Despite privacy outrage, AccuWeather still shares precise location data with ad firms

AccuWeather is still sending precise geolocation data to a third-party advertiser, ZDNet can confirm, despite updating its app earlier this week to remove a feature that collected user's location data without their permission.

In case you missed it, AccuWeather was until this week sending the near-precise location of its iPhone app users to Reveal Mobile, a data monetization firm -- even when location sharing was switched off. Security researcher Will Strafach, who first reported the issue, also accused the company of sharing a user's precise GPS coordinates under the guise of providing local weather alerts.

The news sparked outrage and anger. AccuWeather responded with a forced apology, which one leading Apple critic John Gruber called a "bulls**t response."

However, tests conducted by Strafach show that the updated app, released Thursday, still shares precise geolocation data with a data monetization and advertising firm.

ZDNet independently verified the findings. We found that AccuWeather was still, with location sharing enabled, sending precise GPS coordinates and altitude albeit to a different advertiser, without the user's explicit consent.

That data can be used to pinpoint down to a few meters a person's location -- even which floor of a building they are on.

The data is sent to a server run by Nexage, now owned by Oath, which uses the data as part of its AdMax platform for increasing mobile advertising revenue. According to one of its pages, Nexage will use the location data "to ensure users receive the best quality ads and that publishers get the highest possible eCPM," referring to the cost-per-mile metric for advertisers.

But at no point does AccuWeather's updated app explicitly state that the location data will be used for advertising, a key criticism first noted by Strafach in his original disclosure.

Gruber said in his blog post that users who permit their location to be shared are doing so under "the guise of showing you local weather wherever you are."

Strafach commented Friday that many of those who did not want their location data used for purposes besides local alerts are "still angry," and noted that these concerns have gone "totally unacknowledged by AccuWeather."

A rival weather app, Dark Sky, said in a blog post Wednesday that the monetization of customer's location data is "a much larger -- and more widespread -- phenomenon."

Dark Sky, which says it doesn't and "never will" share its customers location data with third party advertisers or data monetization firms, posted several screenshots of emails they have received soliciting business to monetize their customers' locations.

Adam Grossman, co-creator of Dark Sky, said in the blog post: "These companies all claim that the location data they collect is "anonymous", and that it can't be used to identify or track individual people -- this is false," he said.

"In fact, it's trivially easy for one of these data monetization firms to put real names to the latitude/longitude pairs they receive," Grossman added.

A spokesperson for Oath said in a statement: "AccuWeather sends us geo-location data through our SDK only when location sharing is enabled by the consumer. We use this data to enable our buyers on our ad exchange to effectively value the impression. Location is commonly used by buyers in order to serve more relevant content and advertising to enhance the overall consumer experience. We're committed to fostering an accountable ecosystem and complying with all applicable privacy laws and regulations."

A spokesperson for AccuWeather did not respond to a request for comment.