First Published: 7 Sep 2018
Last Revised: 21 June 2019

Contact: info@guardianapp.com

The Guardian Firewall team has discovered that a growing number of iOS apps have been used to covertly collect precise location histories from tens of millions of mobile devices, using packaged code provided by data monetization firms. In many cases, the packaged tracking code may run at all times, constantly sending user GPS coordinates and other information.

In order to gain initial access to precise data from the mobile device’s GPS sensors, the apps usually present a plausible justification relevant to the app in the Location Services permission dialog, often with little or no mention of the fact that location data will be shared with third-party entities for purposes unrelated to app operation.

All location data monetization firms listed on this page collect one or more of the following data points:

• Bluetooth LE Beacon Data
• GPS Longitude and Latitude
• Wi-Fi SSID (Network Name) and BSSID (Network MAC Address)

In addition, some firms also collect the following types of less sensitive device information:

• Accelerometer Information (X-axis, Y-axis, Z-axis)
• Advertising Identifier (IDFA)
• Battery Charge Percentage and Status (Battery or USB Charger)
• Cellular Network MCC/MNC
• Cellular Network Name
• GPS Altitude and/or Speed
• Timestamps for departure/arrival to a location

This page contains potential mitigations for end users, 24 examples of apps which contain code from location data monetization firms, 12 known location data monetization firms, and nearly 100 examples of regional/local news apps which have previously contained code from a specific location data monetization firm (RevealMobile).

All known hostnames for location data monetization firms will be listed, so that users may block connections to these domain names if they choose.

Potential Mitigations

• Go to Settings > Privacy > Advertising and turn on Limit Ad Tracking in order to make uniquely identification of your iOS device more difficult for location trackers.
• Press “Don’t Allow” if a Location Services permission dialog contains “See privacy policy” or similar text.
• Use a very generic name for the SSID of your home Wi-Fi router (eg. “home-wifi-1”).
• Turn off Bluetooth functionality when it is not in use.

Examples of Affected Applications

The following are 24 examples of popular or well-known iOS apps confirmed to send data to a third-party data monetization firm (See Data Sourcing and Validation for more information on the process). Additionally, nearly 100 regional/local news apps have been confirmed to previously include code from RevealMobile in their apps (See RevealMobile in Local News Apps for more information).

1. ASKfm: Ask Anonymous Questions (fm.ask.askfm)

ASKfm is a social networking app for iOS which claims to have a user base of over 215,000,000 users (“Over 215M users love ASKfm!”). This app contains location tracking code from AreaMetrics and Huq. The location tracking code is present as of the latest app version (4.24, released August 30, 2018).

The justification pop up presented to users when requesting access to Location Services while the app is open contains the following text: “This information won’t be shared with anyone.” and then uses the text “ASKfm needs your location to improve some features. You can always change this later in your device’s settings.” for access when the app is not open.

2. C25K 5K Trainer (com.zenlabs.c25kfree)

C25K 5K Trainer is a fitness app for iOS which appears to claim to have a large user base (“Millions of success stories!”). This app contains location tracking code from Sense 360. The location tracking code is present as of the latest app version (4.9.2, released May 18, 2018).

The justification pop up presented to users when requesting access to Location Services uses the following text: “Please enable GPS for increased accuracy with voice alerts, and more. Continued use of GPS running in the background can dramatically decrease battery life. See privacy policy for details.”

3. Classifieds 2.0 Marketplace (com.orgmentis.buyandsell)

Classifieds 2.0 Marketplace is a local classifieds app for iOS which appears to claim to have a large user base (“Join our huge community of happy users”). This app contains location tracking code from AreaMetrics and Fysical. The location tracking code is present as of the latest app version (2.9.1, released August 25, 2018).

This app previously contained location tracking by Cuebiq, although it does not appear to be present in the latest version.

The justification pop up presented to users when requesting access to Location Services uses the following text: “We need your location to automatically show you local listings and alert you of new relevant listings available nearby.”

4. Code Scanner by ScanLife (com.att.ATTScanner)

Code Scanner by ScanLife is a shopping app for iOS, allowing users to scan barcodes for price comparison purposes. This app contains location tracking code from InMarket and Sense 360. The location tracking code is present as of the latest app version (7.0.5, released May 31, 2018).

The justification pop up presented to users when requesting access to Location Services while the app is open contains the following text: “Location is used to find local deals.” and then uses the text “Location is used to enable location-based rewards and opportunities and to find nearby merchants” for access when the app is not open.

