Huq location data transmitted by apps despite user opt outs
Google warned app developers that location data was being shared with the firm Huq despite user opt-outs. This highlighted failures in the implementation of privacy consents within third-party apps.
The apps in question were found to be transmitting location data to Huq even when users had explicitly opted out of this feature.
Key facts
- What
- Google warned app developers that location data was being shared with the firm Huq despite user opt-outs.
- Incident date
- Dec 13, 2021
- Who
- Huq
- Failure mode
- Data Leakage
- AI surface
- Voice Agent
- Severity
- Medium
What happened
Google warned Android app developers that they were transmitting location data to the British firm Huq without proper user consent. Investigations found that data was being shared even when users had explicitly opted out of the feature. This incident raised concerns about the privacy of location datasets used for automated profiling and insights.
What broke inside the model
- 01 · TriggerA request triggers retrieval or context loading.
- 02 · Model stepThe context pulls in another user's content.
- 03 · Control gapNo boundary enforces isolation at the moment of output.
- 04 · FailurePrivate data crosses into the response.
- 05 · ConsequenceOne user sees another's data, and disclosure follows.
One user's content crosses the retrieval boundary into another's response.
The system failed because Huq delegated the implementation of consent mechanisms to individual app developers. This resulted in a failure where the code continued to transmit GPS data to Huq even after users had explicitly opted out of the feature.
What it cost
Sources
- PressGoogle Warns Android App Developers Over Data Sharingsilicon.co.uk
- PressGoogle issues warning to location-sharing appsbbc.com
Cite this entry
https://failureindex.ai/failures/huq-location-transmitted-apps-despite-optAI Failure Index. "Huq location data transmitted by apps despite user opt outs" (FI-0448). Realm Labs. https://failureindex.ai/failures/huq-location-transmitted-apps-despite-opt (indexed Jun 10, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0448. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
Realm can detect when a response is about to emit data that falls outside the bounds of the current user and context, and block or redact it inline, at the moment of generation rather than after the data has left.