Police Obtain Location Data from 200+ App Ad SDKs Without Warrants

Agencies submitted geofence requests directly to mobile advertising exchanges rather than carriers or device makers. SDKs from companies supplying location bids to real-time bidding auctions returned latitude-longitude pairs tied to advertising identifiers at five-to-fifteen-minute intervals. Transaction logs show 1.2 million such queries processed between January and October 2025.

Data flows originated in apps whose privacy policies listed "partners" for ad targeting but omitted law-enforcement access clauses. Cross-referencing with app store manifests reveals repeated inclusion of the same three location SDKs in finance, weather, and gaming titles. No court filings referenced user consent or minimization procedures.

Existing reporting focused on single exchanges; the pattern spans multiple demand-side platforms that aggregate bids from hundreds of publishers. This multiplies the surface area beyond any one app's user base. Retention schedules for raw coordinates remain governed by advertising contracts, not criminal procedure rules.

Next quarter, at least two major SDK providers plan to segment location endpoints behind separate enterprise APIs. Threshold for measurable adoption is 15 percent of current bid traffic by Q3 2026.