A report released by the Electronic Frontier Foundation (EFF) in August 2026 details the ways that advertising software development kits (SDKs) that make it easy to monetize their apps can also automatically feed users’ location data into ad systems that location data brokers use to track people.
Data from these brokers, in turn, are available to anyone, including developers of illicit apps that target consumers of illegally distributed content. “While apps and SDKs can estimate a users’ approximate location from their IP address without requesting any permissions,” said EFF, “location permissions provide access to estimates that are more accurate and revealing. Precise location permissions give apps (and their embedded SDKs) access to location estimates within about 160 feet, but sometimes as accurate as 10 feet.
When an advertising SDK collects and shares location data, it becomes part of a larger ecosystem that can include advertisers, ad tech companies, and location data brokers. The data is usually sold without the knowledge or consent of the consumer.
Companies whose businesses depend on advertising revenue may bury the disclosure of this practice within their business terms or privacy notices, but few consumers read this. Consumers in the US are often powerless to do anything other than accept these terms, or not use the app at all.
Advice to policymakers
“Regulators should continue to hold app developers accountable when they unlawfully share personal data and include libraries which subject users to privacy harms, as they have in the past, said EFF. “But they should also scrutinize the companies whose SDKs encourage these practices at scale. Otherwise, companies can continue to design SDKs that make invasive data sharing the default while shifting the responsibility and consequences to developers who include their tools.
“The US is in dire need of federal law to protect all Americans’ location privacy, one which doesn’t preempt stronger state privacy laws, and has a private right of action empowering individuals to sue those who violate their privacy. Countries across the globe should likewise enact legislation that protects their users’ location privacy. Everyone deserves privacy as a universal human right,” said the report.
Why it matters
While this may seem, at best, tangential to piracy, it also is a violation of privacy. Many developers may not be aware of this privacy violation, let alone are users who are directly affected.
The report recommends that app developers review their privacy practices of third party tools integrated with theyr apps, and minimize the sharing of location information.
The situation also illustrates how easy it could be to assemble lists that micro-target individuals or geographically-contained groups for attacks.
Further reading
Developers: Beware of ad libraries that betray your users’ location privacy. Landing page with Article and links to report. August 4, 2026. by Lena Cohen and Bill Budington. Electronic Frontier Foundation (EFF)
