Ad SDKs Leak Location, New Jersey Bans Surveillance Pricing (08/04/2026)

The EFF report is the one to sit with today, because it describes a leak with no villain in the room: a developer drops in an advertising kit to make rent, and the kit ships location data out the back without anyone deciding to do that. New Jersey went the other direction and made it illegal to price your groceries off what a company knows about you. New York finished the rules for what a teenager’s feed is allowed to do.

Top 4 Critical Privacy Alerts

1. The Ad Kit Was Sending Location Before Anyone Decided To

EFF researchers examined software development kits that advertising companies hand to app developers, and found several automatically feeding users’ location data back to the ad company. The developer integrating the kit is often not the one choosing that, and in some cases has no clear way to see it happening. EFF published a companion piece aimed directly at developers, telling them to check what their ad libraries do before shipping. EFF

Operator Note: Your organization almost certainly has an app, or pays someone who does. The person who chose the monetization kit was solving a revenue problem, not a privacy one, and nobody in your compliance chain was in that conversation. That gap between who decides and who is accountable is where this class of exposure lives.

2. New Jersey Makes It Illegal to Price Groceries Off Your Data

Governor Mikie Sherrill signed A4085, the Fair Price Protection Act, on July 23, prohibiting companies from charging consumers different prices for groceries based on their personal data. Inside Privacy

Operator Note: Surveillance pricing has been legal and quiet for years, and the first states to name it are drawing the line at food. Expect the category to widen. If your pricing engine takes any personal attribute as an input, you now have a jurisdiction question rather than a product question.

3. New York Finalizes the SAFE for Kids Rules

The New York Office of the Attorney General released final rules on July 28 implementing the Stop Addictive Feeds Exploitation for Kids Act, which takes effect January 25, 2027. The law restricts algorithmic feeds and overnight notifications for minors without parental consent. Inside Privacy

4. Building a Browser Is Not a Federal Crime

A federal appeals court agreed with EFF that building a web browser does not violate the Computer Fraud and Abuse Act. The CFAA has been stretched for years to cover ordinary software behavior, and a court declining to extend it further is worth noting. EFF

Operator Note: This one protects your security team as much as any developer. Overbroad readings of the CFAA are what make researchers hesitate before reporting what they found in your product.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.