An examination of the opaque data collection practices in mobile games, which have largely escaped the level of scrutiny applied to social media companies
Seemingly simple mobile games made us all way too comfortable with giving away our personal information. — Angry Birds is so 2009, you might say.
Context & Ripple Effects
The Vox examination lands in a decade-long paper trail. As far back as a 2015 survey of popular apps, email and location were flowing to Apple, Google, and other third parties, and Engadget's 2018 look at data requests showed how opaque even the companies' own interpretations of that data were. What changed is that the evidence moved from surveys to named pipelines: apps sending heart rates and pregnancy intent to Facebook via its analytics SDK, then [[a:979751|Pixalate's finding that most of the 1,000 most popular children's apps feed location data to the ad industry]].
Mobile games are the least-examined corner of that pipeline. Angry Birds is the emblem — a game whose casual, toy-like surface made permission prompts feel harmless — and the Gravy breach later showed Candy Crush and thousands of apps feeding location brokers, often without developers' knowledge. The scrutiny social platforms faced simply never arrived for the game layer.
First-order effects
- Casual-game players — including children, per the Pixalate data — are the directly exposed group, since the games they grant location and identity permissions to are wired into ad-industry data flows.
- Game publishers like Rovio (Angry Birds) and King (Candy Crush) now face the kind of data-practice questions that social media companies absorbed years earlier, with their SDK and broker relationships on the record.
Second-order effects
- Ad SDK vendors and location brokers such as Gravy become the pressure point: their distribution through games is the mechanism, so platform holders Apple and Google face calls to govern SDK behavior at the store level rather than leave it to app privacy labels.
- Game studios that monetize through ad networks may need to choose between SDK-driven revenue and demonstrable data hygiene, reshaping which analytics and ad partners mid-size studios can afford to integrate.
Third-order effects
- If the pattern holds, privacy regulation and platform policy extend from social media platforms down to the SDK and data-broker layer — the infrastructure beneath apps, not just the apps themselves — with children's apps as the likeliest regulatory wedge.
- The Gravy breach suggests the structural risk sits with intermediaries players never see: a single broker hack exposes thousands of apps at once, pushing the industry toward SDK audits and broker liability as standard practice.
The trend: Privacy scrutiny is migrating down the stack — from social media platforms to the ad SDKs and location brokers embedded in everyday apps, with mobile games as the least-policed entry point.