5. Coupon Sherpa (com.sherpa.couponsherpa)

Coupon Sherpa is a coupon app for iOS which claims to be an “iTunes Staff Favorite” in the app description. This app contains location tracking code from InMarket and Sense 360. The location tracking code is present as of the latest app version (3.2, released May 10, 2017).

The justification pop up presented to users when requesting access to Location Services uses the following text: “Location/Bluetooth- data may be used for providing relevant and timely coupons and for providing more applicable ads.”

6. GasBuddy (com.gasbuddymobile.gasbuddy)

GasBuddy is a travel app for iOS, allowing users to save money on gas purchases, which claims to have a user base of 70,000,000 users (“Save money, save time and never pay full price for gas again with a community of 70 million users”). This app contains location tracking code from Cuebiq. The location tracking code is present as of the latest app version (5.31.0, released August 31, 2018).

The justification pop up presented to users when requesting access to Location Services while the app is open contains the following text: “We use your location to provide local gas prices and more. See our privacy policy.” and then uses the text “We use your location to provide local gas prices and personalize your experience. See our privacy policy.” for access when the app is not open.

7. Homes.com (com.homes.com.homes)

UPDATE (14 Sep 2018): An update has been released (9.6.12) to the App Store, properly removing AreaMetrics code. The GuardianApp team has used a network traffic analyzer to validate the absence of AreaMetrics connections in this update. Additionally, upon request from Homes.com staff, the GuardianApp team has provided Homes.com with advice regarding use of network traffic analysis tools to prevent any future accidental inclusions of unwanted location tracking code.

Homes.com is a real estate app for iOS with over 10,000 user ratings. This app contains location tracking code from AreaMetrics. The location tracking code is present as of the latest app version (9.6.10, released August 7, 2018).

The precise revision of AreaMetrics code present in the latest version of Homes.com appears to be old code from an unknown date in 2016, indicating the possibility that Homes.com may be unaware their app still continues to send the GPS longitude and latitude of their users to a third-party firm when the Homes.com app is opened.

The justification pop up presented to users when requesting access to Location Services uses the following text: “We use location to find nearby homes ... you can always turn this feature off later 😊”

8. Mobiletag (com.yourcompany.Mobiletag)

Mobiletag is a French shopping app for iOS, allowing users to scan barcodes for price comparisons and coupons, which appears to claim to have a user base of 22,000,000 users (“[…] makes the life of 22 millions of consumers easier”). This app contains location tracking code from two French location data monetization firms (Both are still being investigated by the GuardianApp team). The location tracking code is present as of the latest app version (7.6.19, released May 8, 2018).

This app previously contained location tracking by Teemo, although it does not appear to be present in the latest version.

The justification pop up presented to users when requesting access to Location Services uses the following text: “Votre position est utile à Flashcode et peut être partagée avec ses partenaires pour personnaliser au mieux les promotions et publicités vues sur votre mobile.” (English Translation via Google: “Your location is useful for Flashcode and can be shared with its partners to better customize the promotions and advertisements seen on your mobile.”)

9. Moco - Chat, Meet People (com.mocospace.mocoapp)

Moco is a social networking app which appears to claim to have a large user base (“Chat now with millions of people nearby or around the world” and “MocoSpace is the largest social network of African Americans and Hispanics / Latinos in the world!”). This app previously contained location tracking code from Teemo. The location tracking code was present at least between February 2018 (2.6.57) and April 2018 (2.6.60). This location tracking code may have been present in other versions Moco which we have not yet analyzed. 

The justification pop up presented to users when requesting access to Location Services, for app versions 2.6.57 through 2.6.60, uses the following text: “Location based social networking for meeting people nearby”

10. My Aurora Forecast (com.jrustonapps.My-Aurora-Forecast)

My Aurora Forecast is a weather app for users who would like information on the Northern Lights, with over 4,000 user ratings. This app previously contained location tracking code from Huq. The location tracking code was present in May 2018 (1.8.9). This location tracking code may have been present in other versions My Aurora Forecast which we have not yet fully analyzed.

The justification pop up presented to users when requesting access to Location Services while the app is open, for app version 1.8.9, uses the following text: “Your location is needed for notifications and for calculating how likely you are to see the aurora.”

