In November of last year, a VICE report discovered that two major data brokers, Babel Street and X-Mode, were selling location information of users of various apps to the U.S. military. Many of the apps were aimed at Muslims, as an app that showed the direction of Mecca for prayers, and had over 98 million downloads.

Now, researchers from the ExpressVPN Digital Security Lab e Defensive Lab Agency found almost 200 apps for Android containing X-Mode tracking code until last year. In December, Apple and Google ordered that their developers remove X-Mode from their products, or they would be banned from the app stores.

After the decision of the Apple and Google, most apps have stopped including the X-Mode tracking code. But, as the TechCrunch discovered, at least one application continued to share data with X-Mode, the New York Subway. According to their investigation, the New York City subway system's maps and directions app was still available on Google Play this week. New York Subway had 250 downloads.

An initial pop-up for the app asked users to allow data sharing with X-Mode for market research purposes, but said nothing about location data being sold to the U.S. military. After being contacted by TechCrunch, Google Play removed New York Subway from its store. The investigation also uncovered another discovery: Older versions of the apps Moco (a chat service) and Video MP3 Converter, which have over 115 million downloads between them, are still sharing user data with X-Mode.

Data brokers targeted by US government

American privacy activists accuse federal agencies such as the Department of Homeland Security of using data brokers to circumvent a 2018 Supreme Court decision. Under the ruling, law enforcement agencies are prohibited from obtaining location data from cellphone users without a warrant.

“Americans are tired of finding out that their location data is being sold by brokers to anyone with a credit card,” said Sen. Ron Wyden, who wants to pass a law which gives the FTC, the Federal Trade Commission, the power to regulate and fine data brokers. “Industry self-regulation is clearly not working. Congress needs to pass tougher legislation that gives consumers tools to prevent their data from being sold and holds companies that violate Americans’ privacy accountable.”

Image: Andrey_Popov (Shutterstock)