# "Free" apps: who actually pays, and with what > Most free apps are paid for by advertisers and data buyers. How your taps and location turn into revenue, who ends up holding them, and what that costs you. By Alexandr Bykov, OxiSoft. Published 9 November 2026. Canonical: https://oxisoft.io/blog/free-apps-who-actually-pays/ Building an app costs real money. Designers, developers, servers, store fees, support, updates for every new phone. When the price on the store says "Free", that money still comes from somewhere. Sometimes it comes from a small group of paying users who fund everyone else. Often it comes from advertisers and from companies that buy data. In that model, the person using the app is not the customer. The customer is whoever pays to reach that person, or to know things about them. This post walks through how that works in plain terms, and what it means for you as the person holding the phone. ## The ad slot is the small part Most people picture a free app as "app plus a banner". You see an ad, the developer earns a few cents, fair trade. The banner is the visible part. To show it, the app usually includes an advertising library (an SDK) written by someone else. That library runs inside the app with the same access the app has. It reads the device's advertising ID, which is a number that stays the same across every app on the phone, and it collects whatever else it was built to collect: device model, language, network, approximate or precise location, which screens you open and for how long. None of this needs your attention. You agreed to the app's permissions, and the library inside it rides along. ## What happens in the split second before an ad appears When an app has an ad slot to fill, it does not just pick an ad. In most cases it runs an auction, called real-time bidding. The app's ad library sends out a "bid request": a description of the slot and of you. Who you are (as an advertising ID), where you are, what you are doing, what kind of device you hold. Many companies receive that request and decide how much to bid. One of them wins and shows the ad. Here is the part that matters. Every company that received the request got the data, whether it won or not. Losing the auction does not delete what you saw. The Irish Council for Civil Liberties measured how often this happens. In 2022 its estimate was that a person in the US has their online activity and location broadcast this way 747 times a day on average, and a person in Europe 376 times a day. It also counted 4,698 companies allowed to receive this data about people in the US through one large ad exchange alone. That is a lot of places for your morning commute to end up. ## From ads to data brokers Advertising is only one buyer. The data that leaves your phone also feeds a quieter industry: data brokers, companies that collect, combine and resell information about people. They get it in two main ways: - **Their own library inside other apps.** The broker pays app developers to include its SDK, and the SDK sends location and device data back. For a small developer, that check can be the difference between a free app and no app. - **Listening to the auctions.** Anyone who receives bid requests can store them. Nothing in the auction itself stops a participant from keeping the data and selling it later. The US Federal Trade Commission has described exactly this setup. In 2024 it [banned one data broker from selling sensitive location data](https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data). According to the FTC, that company collected precise location from third-party apps that included its SDK, linked it to advertising IDs, and sold it to hundreds of clients. The data was not anonymized and could match a phone to the places it had been, including clinics and places of worship. A year later, in January 2025, a hack at another location data company exposed a sample of its records. Reporters found location data tied to thousands of well-known apps: games, dating apps, fitness trackers. Several of those app makers said they had never worked with that company at all. The data appears to have been picked up through the ad auctions, not through any deal with them. That last detail is the uncomfortable one. Once data leaves the phone through an ad system, even the people who built the app cannot tell you where it went. ## Why "anonymous" does not help much The usual answer is that the data is anonymous. No names, only an ID. An advertising ID is a stable number. Put a week of location points behind it and you know where the phone sleeps at night and where it sits during the working day. That is usually enough to name the person without ever seeing a name. We wrote more about this in [Metadata is data](/blog/metadata-is-data/): the pattern around the content often says more than the content. ## What it costs you You do not get a bill, which is why this model works so well. The costs show up in other places: - **Your location history exists somewhere you cannot see.** You cannot ask it to be deleted if you do not know who holds it. - **It can be used against you later.** Price changes, insurance decisions, people looking for you who should not find you. The data does not know who its next buyer is. - **Battery and data.** Ad libraries download, measure and report. Small numbers each time, many times a day. - **The app's priorities shift.** When revenue comes from attention, the app is tuned to keep you in it longer, not to get your task done faster. None of this means every free app is evil. Some are free because a company uses them to sell something else, some are hobby projects, some are funded by donations. The question is only who pays, and you can usually find out. ## How to tell who pays for an app A few checks that take a minute: - **Look for the payment.** If there is a paid version, a one-time unlock or a subscription, someone is paying the bills directly. If there is nothing to buy and no company behind it selling something else, ask how it survives. - **Read the store's data section.** Both stores now show what an app says it collects and shares. Location listed as "shared" or "used to track you" is the line to look for. - **Check whether the app needs an account.** An account is not bad in itself, but an app that only stores your own data on your own phone rarely needs one. - **Turn off the advertising ID.** Both Android and iOS let you delete it or block apps from reading it. This does not stop all tracking, but it removes the easiest way to link your activity across apps. This is the main reason we sell our apps for money instead of selling our users. [Habit Observer](/apps/habitobserver/), for example, is free to try and has one paid unlock, with no ads, no analytics library and no account. The price is on the store page. There is no second price somewhere else. When an app costs nothing, the bill still exists. It is only sent to someone you will never meet.