A popular flashlight Android app with an installed base of between 50 million and 100 million users has also been collecting personal data including location and device ID and sharing it with advertisers even for users who had opted out, the Federal Trade Commission found. GoldenShores Technologies, LLC, the developer behind the “Brightest Flashlight Free” app that currently enjoys a 4.8-star rating from over 1 million reviews, on Thursday settled a case with the FTC, Fast Company reports.

The FTC found that while the app’s privacy policy told users that personal data will be collected by the company, it did not say that data including location and device ID would also be shared with third-parties such as advertising networks. Furthermore, the app was found to collect and send data to advertisers immediately after installation, even before the user could either accept or refuse the End User License Agreement of the app.

“When consumers are given a real, informed choice, they can decide for themselves whether the benefit of a service is worth the information they must share to use it,” Jessica Rich, FTC’s Director of the Bureau of Consumer Protection said. “But this flashlight app left them in the dark about how their information was going to be used.”

According to the settlement, the developer will have to fully inform users when, how and why their location data is collected, and to obtain the their “affirmative express consent” when it comes to sharing that data. GoldenShores will also have to delete any personal information collected from consumers via the Brightest Flashlight app.