A recent data leak at Gravy Analytics provided the first clues, but now it's clear: more than 40,000 apps collect location data.