U.S. government contractor tracked hundreds of millions of users using SDK