There are SDKs inside mobile apps collecting location and passing it to advertisers. The developer switched nothing on: it shipped that way. The Electronic Frontier Foundation mapped the problem and warned that plenty of people publishing apps have no idea the third-party code they embedded is doing this.
Here is the concrete shape of it. Someone drops in an analytics SDK to understand how people move through the app. By default it collects GPS coordinates even when the app has no need for location at all. Nobody opened the advanced settings, because the manual only says it gathers usage and performance data. The app starts sending precise location to ad servers, and the discovery arrives as a user complaint or a blocked store update.
The bill lands on the person who decided nothing: the developer pays to rip out the SDK, rework the app and manage the reputational mess. The SDK vendor walks away clean.
The practice left to anyone shipping an app is tedious and comes before the code: demand full documentation of what the component collects, and a written statement that the default gathers nothing beyond the essential. If the answer is vague, look elsewhere. Assuming a service keeps nothing is how this starts.
The point isn't to demonise SDKs. It's that an unsafe default pushes responsibility onto someone who doesn't know they carry it. You think you shipped a weather app. What you shipped is a location history business.
Reviewing every SDK that comes through the door is dull work. It is still cheaper than the lawsuit that follows.