effectively granting that same permission to every piece of third-party code the app's developer chose to include — even code whose only job is to serve advertisements. The operating system does not distinguish between the app developer's own code and a third-party ad library when enforcing permissions.

To reach these conclusions, EFF researchers analyzed the network traffic of targeted Android apps to observe which services received users' location data in transit. Among the apps the EFF identified as quietly sharing location data, two had been downloaded a combined 60 million times (TechCrunch).

Bill Budington, a senior staff technologist at the EFF, noted that the SDKs examined in the investigation account for only a small percentage of the broader advertising ecosystem. They nonetheless claim to reach billions of users across tens of thousands of apps (TechCrunch).

The EFF urged app developers to disable unnecessary data collection whenever possible and stated that advertising SDKs should not make sharing personal data the default, particularly for data as sensitive as a person's location (TechCrunch).

The findings are not isolated. Academic research presented at the FTC's PrivacyCon 2019 by J. Reardon et al. documented that Android developers routinely integrate third-party libraries for crash reporting, analytics, social-network integration, and other functions, and that these libraries can circumvent Android's permissions system entirely (FTC). The EFF maintains on its "Location Data Brokers" issue page that dozens of data brokers collect information about the precise movements of hundreds of millions of people without their consent (EFF).

The problem has proven resistant to platform-level intervention. The Markup reported in February 2022 that Google and Apple had attempted to crack down on location data brokers, but that brokers were moving to new collection methods harder for the platforms to police (The Markup). In March 2026, the EFF separately reported that the online advertising industry has constructed what the organization described as a massive surveillance apparatus that the US government can co-opt for its own purposes, citing Customs and Border Protection as an example (EFF).

The architectural issue at the core of the EFF's findings is not new to anyone who has traced the Android permission model over the years. Android treats location permission as app-scoped, meaning the permission covers everything running inside that app. When a user grants location access to an application, every code module running within that application's process — including bundled third-party SDKs — gains access to the same location data. The operating system has no mechanism to tell the difference between the app developer's own code and a third-party ad library when it comes to permission enforcement.

What the EFF's traffic analysis makes concrete is that this is not a theoretical gap. The SDKs are actively transmitting the data. Developers who include advertising SDKs for monetization may be doing so without realizing that their users' location data flows to advertisers by default. The user's consent dialog, which names the application, never names the third parties that ultimately receive the data.

In this author's view, the practical implication for developers is straightforward: any SDK included in an app that requests location permissions should be treated as a potential data pipeline to third parties unless the developer has verified, through network-level inspection or SDK documentation, that it does not transmit location data. The EFF's recommendation to disable unnecessary collection is the minimum responsible action. Developers who monetize through advertising SDKs and also request location access should treat those two decisions as in tension with each other and audit the resulting data flows accordingly.

The broader context here is one of accumulated accountability failures across the stack. Platform vendors have tightened location permissions on paper. Data brokers have adapted. Ad SDKs continue to operate within the permissions they inherit. And the consent that users believe they are granting — to a single app for a single purpose — is in practice distributed to parties they will never see named.