In short: On 8 August 2026 the Electronic Frontier Foundation published research naming four Android advertising SDKs — InMobi, BidMachine, HyBid (Verve), and Huawei Petal Ads — that collect precise GPS coordinates by default, without separate user consent. The mechanism is architectural: Android grants every embedded SDK the same permissions as the host app. Grant location access to a weather app, and the ad library inside it quietly gets the same rights and ships your coordinates to ad auctions.
What the EFF Found
EFF researchers reviewed documentation for dozens of ad libraries that developers embed in Android apps. Four — InMobi, BidMachine, HyBid (Verve), and Petal Ads (Huawei) — enable location collection by default with no additional consent prompt. InMobi's developer docs explicitly encourage requesting precise location, calling it a way to increase user value for advertising partners. For background on how advertising IDs work, see our guide on advertising identifiers and how to disable them.
Two apps with tens of millions of downloads — QR Scanner (50M+) and GPS Speedometer (10M+) — were specifically named. Both transmitted precise coordinates to BidMachine without listing this in their Google Play Data Safety sections.
Why Android Architecture Makes This Easy
When a user grants location access to an app — for navigation, weather, or fitness — every SDK bundled inside inherits the same permission automatically. There is no separate dialog saying the advertising network wants your coordinates. Android sees one app, one permission. Users have no visibility into which third-party libraries benefit from the grant.
EFF argues this makes consent meaningless in practice. Permission dialogs describe one use case (weather forecast) but silently authorise a data market (sell coordinates to ad exchanges). Precise GPS signals command a premium in RTB auctions: the more exact the location, the more valuable the user profile.
Where Your Location Data Goes
Coordinates flow into Real-Time Bidding (RTB) auctions where hundreds of companies compete to show you an ad. Every auction broadcasts your data to all bidders simultaneously — not just the winner. From RTB, data lands at brokers who build persistent profiles: home address, workplace, medical facilities visited, regular travel routes.
The 2025 Gravy Analytics breach illustrated the stakes: ICE, the US immigration enforcement agency, used the broker's datasets to track specific individuals. The same data was used to monitor activists and military personnel. For ordinary users the risk is analogous: the route home — office — clinic produces a profile from which insurers and employers infer health status, finances, and lifestyle.
How to Reduce the Risk
- Grant location "only while using" the app, never "always." Background access enables silent collection. Settings → Apps → [App] → Permissions → Location.
- Choose approximate location. Android 12 and later lets you cap precision. Most utilities work identically; ad SDKs lose most of their targeting value without precise coordinates.
- Reset your advertising ID regularly (Settings → Privacy → Ads → Reset advertising ID). This disrupts long-term profile continuity without stopping collection.
- Use a no-logs VPN. LiMP VPN replaces your real IP and encrypts traffic, preventing SDKs from linking location data to a specific connection, provider, or household. IP address is a core profiling signal when precise GPS is unavailable or permission is denied.
- Audit utility apps. Remove or replace apps from unknown publishers that request location without an obvious need. Check installed SDKs with Exodus Privacy.
For a wider look at mobile tracking risks see our guide on how to protect your phone from tracking.