11. MyRadar NOAA Weather Radar (com.fboweb.MyRadar)

MyRadar NOAA Weather Radar is weather app for iOS ranked #3 in the Top Free Weather apps in the App Store, with over 160,000 user ratings, which claims to have a large user base (“Thanks to everyone for making MyRadar so successful, with over 35 million downloads!”). This app contains location tracking code from Cuebiq. The location tracking code is present as of the latest app version (6.1.0, released August 27, 2018).

The justification pop up presented to users when requesting access to Location Services, for app versions 6.0.1 (released June 29, 2018) and earlier, uses the following text: “MyRadar needs your location to show your position on the map, as well as for advanced features including critical weather warnings. See privacy policy.”

The justification pop up presented to users when requesting access to Location Services, for app versions 6.0.2 (released August 17, 2018) and later, uses the following text: “MyRadar needs your location to show your position on the map, as well as for advanced features including critical weather warnings. We also share this data with third parties for monetization and analytics purposes. See privacy policy for full details.”

12. NOAA Weather Radar (com.apalonapps.radarfree)

NOAA Weather Radar is a weather app for iOS ranked #2 in the Top Free Weather apps in the App Store, with over 260,000 user ratings.. This app previously contained location tracking code from Factual, Sense 360, and Teemo. The location tracking code was present in March 2018 (3.21). This location tracking code may have been present in other versions NOAA Weather Radar which we have not yet analyzed.

The justification pop up presented to users when requesting access to Location Services while the app is open, for app version 3.21, uses the following text: “Your location is shown on the map and is used to provide weather info.” and then uses the text “Get weather info and alerts for new destinations as you travel.” for access when the app is not open.

13. PayByPhone Parking (com.verrus.paybyphone)

PayByPhone Parking is a parking app for iOS, which claims to have a user base of 12,000,000 daily active users (“12 million motorists use the service to take control of their parking every day.”). This app previously contained location tracking code from AreaMetrics. The location tracking code was present in November 2017 (3.2.0). This location tracking code may have been present in other versions PayByPhone Parking which we have not yet analyzed.

The justification pop up presented to users when requesting access to Location Services, for app version 3.2.0, uses the following text: “Share your location with PayByPhone, so that we can offer you personalized features like nearby parking.”

14. Perfect365 (com.arcsoft.Perfect365)

Perfect365 is an augmented reality beauty app for iOS with over 50,000 user ratings, which claims to have a user base of over 100,000,000 users (“More than 100 million users and counting"). This app contains location tracking code from at least 8 different location data monetization firms. The location tracking code is present as of the latest app version (7.44.23, released September 3, 2018).

The justification pop up presented to users when requesting access to Location Services uses the following text: “Enable Perfect365 to customize your experience based on your location and more. See our Privacy Policy for details.”

The GuardianApp team has noted that Perfect365, in at least one or more versions of their app throughout 2018, has contained code from almost every known location data monetization firm we are aware of.

One known instance of location tracking code removal (instead of addition) has occurred in Perfect365. After BuzzFeed News requested comment from Apple regarding presence of Teemo in Perfect365 when the GuardianApp team shared early location tracker research (https://www.buzzfeednews.com/article/nicolenguyen/how-apps-take-your-data-and-sell-it-without-you-even), Perfect365 was briefly removed from the App Store on April 26 and then became available again on April 30 with all Teemo code removed.

15. Photobucket (com.photobucket.iphone)

Photobucket is a photo storage app for iOS. This app contains location tracking code from Cuebiq. The location tracking code is present as of the latest app version (3.4, released November 29, 2017).

The justification pop up presented to users when requesting access to Location Services while the app is open contains the following text: “Photobucket may use your location when the app is in use.” and then uses the text “Location data may be used for providing you more relevant ads.” for access when the app is not open.

16. QuakeFeed Earthquake Alerts (com.artisanglobal.quakefeed)

QuakeFeed Earthquake Alerts is a weather app for iOS ranked #61 in the Top Free Weather apps in the App Store, with over 15,000 user ratings. This app contains location tracking code from Fysical and RevealMobile. The location tracking code is present as of the latest app version (4.1.5, released August 8, 2018).

The justification pop up presented to users when requesting access to Location Services while the app is open contains the following text: “QuakeFeed uses location to send you nearby earthquake alerts, to display earthquake information relevant to your location, and to serve ads in the free version.” and then uses the text “QuakeFeed uses location to send you nearby earthquake alerts, to display earthquake information relevant to your location, and to serve ads in the free version. To get nearby alerts for your device’s current location, select the ‘Allow’ option.” for access when the app is not open.

