Android app developers may be unwittingly sharing their users’ location data with advertisers
Android app developers may be unwittingly sharing their users’ location data with advertisers
安卓应用开发者可能在无意中与广告商共享了用户的地理位置数据
For many apps, granting permission to access your device’s precise location makes sense. Your favorite weather app needs to know where you are to get the day’s forecast, or your go-to fitness app for tracking your running route. 对于许多应用程序来说，授予其访问设备精确位置的权限是有意义的。你最喜欢的天气应用需要知道你的位置才能提供当天的天气预报，或者你常用的健身应用需要它来追踪你的跑步路线。
But some apps are also inadvertently sharing their users’ location data with third parties, including advertisers and data brokers, because the app developer may not know that this data-sharing setting is enabled by default. 但一些应用程序也在无意中与第三方（包括广告商和数据经纪人）共享了用户的地理位置数据，因为应用开发者可能并不知道此数据共享设置是默认开启的。
New findings by the Electronic Frontier Foundation aim to warn app developers that some of the third-party code they place in their apps may also collect their users’ location data when they grant permission to the app. Unless the developer actively switches off the collection, the code snippet (known as software development kits, or SDKs) will inherit the app’s permissions and collect the user’s precise location data. 电子前沿基金会（EFF）的最新研究旨在警告应用开发者：当用户授予应用权限时，开发者植入应用中的某些第三方代码也可能会收集用户的地理位置数据。除非开发者主动关闭该收集功能，否则这些代码片段（即软件开发工具包，简称 SDK）将继承应用的权限，并收集用户的精确位置数据。
The EFF says many developers might not realize that they are sharing their users’ location data with third parties by default and urged app makers to disable unnecessary data collection whenever possible. EFF 表示，许多开发者可能并未意识到他们默认就在与第三方共享用户的地理位置数据，并敦促应用开发者尽可能禁用不必要的数据收集。
While advertising SDKs are promoted as a way for developers to monetize their app, the trade-off is that the users’ location histories get fed to data brokers, who monetize that information, which then gets sold to militaries, governments, and intelligence agencies, like the FBI. The data is also a security and privacy risk if it gets hacked or stolen, which some data brokers have experienced. 虽然广告 SDK 被宣传为开发者实现应用变现的一种方式，但其代价是用户的地理位置历史记录会被输送给数据经纪人。这些经纪人将信息变现，随后将其出售给军队、政府和情报机构（如 FBI）。如果这些数据被黑客攻击或窃取，也会带来安全和隐私风险，而一些数据经纪人已经遭遇过此类事件。
Among the Android apps that the EFF identified that were quietly sharing users’ location data included two that had been downloaded a combined 60 million times to date. The EFF ran its tests by analyzing the apps’ network traffic and seeing which services are receiving the users’ location data. 在 EFF 识别出的悄悄共享用户地理位置数据的安卓应用中，包括两款迄今为止总下载量已达 6000 万次的应用。EFF 通过分析这些应用的流量并查看哪些服务正在接收用户的地理位置数据来进行测试。
Bill Budington, a senior staff technologist at the EFF, told TechCrunch that the SDKs they examined account for a small percentage of the broader advertising ecosystem but nevertheless claim to reach billions of users over tens of thousands of apps. That gives some sense of the scale of this type of location data collection. EFF 的高级技术专家 Bill Budington 告诉 TechCrunch，他们检查的 SDK 在更广泛的广告生态系统中仅占一小部分，但它们声称通过数万个应用程序覆盖了数十亿用户。这让人对这类地理位置数据收集的规模有了一定的了解。
The EFF’s report said that there are “no SDK-specific location permissions,” meaning that once the user allows their location data to be shared with the app, their location data is also shared with advertisers. The entities offering those SDKs are generally commercially incentivized to get their customers to collect more data. EFF 的报告指出，目前“没有针对 SDK 的特定位置权限”，这意味着一旦用户允许应用获取其地理位置数据，这些数据也会被共享给广告商。提供这些 SDK 的实体通常有商业动机，促使其客户收集更多数据。
“App-level location permissions alone cannot signal meaningful consent to location collection and sharing by third-party advertising SDKs,” wrote the EFF. “Advertising SDKs should not make sharing personal data the default, especially for data as sensitive as a person’s location.” EFF 写道：“仅凭应用层面的位置权限，无法代表用户对第三方广告 SDK 收集和共享位置数据表示了有效的同意。广告 SDK 不应将共享个人数据设为默认选项，尤其是对于像个人位置这样敏感的数据。”