Most users think granting location permission means showing a local forecast. In practice, a continuous stream of GPS coordinates is a map of someone's private life – and there's a multibillion-dollar industry built around buying it. Most users think granting location permission means showing a local forecast. In practice, a continuous stream of GPS coordinates is a map of someone's private life – and there's a multibillion-dollar industry built around buying it. Think about what happens the moment you grant location permission to a weather app. The app receives your GPS coordinates. Modern GPS is precise – often within a few meters, and on CarPlay or Android Auto, sub-meter. If the app logs that data over time, it doesn't just know where you checked the forecast. It knows where you sleep. Where you work. Where you spend Friday nights. Which doctor you visit. How you commute. Whether you came home last night. Most users assume their weather app uses location for exactly one thing: showing the local forecast. I build weather software for a living, and I can tell you that assumption is dangerously incomplete. A continuous stream of coordinates is not weather telemetry. It is a map of someone's private life. And for a $12 billion location data industry, that map is the product. $12 billion location data industry $12 billion location data industry Why weather apps are a special privacy case Users hesitate when a random utility app asks for location. They hesitate much less when a weather app asks. The request sounds inherently legitimate – weather is local, so of course the app needs to know where you are. That instinct makes the weather category one of the most efficient pipelines for collecting high-quality geolocation data at scale. It is not just GPS coordinates, either. Once an app combines location with time, frequency, repeated routines, and movement patterns, "anonymous" becomes a very weak word. Coordinates plus timestamps plus daily patterns equals identity – no name required. "The request sounds legitimate. That's exactly what makes weather apps one of the most efficient pipelines for high-quality location data in mobile." "The request sounds legitimate. That's exactly what makes weather apps one of the most efficient pipelines for high-quality location data in mobile." What the public record shows Over the past several years, weather apps have repeatedly appeared in lawsuits, FTC enforcement actions, and investigative reports. The documented patterns across the category include: Selling precise location data to hedge funds and financial firms to predict retail foot traffic and earnings – a use case users granting "forecast" permission almost certainly never anticipated.
Tracking users who explicitly denied location permission by using embedded SDKs that collect WiFi router identifiers to geolocate devices without GPS – a workaround that bypasses the user's stated choice entirely.
Embedding SDKs from insurance and data companies that collect GPS coordinates at high frequency – every few seconds – and route driving behavior data to insurers and brokers without disclosure to the user.
Sharing location data with dozens of downstream companies per app, including ad networks, data brokers, and behavioral analytics platforms, with no clear user-facing disclosure of who those recipients are.
Building a business model where the weather functionality is a wrapper around an advertising or data monetization product – the forecast is free because the location data is the revenue stream. Selling precise location data to hedge funds and financial firms to predict retail foot traffic and earnings – a use case users granting "forecast" permission almost certainly never anticipated. Tracking users who explicitly denied location permission by using embedded SDKs that collect WiFi router identifiers to geolocate devices without GPS – a workaround that bypasses the user's stated choice entirely. Embedding SDKs from insurance and data companies that collect GPS coordinates at high frequency – every few seconds – and route driving behavior data to insurers and brokers without disclosure to the user. Sharing location data with dozens of downstream companies per app, including ad networks, data brokers, and behavioral analytics platforms, with no clear user-facing disclosure of who those recipients are. Building a business model where the weather functionality is a wrapper around an advertising or data monetization product – the forecast is free because the location data is the revenue stream. The pattern is consistent across documented cases: a user grants location for a forecast, and the data ends up somewhere they never intended. Two enforcement actions worth knowing about These cases are not hypothetical. They are on the public record and show what downstream data flows can look like in practice. FTC v. Kochava – The FTC sued data broker Kochava for selling precise geolocation data that could trace people to reproductive health clinics, places of worship, domestic violence shelters, and addiction recovery facilities. The case settled in February 2026. Kochava is one of the SDKs embedded in mobile apps – including weather apps – to collect and monetize location data. FTC sued data broker Kochava FTC sued data broker Kochava settled in February 2026 settled in February 2026 Texas AG v. Allstate / Arity — The Texas Attorney General sued Allstate and its data subsidiary Arity for allegedly collecting, using, and selling location and driving behavior data tied to more than 45 million Americans – much of it collected through SDKs embedded in third-party apps without meaningful user disclosure. Texas Attorney General sued Allstate and its data subsidiary Arity Texas Attorney General sued Allstate and