17. Roadtrippers (com.roadtrippers.roadtrippersinc)

UPDATE (21 June 2019): After receiving a request from Roadtrippers' General Manager on 20 June 2019 to conduct a fresh analysis of their app, we have now verified that Roadtrippers no longer utilizes the referenced location monitoring code, and furthermore claims to now have an internal policy stating that they "do not ever sell user data to anyone" (This commitment is not yet present in their Privacy Policy as it first must be cleared by their Legal team, according to Roadtrippers' General Manager). Upon an additional retrospective review of our internal research, we have been able to addtionally confirm that Roadtrippers' no longer contained the referenced location tracking code within any app version released in 2019.

Roadtrippers is a navigation app for iOS with over 14,000 user ratings. This app previously contained location tracking code from AreaMetrics. The location tracking code was present in August 2018 (4.5.7). This location tracking code may have been present in other versions of Roadtrippers which we have not yet analyzed.

The justification pop up presented to users when requesting access to Location Services, for app version 4.5.7, while the app is open contains the following text: “Roadtrippers uses your location to discover places near you.” and then uses the text “Roadtrippers uses your location for full on-trip support and place discovery.” for access when the app is not open.

18. ScoutLook Hunting (com.scoutlookweather.slHuntIphoneFree)

ScoutLook Hunting is a weather app for iOS ranked #58 in the Top Free Weather apps in the App Store, with over 7,000 user ratings. This app contains location tracking code from Fysical. The location tracking code is present as of the latest app version (2.14.17, released September 2, 2018).

The justification pop up presented to users when requesting access to Location Services uses the following text: “We use your location to show you local weather and track using ScoutTreX”

19. SnipSnap Coupon App (com.snipsnap.snipsnapapp)

SnipSnap Coupon App is a coupon app for iOS. This app contains location tracking code from Wireless Registry. The location tracking code is present as of the latest app version (3.9.14, released June 19, 2018).

The justification pop up presented to users when requesting access to Location Services uses the following text: “SnipSnap uses location to send you coupon reminders when you arrive at a store and to help you discover great offers nearby.”

20. Tapatalk (com.quoord.Tapatalk)

Tapatalk is an app for iOS used as a mobile interface for many popular message boards such as AnandTech Forums, HowardForums.com, IGN Boards, iMore, MacRumors, and others. This app contains location tracking code from AreaMetrics and SafeGraph. The location tracking code is present as of the latest app version (7.2.8, released June 14, 2018).

This app previously contained location tracking by Cuebiq in version 7.1.6 (released February 13, 2018) although the code appears to have been removed in subsequent versions.

The justification pop up presented to users when requesting access to Location Services uses the following text: “Tapatalk uses your location to recommend relevant sites, content and more. See our privacy policy.”

21. The Coupons App (thecouponsapp.coupon)

The Coupons App is a coupon app for iOS. This app contains location tracking code from Cuebiq and Sense 360, and. The location tracking code is present as of the latest app version (3.8.8, released August 9, 2018).

This app previously contained location tracking by Teemo in version 3.8.2 (released April 5, 2018) although the code appears to have been removed in subsequent versions. The code may have been removed as of app version 3.8.3 (released May 9, 2018) for reasons The Coupons App developers did not agree with, as evidenced by ostensibly sarcastic App Store “Changes” content for this revision:

“Poorer local content results. No crash reporting, Apple policy prefers your experience in this app to potentially be full of bugs without indication to the developers anything is wrong. No driving notifications of nearby coupons! Faster brick-mortar store closures. Better support for monopolistic Prime online shopping business model driving offline store closures. New for 2018: Less offline/online store variety anonymously & intelligently surfaced based upon your shopping preferences/location, more manual searching for boring & stale stores!”

The justification pop up presented to users when requesting access to Location Services uses the following text: “Location information is collected and may be used and shared for advertising, analytics and research purposes. To opt out, simply change the settings on your device. For more information please check our Privacy Policy”

22. Tunity (com.austtv.Tunity)

Tunity is an iOS app which allows users to listen to audio of a TV channel through their device headset, for use in public locations such as an airport. This app contains location tracking code from Sense 360. The location tracking code is present as of the latest app version (1.11.7, released September 4, 2018).

This app previously contained location tracking by Cuebiq, although it does not appear to be present in the latest version.

The justification pop up presented to users when requesting access to Location Services uses the following text: “We need your location to better detect the channel you want to hear, estimate delay and help sync the audio to the video. For more information, please visit our FAQ!”

23. Weather Live - Local Forecast (com.apalonapps.wlf)

Weather Live by Apalon Apps is a weather app for iOS ranked #6 in the Top Free Weather apps in the App Store, with over 100,000 user ratings.. This app previously contained location tracking code from Factual and Teemo. The location tracking code was present in April 2018 (5.9). This location tracking code may have been present in other versions Weather Live which we have not yet analyzed.

The justification pop up presented to users when requesting access to Location Services, for app version 5.9, while the app is open contains the following text: “Removes the need to type in your location manually to get local weather.” and then uses the text “Useful when traveling: no need to specify each location.” for access when the app is not open.

24. YouMail: Voicemail Upgrade (RH8QQ5UXC8.youmail.)

YouMail is an enhanced voicemail and robocall blocking app for iOS, with over 12,000 user ratings, which appears to claim to have a large user base (“YouMail has answered over 6 billion calls from half the phones in America!”). This app contains location tracking code from Cuebiq and Sense 360. The location tracking code is present as of the latest app version (4.6.1, released July 22, 2018).

The justification pop up presented to users when requesting access to Location Services uses the following text: “We use location to show where you were when you missed each call.”

Location Data Monetization Firms

Connections to and code from the following location data monetization firms have been found in iOS apps in the App Store.

In this context, the GuardianApp team defines a location data monetization firm as an entity who collects precise location data from users of an app and profits from this data.

AreaMetrics (areametrics.com)

AreaMetrics claims to collect information from millions of Daily Active Users, specifically stating the data is “sourced through our SDKs” which are “active in North American and Europe” (https://areametrics.com/solutions/data-partners/#amdata-location).

Known hostnames associated with AreaMetrics location data collection include the following:

• api.areametrics.com

Cuebiq (cuebiq.com)

According to an Oracle document: “Cuebiq persistently collects mobile users’ verified data sets directly from partner apps via SDK, by analyzing a combination of GPS, Wi-Fi, and beacon signals” (http://www.oracle.com/us/solutions/cloud/data-directory-2810741.pdf).

Further, Cuebiq directly states that they collect “location patterns of 61 million monthly active U.S. smartphone users” using “over 180 mobile apps” (https://www.cuebiq.com/press/retail-insights-cuebiq-gasbuddy/).

Known hostnames associated with Cuebiq location data collection include the following:

• in.cuebiq.com

Factual (factual.com)

Factual implies that data is collected from “270+ Million Monthly Active Devices” and touts billions of “Observations” daily, using apps in categories “such as gaming, weather, utility, social, messaging, dating, music and video streaming, photography and more” (https://www.factual.com/products/observation-graph/).

Known hostnames associated with Factual location data collection include the following:

• et.intake.factual.com

Known hostnames associated with general Factual network activity include the following:

• api.factual.com

Fysical (fysical.com)

Fysical describes themselves as a “human movement SDK that is installed across thousands of mobile applications” allowing them to provide “highest accuracy ground-truth location data” to their customs, also touting “15 billion location data points ingested” daily.

Known hostnames associated with Fysical location data collection include the following:

• api.beaconsinspace.com

Huq (huq.io)

Huq describes themselves to app developers as the “world’s largest consumer research panel, powered by thousands of apps and 10x millions of users around the globe” and are framed as an ad-free solution to monetization (https://huq.io/publishers/). According to their earnings calculator, developers are paid $0.75 per 100 “Monthly Active Users” who they collect location data from.

Known hostnames associated with Huq location data collection include the following:

• api.huq.io

InMarket (inmarket.com)

InMarket data sourcing is described as “SDK derived” accurate data using “Beacon, WIFI and GPS data points” (https://inmarket.com). Location data is used to by retailers for “re-targeting” allowing them to show ads to a user for retail locations they previously frequented but which they no longer visit (http://go.inmarket.com/lapsedshopper).

Known hostnames associated with InMarket location data collection include the following:

• m2m-api.inmarket.com

Mobiquity Networks (mobiquitynetworks.com)

Mobiquity Networks claims to source data from:
"65 million monthly unique devices” allegedly for the purposes of helping companies determine the success of a TV/Radio/Digital advertising campaign, and/or gaining “detailed insights” on user habits (http://mobiquitynetworks.com/passage-platform/).

They further claim to not “collect any personally identifiable information” while defining “PII” as “email or phone numbers” ( http://www.mobiquitynetworks.com/app-publishers/), but according to network traffic observation, Mobiquity Networks code packaged in iOS apps may collect the following data:

• Advertising ID (IDFA)
• Cellular MCC/MNC
• Latitude and Longitude
• Wi-Fi Network Name (SSID)
• Wi-Fi Network MAC Address (BSSID), when available (Only iOS 10 and below)

As such data points might only be attributable to a specific household or workplace rather than a specific person, this claim is likely to be technically valid.

Known hostnames associated with Mobiquity Networks location data collection include the following:

• mobileapi.mobiquitynetworks.com

RevealMobile (revealmobile.com)

RevealMobile states their SDK “runs in hundreds native iOS and Android applications across the nation’s top publishers” and that they “process billions of events.”

In August 2017, RevealMobile was also found to be packaged in the AccuWeather app for a brief period of time and was criticized by users for collecting Wi-Fi SSID and BSSID from user’s even if Location Services access was denied (More:https://www.zdnet.com/article/accuweather-caught-sending-geo-location-data-even-when-denied-access/).

Known hostnames associated with RevealMobile location data collection include the following:

• sdk.revealmobile.com

SafeGraph (safegraph.com)

SafeGraph describes themselves as “the ground truth dataset for human movement across the globe” (https://www.safegraph.com/location-data) in which “high-res” GPS data is collected “in background from large population" (https://www.safegraph.com/truth). 

Known hostnames associated with SafeGraph location data collection include the following:

• api.safegraph.com

Sense 360 (sense360.com)

Sense 360 states their “sensor-technology is on nearly one hundred apps and millions of mobile devices in the US” generating “more n a terabyte of sensor data” daily (https://sense360.com/methodology/).

Known hostnames associated with Sense 360 location data collection include the following:

• incoming-data-sense360.s3.amazonaws.com (obfuscated/encrypted)
• ios-quinoa-personal-identify-prod.sense360eng.com
• ios-quinoa-events-prod.sense360eng.com
• ios-quinoa-high-frequency-events-prod.sense360eng.com

Teemo (teemo.co)

Teemo’s public website appears to be light on specific information, but according to a March 2017 sales e-mail obtained by BuzzFeed News, app developers are paid $4 for every 1,000 “Monthly Active Users” the app developer collects location data from (https://www.buzzfeednews.com/article/nicolenguyen/how-apps-take-your-data-and-sell-it-without-you-even).

Known hostnames associated with Teemo location data collection include the following:

• v1.blueberry.cloud.databerries.com

Wireless Registry (wirelessregistry.com)

Wireless Registry’s public website appears to be light on specific information, however, they are included on this page due to granular collections of GPS, Wi-Fi, as well as Bluetooth Low Energy device data (Name, UUID, and RSSI).

Known hostnames associated with Wireless Registry location data collection include the following:

• pie.wirelessregistry.com

Data Sourcing and Validation

• Collection – Random sampling was conducted using the Top Free app rankings for each App Store category, in which all bundled code was scanned to determine network activity, APIs accessed, and other useful information such as app metadata.
• Analysis – Presence of potential location tracking code was determined by an automated decompilation process of all collected executable code in each app, specifically seeking apps containing common code which access CoreLocation APIs and send data to third-party servers.
• Validation – All apps listed under Examples of Affected Applications were downloaded from the App Store and then executed on a live iPhone while the network traffic was observed using an intercepting proxy tool, allowing the GuardianApp team to verify the precise data flowing to servers run by data monetization firms. This additionally allowed detection of tracking code presence in some apps with which direct static code analysis was difficult.

Data Validation Caveat

Apps validated using network traffic analysis have had at least one version confirmed to send location data to third-party external servers. However, due to the frequency of app updates and the limited capital/resources available to the GuardianApp team, sustained validation of already validated apps has been conducted using static code analysis of updates in order to confirm the continued presence of code associated with the cited tracker. Any user who would like to explicitly validate the presence of a location data tracker in any app on their device is encouraged to do so using an intercepting proxy tool such as Bettercap and/or Burp Suite.

