Android users have been "deceived" by a developer who covertly gathered personal data, the US Federal Trade Commission (FTC) said.
GoldenShores Technologies took ID and location data from the millions using its Brightest Flashlight app.
The developer shared the data with ad networks but did not tell users about this practice, an FTC statement said.
To settle the charges, GoldenShores has agreed to give users more control over what happens to their data.
Although the free app offered people an opt-out clause, the FTC said this was "meaningless" because data from all users of the Brightest Flashlight app was shared whether they agreed or not.