PTKDMobile App Security
Knowledge base / PTKD-PRIV-SENSITIVE-TO-TRACKER
medium M6 MASVS-PRIVACY-2 static analysis PTKD-PRIV-SENSITIVE-TO-TRACKER

Sensitive data may be shared with a third-party SDK

The app holds a sensitive permission and bundles an advertising/profiling/identification SDK, so that data category can flow to a third party — a GDPR/CCPA disclosure-and-consent concern.

How it's exploited

The app holds a sensitive permission (precise location, contacts, microphone) and also bundles an advertising or profiling SDK. That data category can flow to a third party, and ad/profiling SDKs are built to collect exactly this kind of signal for targeting.

Why it matters

Sensitive personal data reaching an external processor without a lawful basis is a GDPR/CCPA violation and a serious trust breach.

How to fix it

  1. Verify the SDK is not sent the sensitive data; disable the relevant collection option if it is.
  2. Scope the permission tightly (approximate location, on-demand access) and gather consent before any sharing.
  3. Name every third-party recipient in your privacy disclosures.

References