Privacy fears as researchers find THOUSANDS of popular Android apps are tracking users’ smartphone activity and sharing it with data brokers
- Some 17k Android apps are sharing users’ smartphone activity with advertisers
- Researchers found the apps are collecting a device’s advertising ID and its hardware ID, then sharing it with advertisers to serve them targeted ads
- Users can’t reset a hardware ID, which means advertisers can always track them
- It violates Google’s app policies and the firm has pledged to crack down on them
Popular Android apps are spying on your smartphone activity and sharing the data with advertisers.
Some 17,000 Android apps are believed to be skirting Google’s rules around what kinds of user activity can be tracked and shared with data brokers, according to new research from the International Computer Science Institute, which was first reported by CNET.
Among the apps identified by the International Computer Science Institute were popular news aggregator app Flipboard, the Audiobooks app from Audible, Angry Birds Classic, beauty filter app B612 and antivirus app Clean Master, among others.
Scroll down for video
Popular Android apps are spying on your smartphone activity. Some 17,000 apps are skirting Google’s rules around what kinds user activity can be tracked and shared with data brokers
HOW ARE THE APPS TRACKING YOUR ACTIVITY?
Researchers from the International Computer Science Institute found that 17,000 Android apps were collecting data from users and sharing it with data brokers.
What’s worse, users are unable to prevent advertisers from collecting this data.
The apps are collecting a user’s advertising ID and their hardware ID, which includes things like a MAC address, IMEI and Android ID.
Users can reset their advertising ID whenever they want by clearing their cookies.
However, they cannot reset their hardware ID.
If an app sends advertisers both an advertising ID and a hardware ID, no matter how many times a user resets their advertising ID, advertisers can still tell who they are.
Google has moved to crack down on apps that collect advertising and hardware IDs, but many are still doing it.
The findings are troubling to security experts as the apps are able to track users via ‘persistent identifiers,’ which device owners are incapable of turning off.
Many apps track users’ smartphone activity, including which apps they use and how often they open them, then share that data with advertisers so they can show users targeted advertisements.
They’re able to do this via a unique advertising ID, assigned to every smartphone, that can be read by any app installed on the device.
Thankfully, users can reset their advertising ID as often as they like by clearing their cookies, which deletes any previous data linked to their device.
But the International Computer Science Institute discovered that Android apps are also linking users’ advertising ID with other, more permanent, identifiers on their device, according to CNET.
These IDs include a device’s MAC address, IMEI and Android ID, which cannot be reset.
When apps send your advertising ID and hardware ID to advertisers, it doesn’t matter if you try to reset your advertising ID because advertisers can still tell it’s you, based on your hardware ID.
Google recommends that developers steer clear of using hardware identifiers such as these when collecting information about their users.
The search giant has gone so far as barring developers from combining a user’s advertising ID and hardware ID to target ads.
- Robots are a ‘grave threat to humanity’ and should be… Older brothers really ARE the biggest bullies: Study of… Software pirates exploit feature in Apple’s App Store to… Facebook’s first president Sean Parker lashes out at tech…
Share this article
But some apps continue to collect both IDs – a practice that violate’s Google’s policies.
With users unable to reset their hardware ID, it means they can’t erase any old data around their smartphone activity and start fresh.
Pictured is how users can reset their advertising ID to prevent targeted ads
‘In this case, sending a non-resettable identifier alongside the ad ID completely undermines the privacy-preserving properties of the ad ID: resetting it does not prevent tracking,’ Serge Egelman, a lead author of the study, explained.
‘For this reason, both iOS and Android have policies that prohibit developers from transmitting other identifiers alongside the ad ID.’
Egelman said he contacted Google with their findings in September.
Since then, Google told CNET it has taken action against several apps identified by Egelman.
The firm added that it does allow some apps to collect both advertising IDs and hardware IDs, but they can only be collected for the purposes of things like fraud detection, not for targeted advertising, CNET noted.
‘We take these issues very seriously,’ a Google spokesperson told CNET.
‘Combining Ad ID with device identifiers for the purpose of ads personalization is strictly forbidden.
‘We’re constantly reviewing apps – including those listed in the researcher’s report – and will take action when they do not comply with our policies.’
HOW DOES GOOGLE TRACK ITS USERS’ LOCATIONS OUTSIDE OF ‘LOCATION HISTORY’?
A new investigation led by the Associated Press found that some Google apps automatically store time-stamped location data without asking – even when you’ve paused Location History.
The investigation found, for example:
- Google stores a snapshot of where you are when you open its Maps app
- Automatic daily weather updates on Android phones pinpoint where you are each time the forecast is refreshed
- Simple searchers, such as ‘chocolate chip cookies,’ or ‘kids science kits,’ pinpoint your precise latitude and longitude – accurate to the square foot – and save it to your Google account
This information is all logged as part of the ‘Web and App Activity feature, which does not specifically reference location information in its description.
This is enabled by default, and stores a variety of information from Google apps and websites to your Google account.
When paused, it will prevent activity on any device from being saved to your account.
Leaving ‘Web & App Activity’ on and turning ‘Location History’ off only prevents Google from adding your movements to the ‘timeline,’ its visualization of your daily travels.
It does not stop Google’s collection of other location markers.
Source: Read Full Article