its data subsidiary Arity These are not isolated incidents. They reflect a structural feature of the mobile data economy: SDKs embedded in apps you use daily can route your location to buyers you have never heard of, for purposes you never agreed to. Where your data actually goes The path from weather app to data buyer is more direct than most people realize. You grant location permission. The app passes coordinates to an embedded third-party SDK. That SDK forwards the data to a broker. The broker packages it and sells it to insurance companies, hedge funds, law enforcement agencies, political campaigns, or other brokers who resell it further. The economics explain why this model persists: raw GPS data sells for roughly $0.50 per 1,000 users. Specialized behavioral datasets – driving patterns, visit frequency, home and work location inference – can reach $240,000 per year for institutional buyers. A popular free weather app with tens of millions of users is a significant data asset by any measure. Other documented buyers include firms that sell real-time location access to law enforcement – enabling tracking without a warrant – and data aggregators that have sold visit records for sensitive locations including reproductive health clinics. enabling tracking without a warrant enabling tracking without a warrant reproductive health clinics reproductive health clinics It's not just GPS Some weather apps request Motion permission claiming they "adjust the forecast to your activity." On iOS, that grants access to accelerometer data, step count, and activity classification. Documented cases show that even without explicit GPS permission, WiFi router scanning can geolocate users by matching router identifiers against known databases – a workaround that bypasses the permission dialog entirely. Barometer readings can reveal floor level. Device fingerprinting creates a persistent identifier without requiring an advertising ID. And in the car, CarPlay and Android Auto feed sub-meter GPS through whatever weather app happens to be running. What we do differently at Rain Viewer — and where we are not perfect I want to be specific, because vague privacy promises are part of the problem this article is about. What we do: We do not require user accounts. We do not know who is behind any given device. We delete location data from our database after 2 days and from logs after 14 days. We do not store or link IP addresses to geolocation or device-level behavior. Widgets and Apple Watch contain no ad-related code. For paid users: We do not activate the ad SDK code embedded in the app. No ad requests are made. No data flows to ad networks. For free users: We run Google AdMob. If a user has granted location permission, AdMob can use that location for ad targeting – Google's own documentation confirms this. We do not control what Google does with that data downstream. This is the trade-off of a free, ad-supported product, and I would rather state it plainly. Google's own documentation confirms this Google's own documentation confirms this The line we hold: We do not embed third-party location monetization SDKs. We receive offers to do this regularly – plug in an SDK, collect location in the background, earn revenue per thousand users. We decline every time. There is no secondary revenue stream built on where our users go. We also use Google Analytics and Meta analytics for product understanding. There is a meaningful difference between using analytics to understand how people interact with your product and designing a business model around monetizing where your users physically go. How to protect yourself Check the App Store or Google Play privacy labels before installing any weather app. Use approximate location instead of precise – most forecasts do not need meter-level accuracy. Do not grant motion, Bluetooth, or background location unless a feature clearly depends on it. If a free app shows no ads and has no obvious business model, the location data is likely the revenue. The standard developers should hold Audit every SDK in your app. Challenge every permission. Shorten retention windows. Remove anything you cannot explain clearly and defend publicly. When a third-party SDK offers revenue in exchange for location data, understand exactly what you are selling, to whom, and for what purposes – because your users almost certainly do not. The question should not be "Can we justify asking for precise location?" It should be "Can we avoid needing it?" The weather is local. Your private life is too. A forecast should not require turning either of them into someone else's dataset.

This story contains new, firsthand information uncovered by the writer.

This story contains AI-generated text. The author has used AI either for research, to generate outlines, or write the text itself. 

Allstate

Google

Your Weather App Knows Where You Sleep – Here's What It Does With That Data

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

From Consumer to Developer: How to Build Your Own Weather App

Why Being Likable At Work Matters

Windows Sticky Keys Exploit: The War Veteran That Never Dies

Is ‘bias for action’ making product managers lazier?

Zero People Charged With Online Pirating, Swedish Prosecutor's Office Reports

What No One Told Me About Being a Product Manager at an Early Stage Startup

From Consumer to Developer: How to Build Your Own Weather App

Why Being Likable At Work Matters

Windows Sticky Keys Exploit: The War Veteran That Never Dies

Is ‘bias for action’ making product managers lazier?

Zero People Charged With Online Pirating, Swedish Prosecutor's Office Reports

What No One Told Me About Being a Product Manager at an Early Stage Startup

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps