H0l0 (talk | contribs)
m filled cargo
Rudxain (talk | contribs)
m link GrapheneOS
 
(30 intermediate revisions by 9 users not shown)
Line 8: Line 8:
|ArticleType=
|ArticleType=
|Type=Privacy
|Type=Privacy
|Description=Google & Android phone's alike deliberately collect user information, even when they choose to opt-out.
|Description=Google and Android phones alike deliberately collect user information, even when they choose to opt-out.
}}
}}
This article addresses the manner in which Android phones share personal user information with [[Google]], usually in a complete user unaware and unapproved way, and the legal consequences Google has endured for deceptive practices in users' location tracking.
This article addresses the manner in which Android phones share personal user information with [[Google]], usually in a complete user unaware and unapproved way, and the legal consequences Google has endured for deceptive practices in users' location tracking. This article also discusses non-Google OEM privacy concerns with companies who implement their own modified version of Android such as [[Samsung]] and [[Xiaomi]].


==Background==
==Background==
'''[[Android]]''', the global top mobile operating system,<ref>{{Cite web |title=Mobile Operating System Market Share Worldwide |url=https://gs.statcounter.com/os-market-share/mobile/worldwide |url-status=live |archive-url=https://archive.ph/kSdCi |archive-date=4 Dec 2025 |access-date=15 Mar 2025 |website=[[StatCounter]]}}</ref> is used to power billions of devices globally. Tests have shown that Android phones with [[Google Mobile Services|Google services]] transmit user data to Google on multiple occasions even when users try to restrict sharing of data via settings. This has encouraged increasing alarm over user privacy, transparency, and personal data control.
'''[[Android]]''', the global top mobile operating system,<ref>{{Cite web |title=Mobile Operating System Market Share Worldwide |url=https://gs.statcounter.com/os-market-share/mobile/worldwide |url-status=live |archive-url=http://web.archive.org/web/20260221164626/https://gs.statcounter.com/os-market-share/mobile/worldwide |archive-date=21 Feb 2026|access-date=15 Mar 2025 |website=[[StatCounter]]}}</ref> is used to power billions of devices globally. Tests have shown that Android phones with [[List of Google products|Google Services]] transmit user data to Google on multiple occasions even when users try to restrict sharing of data via settings. This has encouraged increasing alarm over user privacy, transparency, and personal data control.


A study found that data collection happens without any chance to opt out even before the user has even opened their first app.<ref>{{Cite web |last=Jones |first=Connor |date=4 Mar 2025 |title=How Google tracks Android device users before they've even opened an app |url=https://www.theregister.com/2025/03/04/google_android/ |url-status=live |archive-url=https://archive.ph/vVvzw |archive-date=4 Mar 2025 |access-date=2025-03-05 |website=The Register}}</ref>  
A study found that data collection happens without any chance to opt out even before the user has even opened their first app.<ref>{{Cite web |last=Jones |first=Connor |date=4 Mar 2025 |title=How Google tracks Android device users before they've even opened an app |url=https://www.theregister.com/2025/03/04/google_android/ |url-status=live |archive-url=http://web.archive.org/web/20260214065909/https://www.theregister.com/2025/03/04/google_android/ |archive-date=14 Feb 2026|access-date=2025-03-05 |website=The Register}}</ref>  


Moreover, most phone vendors do their own tracking on top and pre-install so-called [[bloatware]] in exchange for payment from the respective company, such as social media and shopping apps (Facebook, TikTok, Aliexpress, eBay, …), which transmit data in the background without user consent even if the apps are never even opened and the user never agreed to their TOS.<ref>{{Cite web |last=Trinity College Dublin |date=October 11, 2021 |title=Study reveals scale of data-sharing from Android mobile phones |url=https://techxplore.com/news/2021-10-reveals-scale-data-sharing-android-mobile.html |url-status=live |archive-url=https://archive.ph/CX9RV |archive-date=12 Oct 2021 |access-date=2025-03-05 |website=TechXplore}}</ref>
Moreover, most phone vendors do their own tracking on top and pre-install so-called [[bloatware]] in exchange for payment from the respective company, such as social media and shopping apps [[Meta]], [[TikTok]], Aliexpress, [[eBay]], …), which transmit data in the background without user consent even if the apps are never even opened and the user never agreed to their TOS.<ref>{{Cite web |last=Trinity College Dublin |date=October 11, 2021 |title=Study reveals scale of data-sharing from Android mobile phones |url=https://techxplore.com/news/2021-10-reveals-scale-data-sharing-android-mobile.html |url-status=live |archive-url=http://web.archive.org/web/20251117171125/https://techxplore.com/news/2021-10-reveals-scale-data-sharing-android-mobile.html |archive-date=17 Nov 2025|access-date=2025-03-05 |website=TechXplore}}</ref>


