Neither WhatsApp nor Instagram: the app that spies on your movements without your knowledge

A shocking privacy issue has been unearthed involving a hack of Gravy Analytics, a location data company, which has shown that thousands of apps have been unknowingly tracking historical location data of millions of smartphones that could, in theory, be sold onto various clients.

It turns out thousands of popular apps like Candy Crush, Tinder, MyFitnessPal, My Period Calendar & Tracker, Tumblr, Microsoft’s 365 office app and Flightradar24 across both Android and iOS have been part of a system that shares users’ precise locations through real-time bidding in digital ads.

This means the apps themselves weren’t directly tracking users; instead, data brokers were secretly taking location info during the ad-buying process without users or even the app creators realising it.

And it gets worse: according to WIRED, the data ends up at a “location data company whose subsidiary has previously sold global location data to US law enforcement." This was done through a subsidiary called Venntel, who has supplied data to groups like the FBI and ICE.

“For the first time publicly, we seem to have proof that one of the largest data brokers selling to both commercial and government clients appears to be acquiring their data from the online advertising ‘bid stream,’” rather than code embedded into the apps themselves, Zach Edwards, senior threat analyst at cybersecurity firm Silent Push via WIRED.

“This is a nightmare scenario for privacy, because not only does this data breach contain data scraped from the RTB systems, but there’s some company out there acting like a global honey badger, doing whatever it pleases with every piece of data that comes its way,” Edwards added.

Related stories

Health

Nationwide blueberry recall escalated to most serious classification

Fourth of July

Here's a look at what businesses will be open on the Fourth of July holiday

Reports say that included in the data are tens of millions of mobile phone coordinates of devices across the US, Russia, and Europe. One expert, via TechCrunch, warned that “the data also allows for easy deanonymisation of ordinary individuals; in one example, the data tracked a person as they traveled from New York to their home in Tennessee".

Get your game on! Whether you’re into NFL touchdowns, NBA buzzer-beaters, world-class soccer goals, or MLB home runs, our app has it all. Dive into live coverage, expert insights, breaking news, exclusive videos, and more – plus, stay updated on the latest in current affairs and entertainment. Download now for all-access coverage, right at your fingertips – anytime, anywhere.