RevealMobile in Local News Apps

The following apps for iOS contain code referencing “ sdk.revealmobile.com" and appears to partially corroborate information on RevealMobile’s public website.

Sinclair Broadcast Group, Inc	com.allbritton.wjla.wjlawx	3.13.0
Sinclair Broadcast Group, Inc	com.tvalabama.-340-Weather	4.2.600
Sinclair Broadcast Group, Inc	com.tvalabama.-340-Weather	4.5.1800
Sinclair Broadcast Group, Inc	com.katu.wx	3.13.1
Sinclair Broadcast Group, Inc	com.weyi.WEYI-WX	4.4.600
Sinclair Broadcast Group, Inc	com.kgan.CBS2-WX	4.4.600
Sinclair Broadcast Group, Inc	com.wpde.WPDE-WX	4.4.600
Sinclair Broadcast Group, Inc	com.kfdm.KFDM-WX	4.4.600
Sinclair Broadcast Group, Inc	com.kmph.KMPH-WX	4.4.600
Sinclair Broadcast Group, Inc	com.kmeg.Siouxland-Weather	4.4.600
Sinclair Broadcast Group, Inc	com.wwmt.WWMT-WX	4.4.600
Sinclair Broadcast Group, Inc	com.wrgb.WRGB-WX	4.4.600
Sinclair Broadcast Group, Inc	com.wztv.WZTV-WX	4.4.603
Sinclair Broadcast Group, Inc	com.wbff.WBFF-WX	4.4.702
Sinclair Broadcast Group, Inc	com.wpmi.WPMI-WX	4.4.702
Sinclair Broadcast Group, Inc	com.wkrc.WKRC-WX	4.4.702
Sinclair Broadcast Group, Inc	com.kfox.KFOX-WX	4.4.703
Sinclair Broadcast Group, Inc	com.kutv.KUTV-WX	4.4.703
Sinclair Broadcast Group, Inc	com.wnwo.WNWO-WX	4.4.703
Sinclair Broadcast Group, Inc	com.wisc.WICS-WX	4.4.1302
Sinclair Broadcast Group, Inc	com.komo.KOMO-WX	4.4.1302
Sinclair Broadcast Group, Inc	com.kabb.KABB-WX	4.5.1800
LIN Television Corporation	com.kxan.KXAN-Weather	4.2.601
LIN Television Corporation	com.keloland.stormtrack	4.2.700
LIN Television Corporation	com.wivb.4-Warn-Weather	4.4.600
LIN Television Corporation	com.youngmedia.wkrn	4.4.600
LIN Television Corporation	com.mediageneral.wsiwbtw2	4.4.600
LIN Television Corporation	com.wane.WANE-WX	4.4.600
LIN Television Corporation	com.koin.PDX-Weather	4.4.600
LIN Television Corporation	com.young.watewx	4.4.600
LIN Television Corporation	com.youngmedia.klfy	4.4.600
LIN Television Corporation	com.youngmedia.kron	4.4.600
LIN Television Corporation	com.WRBL.wsi	4.4.600
LIN Television Corporation	com.youngmedia.wlns	4.4.600
LIN Television Corporation	com.wavy.WAVY-Weather	4.4.600
LIN Television Corporation	com.mediageneral.wsiwjtv	4.4.600
LIN Television Corporation	com.WKRG.wsi	4.4.600
LIN Television Corporation	com.wpri.WPRI-Weather	4.4.600
LIN Television Corporation	com.wtnh.WXedge	4.4.600
LIN Television Corporation	com.mediageneral.wsiwfla1	4.4.600
LIN Television Corporation	com.wiat.WIAT-42-Weather	4.4.1000
Tribune Broadcasting Company	com.wgn.WGN-Weather	4.2.902
Tribune Broadcasting Company	com.wdtinc.WDAFWX	4.2.902
Tribune Broadcasting Company	com.ktla.KTLA-Weather	4.4.603
Tribune Broadcasting Company	com.wdtinc.WNEPWeather	4.4.603
Tribune Broadcasting Company	com.wdtinc.Max5iWX	4.4.603
Tribune Broadcasting Company	com.wdtinc.WREGXW	4.4.603
Tribune Broadcasting Company	com.wdtinc.FOX2Weather	4.4.603
