> The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing.

If this is the take away, then I need to think about how I have phrased things. The GPS co-ordinates are sent two separate companies:

1) The Bluetooth device developer (bm2.quicklynks.com)

2) AMap (dualstack-cgicol.amap.com)

Looking at the decomplication and HTTP REST messages, it is very clear the app developer is deliberately sending GPS to their servers. They send a JSON object with the battery voltages, bluetooth device address and lat/lng in the same request.

The cell data, wifi beacon data - this is exclusively collected by AMap services and is not apparent without investing significant time reverse engineering their SDK.