I analyzed 9,211 weather API requests from 42 Samsung devices over five days and found that the pre-installed Samsung Weather app generates a persistent, unique device fingerprint from saved locations - one that survives IP changes, VPN usage, and network roaming.

How it works

The Samsung Weather app polls api.weather.com on a recurring schedule for each saved location. Every request includes a placeid parameter - a 64-character hex string (consistent with SHA-256) that maps to a specific location. The combination of a user's placeid values creates a fingerprint that is effectively unique per device.

Key results

143 distinct placeid values observed across 42 devices

96.4% fingerprint uniqueness: 27 of 28 distinct fingerprints were unique to a single user. The only collision was two users tracking a single identical location.

Every user with 2+ saved locations had a globally unique fingerprint

Persistence: fingerprints survived across 8+ distinct IP addresses per user, including residential, university, and mobile carrier networks

Hardcoded API keys: the app authenticates with static keys baked into the APK - not bound to any device or session. Anyone can query the API and resolve any placeid to a physical location (city, coordinates, country) using these keys

Redundant coordinate transmission: many requests send raw GPS coordinates alongside the placeid that already encodes the same location, providing the API provider with real-time geolocation data beyond what's needed for forecasts

Who sees this data

Requests use HTTPS, so passive observers can't read placeid values. But The Weather Company (IBM) receives every request server-side, where the placeid array functions as a natural join key across a user's entire request history.

Not the first time

This is far from the first time weather apps have faced scrutiny over location data practices:

2019: LA City Attorney sued IBM/The Weather Company, alleging the Weather Channel app secretly collected continuous geolocation data and sold it to third parties for targeted advertising and hedge fund analysis. Settled August 2020.

2020-2023: Class action alleged TWC tracked users' locations "minute by minute" and sold the data. Settled April 2023.

2024: New VPPA lawsuit alleges weather.com shared PII (names, emails, precise location, video viewing data) with ad partners mParticle and AppNexus/Xandr without consent. $2,500 statutory damages per violation.

2017: Security researcher Will Strafach found AccuWeather transmitted GPS coordinates and Wi-Fi BSSID data to analytics firm Reveal Mobile even when users denied location permission.

A 2018 NYT investigation found WeatherBug shared location data with 40+ companies. A broader analysis of 20 popular weather apps found 85% gathered data for advertising and 70% harvested location data for ad targeting.

The placeid mechanism is a distinct vector: even if a user denies location permissions or uses a VPN, the saved location hashes in routine weather API calls function as a stable device fingerprint that existing consent mechanisms don't address.

Scale

Samsung ships 50-60 million phones per year in the US alone. The weather app is pre-installed and active by default. Our most active user generated 2,000+ requests over five days without any manual interaction.