InMobi and 3 Ad SDKs Leak Your Location by Default

A developer builds a QR code scanner. It needs the camera. Somewhere along the way it also asks for location, because a map feature seemed useful, and the developer drops in an advertising library to pay for the free tier. That developer has now, without writing a single line of tracking code, arranged for a stranger's precise coordinates to enter an open auction. The Electronic Frontier Foundation just measured exactly how that happens.

Key Takeaways

• EFF tested four Android advertising libraries and found all four transmit precise location by default once the host app holds a location permission.
• InMobi is the tenth most popular Android SDK and reaches more than two billion users; Verve's HyBid library sits in over 10,000 apps and reaches 1.5 billion; BidMachine reports 600 million direct users; Huawei's Petal Ads is embedded in more than 85,000 apps.
• A QR Scanner app with over 50 million downloads and a GPS Speedometer app with over 10 million downloads shared location without declaring it in Google Play's data safety section.
• Researchers used mitmproxy to intercept traffic and the Frida instrumentation toolkit on test devices, so the findings come from observed network requests rather than from documentation.
• Location shared into real time bidding auctions is visible to every participating bidder, which is the documented pathway by which location data reaches commercial data brokers.

Which Ad SDKs Are Leaking Location?

Four, and their combined reach is close to the entire Android install base.

• InMobi. The tenth most popular SDK on Android by EFF's count, reaching more than two billion users. Its documentation says it automatically forwards location signals when they are available, and it recommends requesting precise permissions on the grounds that precision earns higher revenue.
• BidMachine. More than 600 million direct SDK users. Its own documentation states the SDK can automatically track user device location once permissions are granted.
• Verve, via the HyBid library. Over 10,000 apps and roughly 1.5 billion users. Location tracking is described as enabled by default.
• Huawei Petal Ads. More than 85,000 embedded apps. Location is included in ad requests by default, and a developer who wants it excluded has to explicitly call a setRequestLocation method to switch it off.

Read the full EFF write up for the request captures behind each of those claims.

What Does "By Default" Actually Mean Here?

It means the data flows unless somebody stops it, and the person who could stop it usually does not know they need to.

This is the part worth sitting with. The location permission you granted was granted to the app. Android's permission model has no concept of granting a permission to one library inside an app and withholding it from another. Once the app process holds the permission, every SDK linked into that process can call the location APIs, and the ad library does exactly that.

So the consent you gave the flashlight app to find your nearest sunset time is, in practice, consent given to an advertising network you have never heard of, operating under a privacy policy you have never read, in a country you may never have visited. The developer did not deceive you. The default did.

Huawei's case is the clearest illustration: excluding location requires an affirmative method call. Silence means send it.

How Did Researchers Find This?

By watching the wire rather than reading the marketing pages.

The team ran test applications on Android devices in a lab and put mitmproxy in front of them to decrypt and inspect HTTP and HTTPS traffic. Where an SDK pinned certificates or obscured its payloads, they used Frida, a dynamic instrumentation toolkit that hooks running processes and lets you observe what a function actually receives at runtime.

That methodology matters because it removes the usual escape hatch. A vendor can argue about what its policy permits. It cannot argue about a captured request containing a latitude and a longitude.

Which Apps Were Caught?

Two ordinary utilities with enormous install counts, and neither disclosed the sharing.

A QR Scanner application with more than 50 million downloads and a GPS Speedometer application with more than 10 million downloads both transmitted user location without declaring that transmission in Google Play's data safety section. The data safety section is the label Google introduced precisely so that users would not have to reverse engineer an APK to know what leaves their phone.

The likeliest explanation is not malice. It is that the developers did not know either. A data safety declaration is filled in by a human who is describing the code they wrote, and the leak is in code they merely linked against. That is the whole point of the EFF advisory being addressed to developers rather than to users.

Why Does Location End Up With Data Brokers?

Because real time bidding broadcasts the bid request to everyone invited to bid, and losing bidders keep what they saw.

When an ad slot loads, the SDK assembles a bid request describing the opportunity: device, app, advertising identifier and, in these cases, coordinates. That request goes out to many demand side platforms at once. One of them wins and serves an ad. The rest lost the auction but still received the request, and nothing technical prevents them from retaining it. A firm can therefore build a location dataset without ever buying a single ad.

EFF has documented this pipeline before in consumer apps, including its finding that Grindr contacted 20 trackers within 15 minutes of use. The buying end of that pipeline is what states have started to regulate directly, as with California's data broker deletion regime and its penalties per ignored request.

What Should Developers and Users Actually Do?

EFF's recommendations split cleanly by audience, and each has a concrete first step.

If you ship an Android app: audit every third party SDK you link against, read its location configuration rather than assuming the default is conservative, and explicitly disable collection you do not need. Then verify with a proxy that the traffic matches your data safety declaration. Assume nothing from the documentation alone, since the documentation here is what markets precise location as a revenue feature.

If you use an Android phone: go to Settings, then Location, then App location permissions, and downgrade anything that does not genuinely need coordinates from "precise" to "approximate", or to "ask every time". Denying location outright to utility apps costs almost nothing. Resetting your advertising ID periodically breaks some long term linkage, and turning off ad personalisation reduces the value of what does escape. On the desktop side, the same auction infrastructure is what anti tracking browser extensions exist to interrupt.

EFF's asks of regulators and legislators go further: hold app developers accountable for unlawful sharing, scrutinise the SDK vendors who design invasive defaults, pass a federal location privacy law carrying a private right of action, and consider whether behavioural advertising should exist in this form at all. Until any of that lands, the default stays what it is, and the default sends your coordinates.