As a followup to my previous post, I both emailed CVS and tweeted at them to give them an opportunity to comment on their app’s location-sharing practices:
I noticed that your mobile app appears to be sharing my location data with around 40 different third parties. Can you please explain this? Is this a bug?
They responded 5 hours later, claiming that they do not
share location data with any third parties:
…we do not share your location or information with any third parties. You may however, if you are not using our app turn off the locations [sic].
This is empirically false. (They also claim that I can turn off location-sharing, but only if I’m not using their app. I can only assume that’s a typo, rather than a statement that their app users cannot opt out of location-sharing.)