Third‑party code can leak sensitive info even after permission is granted
A new study by the Electronic Frontier Foundation warns that popular ad and analytics SDKs can harvest user location data, raising privacy concerns for developers and regulators alike.
A new study by the Electronic Frontier Foundation warns that third‑party code embedded in Android apps can collect user location data, even when developers do not explicitly request it.
Many Android applications incorporate advertising libraries and analytics SDKs that execute code outside the core app. These libraries frequently request broad permissions, including access to device location.
According to the foundation’s findings, when users grant location permission to the main app, the same permission is implicitly granted to all embedded SDKs.
The report highlighted that popular libraries such as AdMob, Unity Ads, and Firebase Analytics have been observed capturing GPS coordinates and transmitting them to remote servers.
Such behavior can occur even if the developer never directly requests location data, because the permission is granted at the app level.
Under regulations like GDPR and CCPA, collecting location data without explicit user consent can trigger penalties and reputational damage.
Developers should conduct a thorough audit of third‑party code, review privacy policies, and consider disabling unused permissions in the manifest.
The foundation recommends using tools such as privacy‑by‑design SDK wrappers that restrict data flow to only what is necessary for ad targeting. These wrappers can limit the scope of data collected and provide clearer user disclosures.
Regulatory bodies may increasingly scrutinize Android app developers for compliance, especially after the recent EU Digital Services Act.
In a public statement, the foundation called for clearer disclosure and tighter controls on third‑party data usage.
A new study by the Electronic Frontier Foundation warns that third‑party code embedded in Android apps can collect user location data, even when developers do not explicitly request it.
Many Android applications incorporate advertising libraries and analytics SDKs that execute code outside the core app. These libraries frequently request broad permissions, including access to device location.
According to the foundation’s findings, when users grant location permission to the main app, the same permission is implicitly granted to all embedded SDKs.
The report highlighted that popular libraries such as AdMob, Unity Ads, and Firebase Analytics have been observed capturing GPS coordinates and transmitting them to remote servers.
Such behavior can occur even if the developer never directly requests location data, because the permission is granted at the app level.
Under regulations like GDPR and CCPA, collecting location data without explicit user consent can trigger penalties and reputational damage.
Developers should conduct a thorough audit of third‑party code, review privacy policies, and consider disabling unused permissions in the manifest.
The foundation recommends using tools such as privacy‑by‑design SDK wrappers that restrict data flow to only what is necessary for ad targeting. These wrappers can limit the scope of data collected and provide clearer user disclosures.
Regulatory bodies may increasingly scrutinize Android app developers for compliance, especially after the recent EU Digital Services Act.
In a public statement, the foundation called for clearer disclosure and tighter controls on third‑party data usage.