The privacy problem on your phone usually isn't the app you're thinking about. It's one layer down — in the advertising and analytics libraries developers bolt on without writing them, and often without fully understanding them.
Research published this summer by the Electronic Frontier Foundation, and covered by TechCrunch in early August, describes advertising SDKs quietly passing location data into ad systems where data brokers can collect it. The developers often have no idea their apps are doing it. And if the person who built the app doesn't know, the person who installed it has no chance at all.
Why this beats a merely bad app
One privacy-hostile app is a solvable problem. You delete it and you're done.
A library sitting inside thousands of unrelated apps isn't solvable that way, because the exposure has nothing to do with what the app is for. A parking app, a fitness tracker, and a puzzle game can all carry the same advertising component, and each becomes a location source. Nothing on the outside tells you which apps have it.
And the destinations aren't hypothetical. EFF documents advertising-sourced location data turning up in ICE investigations, in commercial surveillance tools, and in tracking aimed at union organizers and US military personnel. Data gathered to sell you shoes does not stay in the shoe business.
Consent screens describe intentions, not behavior
The second finding is the one that stings: consent mechanisms often fail at the implementation level. Analytics SDKs fire before you've touched the consent dialog. Advertising identifiers go out without an explicit opt-in. Third-party trackers keep running after you've said no.
Mostly this isn't malice. It's what happens when consent lives in one part of an app and data collection lives in components nobody wired into that decision. The result is identical either way: tapping "reject" tells you what the app meant to do, not what it did.
The contacts problem
Worth separating out: the FBI has warned that foreign-developed apps — it specifically flags ones tied to China — can collect data about people who never installed anything. The route in is your address book. Grant contacts access and the names, numbers and email addresses of everyone you know travel with it, potentially onto servers in places where local law lets the government read them.
Contacts is the least-considered permission on any phone, because the cost lands on people who aren't in the room to object.
What actually shrinks your exposure
Audit location permissions and downgrade nearly everything. Very few apps need location, and fewer need it in the background. Set apps to "while using" at most, and switch off precise location for anything that isn't navigation or delivery. Approximate location is plenty for weather and local search — and much less valuable to a broker.
Kill the advertising identifier. On iOS, decline tracking prompts and turn off personalized ads. On Android, you can now delete the advertising ID outright in privacy settings. It doesn't stop collection, but it breaks the join that makes collected data worth money.
Say no to contacts by default. Almost nothing needs your address book. If an app insists, ask why it can't just let you type a name.
Review permissions on a schedule instead of at install time. Both platforms show which apps used location recently, and that list is usually a surprise. It's the fastest way to find a library you never agreed to.
Delete apps you've stopped opening. Dormant apps keep their permissions, and they keep their SDKs.
The uncomfortable part
None of this is a fix, because the leak is structural — it lives in a supply chain users can't see and most developers never audit. What these settings buy you is less surface area and a broken identifier chain. That's meaningfully better than nothing, and a good deal less control than the settings screen implies you have.
Image: Theo Decker, via Pexels
