Thread by @EFF

Last fall, Apple & Google took action against data broker X-Mode after we learned of its ties to US defense contractors. Last month, Google kicked another location data broker from its stores—Predicio. These moves help users, but they’re not enough. Thread.eff.org/deeplinks/2021…

The data brokers, X-Mode and Predicio, have each been the subject of reports over the past year that reveal how U.S. government agencies—including the Department of Defense and ICE—try to work around the 4th amendment by buying location data on the private market.

In 2018 the Supreme Court handed down US v. Carpenter, a landmark decision which ruled that location data collected from cell towers is protected by the 4th Amendment—meaning law enforcement can’t get your location from your cell carrier without a warrant.eff.org/cases/carpente…

But dozens of companies collect and sell location data from a different source: mobile apps. Data brokers entice app developers to install pieces of third-party code, called SDKs, which collect raw GPS data and feed it directly to the brokers.

These data brokers then resell the location feeds to advertisers, hedge funds, other data brokers, and governments all around the world.

@xmodesocial collected data from thousands of apps including Muslim Pro, one of the most popular Muslim prayer apps in the U.S. X-Mode allegedly sold that data to several Pentagon contractors. vice.com/en/article/jgq…

Another broker, @Predicio_Apps, collected data from hundreds of apps including Fu*** Weather and Salaat First. It then sold data to @GravyAnalytics, whose subsidiary Venntel has provided location data to the IRS, @CBP, and @ICEgov.
nrkbeta.no/2020/12/03/my-…

It took months of investigation by @motherboard, @WSJ, @NRKbeta, @protocol, and more to piece together the flow from these apps to the government. These reporters deserve our gratitude. But we shouldn’t have to wait for companies to come into the spotlight before banning them.

We know brokers continue to mine location data from our apps and sell it to military and law enforcement - we just don’t know which apps.

For example, we know that @BabelKnowledge sells its secretive Locate X product, which comprises real-time location data about untold numbers of users, to @DHSgov, @DeptofDefense, and the Secret Service. protocol.com/government-buy…

This data reportedly comes from thousands of different mobile apps. But figuring out which apps are responsible is difficult. Even the app developers involved often don’t know where the data they share will end up.

Users can’t make educated choices without knowing where or how their data will be shared. And platforms shouldn’t wait on journalists to establish end-to-end data flows before taking steps to protect users. It’s too easy for data brokers to mask their behavior.

This ecosystem must be better regulated. Local community control of police surveillance laws can ban police and other local government agencies from acquiring surveillance tech, including data broker deals, without legislative permission & community input. eff.org/deeplinks/2016…

EFF will also continue pushing for legislation and judicial decisions that, as required by the Fourth Amendment, prevent the government at all levels from buying this kind of data without first getting a warrant.

But in the meantime, many government agencies will continue buying location data for as long as they believe they can.

App stores are in a unique position to protect tech users from app-powered surveillance. We applaud Apple and Google for taking action against X-Mode and Predicio. But so far, they have only addressed the tip of the iceberg.

Now they should take the next step: ban SDKs from any data brokers that collect and sell our location information.

There is no good reason for apps to collect and sell location data, especially when users have no way of knowing how that data will be used. We implore Apple and Google to end this seedy industry, and make it clear that location data brokers are not welcome on their app stores.