Tribune Broadcasting Company	com.wdtinc.MKEWeather	4.4.603
Tribune Broadcasting Company	com.wdtinc.FOX8Weather	4.4.703
Gray Television Group, Inc.	com.kvly.VNL-Weather	4.2.601
Gray Television Group, Inc.	com.wsi.WSIWeatherWYMT-Radar	4.4.603
Gray Television Group, Inc.	com.kota.KOTA-Weather	4.4.603
Gray Television Group, Inc.	com.wsi.WSIWeatherKEVN-Mobile	4.4.603
Gray Television Group, Inc.	com.knoe.KNOE-8-WX	4.4.603
Gray Television Group, Inc.	com.kmot.KMOT-Weather	4.4.801
Gray Television Group, Inc.	com.KQCD.KQCD-WX	4.4.801
Gray Television Group, Inc.	com.gray.QCWeather	4.4.1003
Raycom Media Inc	com.raycommedia.wlbt.wsi	4.2.600
Raycom Media Inc	com.raycommedia.wbrc.wsi	4.2.600
Raycom Media Inc	com.raycommedia.wtoc.wsi	4.2.600
Raycom Media Inc	com.raycommedia.wwbt.wsi	4.2.1203
Raycom Media Inc	com.raycommedia.kcbd.wsi	4.4.1100
Raycom Media Inc	com.raycommedia.walb.wsi	4.4.1100
Raycom Media Inc	com.raycommedia.wdam.wsi	4.4.1100
Raycom Media Inc	com.raycommedia.wect.wsi	4.4.1101
Raycom Media Inc	com.raycommedia.kait.wsi	4.5.900
Tegna Inc.	com.wsi.WSIWeatherWFMY-Radar	4.2.900
Tegna Inc.	com.wkyc.WKYC-Radar	4.4.500
Tegna Inc.	com.wsi.WSIWeatherNews-19-WX	4.4.500
Tegna Inc.	com.wsi.WSIWeatherWUSA-Radar	4.4.500
Tegna Inc.	com.wsi.WSIWeather-NEWS-WX	4.4.500
Tegna Inc.	com.wsi.WSIWeatherWBIR10-WX	4.4.800
Capitol Broadcasting Company	com.cbcnm.iapp.now.wralwx	4.5.6
Capitol Broadcasting Company	com.stinkbot.iphone.newsoverwireless.wral	5.4.1
Capitol Broadcasting Company	com.stinkbot.iphone.newsoverwireless.wral	5.4.11
Capitol Broadcasting Company	com.cbcnewmedia.oaa	5.4.1
Capitol Broadcasting Company	com.cbcnewmedia.oaa	5.4.12
Capitol Broadcasting Company	com.cbcnmg.iapp.now.wcmc	5.4.1
Capitol Broadcasting Company	com.cbcnmg.iapp.now.wcmc	5.4.12
WJLA TV	com.cbcnmg.iapp.now.katvwx	4.2.600
WJLA TV	com.cbcnmg.iapp.now.katvwx	4.4.600
WJLA TV	com.cbcnm.iapp.now.wsetwx	4.4.702
Charter Communications	com.baron.baynews9.wx	3.13.2
Charter Communications	com.baron.centralfloridanews.wx	3.13.2
Graham Media Group, Inc	com.pnsdigital.weather.wjxt	2.3
Graham Media Group, Inc	com.pnsdigital.weather.kprc	2.3.2
Local TV LLC	com.localtvllc.4warnme	4.2.1000
Local TV LLC	com.localtvllc.livealert19	4.4.603
Fox Television Stations, Inc.	com.wnyw.Fox5NY-Weather	4.4.602
Fox Television Stations, Inc.	com.wjzy.FOX-46-Weather	4.4.602
Fox Television Stations, Inc.	com.wtxf.FOX-29-WEATHER	4.4.1306
Fox/UTV Holdings, Inc on behalf of its television station KMSP	com.myfox9.weatherapp	4.2.603
Fox/UTV Holdings, Inc on behalf of its television station KMSP	com.myfox9.weatherapp	4.4.1200
KRIV FOX 26	com.kirv.MyWeather	4.2.701
KRIV FOX 26	com.kirv.MyWeather	4.4.1305
KAKEland Media	com.kake.KAKE-Weather	4.2.1100
NW Communications of Texas, Inc.	com.KDFW.FOX4-Weather	4.2.603
KWCH 12	com.kwch.KWCH-Storm-Team-12	4.2.1100
KY3 INC.	com.kytv.KYTV-KY3-Weather	4.2.901