Apps requesting background location with advertising SDKs present

What this finding means

ACCESS_BACKGROUND_LOCATION lets an app read the device's location while it is not in use. Android treats it as its own permission tier with its own consent prompt, separate from foreground location.

This category reports apps that declare it while also shipping advertising or analytics SDKs. We have recorded this in 375 apps. Either element alone is unremarkable; together they describe an app that can establish where a user is at all times and that also contains code whose business is sending data to third parties.

Why it matters

Google Play has a specific policy for background location. An app requesting it must demonstrate that the feature delivering it is central to the app, must disclose the use prominently in-app before the system prompt, and may be required to submit a declaration form. Apps have been removed for failing this.

Continuous location is also among the most sensitive data a phone holds: it reveals home, workplace, medical visits and religious attendance. Where advertising SDKs are present, the privacy question is not only what the app does with the location but what the SDKs are permitted to do with it.

How to fix it

• Establish whether background access is needed at all. Most location features work with foreground-only access plus the activity recognition or geofencing APIs, which do not require this permission.
• If it is needed, disclose the use in-app before the system prompt and state plainly which feature depends on it.
• Make sure the location data is not reachable by advertising SDKs, and check what the SDK's own configuration transmits by default.
• Declare the collection and any sharing in the Play Data Safety form, which this finding frequently accompanies.

How we detect it, and what it cannot tell you

The permission is read from the manifest and the SDKs from compiled package paths. Both are facts about the binary.

What this cannot show is use. A declared permission is a capability, not evidence that location was read, and an SDK compiled in may never be initialised. The combination is flagged because it is the one Play scrutinises, not because transmission has been observed.