==Data sharing with Google==
==Data sharing with Google==
A research examined the frequency of data sharing between Google and Android phones with Google services.<ref name=":0">{{Cite web |last=Leith |first=Douglas J. |date=25 Mar 2021 |title=Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google |url=https://www.scss.tcd.ie/doug.leith/apple_google.pdf |url-status=live |archive-url=https://archive.ph/2ycdM |archive-date=6 Oct 2021 |access-date=15 Mar 2025}}</ref> The research showed that even if an Android phone is set to minimal setting and left on its own, it shares data with Google on average every 4.5 minutes. The shared data includes sensitive information like:
A research study examined the frequency of data sharing between Google and Android phones with Google services.<ref name=":0">{{Cite web |last=Leith |first=Douglas J. |date=25 Mar 2021 |title=Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google |url=https://www.scss.tcd.ie/doug.leith/apple_google.pdf |url-status=live |archive-url=http://web.archive.org/web/20251219165022/https://www.scss.tcd.ie/doug.leith/apple_google.pdf |archive-date=19 Dec 2025|access-date=15 Mar 2025}}</ref> The study describes that even if minimally configured and in idle mode, the handset will share data with Google on an average of every 4.5 minutes. The shared data includes the following sensitive information:


*IMEI (International Mobile Equipment Identity)
*IMEI (International Mobile Equipment Identity)
Line 27: Line 27:
*SIM serial number and IMSI (International Mobile Subscriber Identity)
*SIM serial number and IMSI (International Mobile Subscriber Identity)
*Handset phone number
*Handset phone number
 
{| class="wikitable sortable mw-collapsible"
|+SUMMARY OF HANDSET DATA SHARED WITH APPLE AND GOOGLE WHEN USER IS NOT LOGGED IN.
!
!<small>IMEI</small>
!<small>Hardware</small>
<small>Serial</small>
<small>Number</small>
!<small>SIM</small>
<small>Serial</small>
<small>Number</small>
!<small>Phone</small>
<small>Number</small>
!<small>Device IDs</small>
!<small>Location</small>
!<small>Tele-</small>
<small>metry</small>
!<small>Cookies</small>
!<small>Local</small>
<small>IP</small>
<small>Address</small>
!<small>Device WiFi MAC</small>
<small>Address</small>
!<small>Nearby</small>
<small>WiFi MAC</small>
<small>Addresses</small>
|-
|<small>Apple iOS</small>
|<small>✓</small>
|<small>✓</small>
|<small>✓</small>
|<small>✓</small>
|<small>UDID, Ad ID</small>
|<small>✓</small>
|<small>✓</small>
|<small>✓</small>
|<small>✓</small>
|x
|<small>✓</small>
|-
|<small>Google Android</small>
|<small>✓</small>
|<small>✓</small>
|<small>✓</small>
|<small>✓</small>
|<small>Android ID,</small>
<small>RDID/Ad ID,</small>
<small>Droidguard</small>
<small>key</small>
|x
|<small>✓</small>
|<small>✓</small>
|x
|<small>✓</small>
|x
|}
In addition, Google services on Android sends telemetry data to Google even when customers directly decline to have their data collected. For instance, each time a SIM card is inserted into the device, Google services sends its information to Google automatically.
In addition, Google services on Android sends telemetry data to Google even when customers directly decline to have their data collected. For instance, each time a SIM card is inserted into the device, Google services sends its information to Google automatically.


Data exchanged with Google by Google Messages and Google Dialer applications on an Android smartphone was also researched.<ref>{{Cite web |last=Leith |first=Douglas J. |date=28 Feb 2022 |title=What Data Do The Google Dialer and Messages Apps On Android Send to Google? |url=https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf |url-status=live |archive-url=https://archive.ph/gtRKo |archive-date=14 Mar 2022 |access-date=15 Mar 2025}}</ref> These applications report to Google whenever messages are being sent/received or calls are being received/made. Precisely:
Data exchanged with Google by Google Messages and Google Dialer applications on an Android smartphone was also researched.<ref>{{Cite web |last=Leith |first=Douglas J. |date=28 Feb 2022 |title=What Data Do The Google Dialer and Messages Apps On Android Send to Google? |url=https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf |url-status=live |archive-url=http://web.archive.org/web/20251219161507/https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf |archive-date=19 Dec 2025|access-date=15 Mar 2025}}</ref> These applications report to Google whenever messages are being sent/received or calls are being received/made. Precisely:


*Google Messages sends a message text hash so Google can match the sender and receiver in a message exchange.
*Google Messages sends a message text hash so Google can match the sender and receiver in a message exchange.
Line 45: Line 99:
Google misled some Android users into thinking that the setting titled “Location History” was the only Google account setting that affected whether the company collected, kept and used personally identifiable data about their location. In fact, another account setting titled “Web & App Activity” also enabled Google to collect, store and use personally identifiable location data when it was turned on, and that setting was turned on by default.
Google misled some Android users into thinking that the setting titled “Location History” was the only Google account setting that affected whether the company collected, kept and used personally identifiable data about their location. In fact, another account setting titled “Web & App Activity” also enabled Google to collect, store and use personally identifiable location data when it was turned on, and that setting was turned on by default.


For this, Google was sued in the United States<ref>{{Cite web |last=Gatlan |first=Sergiu |date=14 Nov 2022 |title=Google will pay $391M to settle Android location tracking lawsuit |url=https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/ |url-status=live |archive-url=https://archive.ph/riwh9 |archive-date=15 Nov 2022 |access-date=15 Mar 2025 |website=[[BleepingComputer]]}}</ref> and in Australia.<ref>{{Cite web |date=12 Aug 2022 |title=Google LLC to pay $60 million for misleading representations |url=https://www.accc.gov.au/media-release/google-llc-to-pay-60-million-for-misleading-representations |url-status=live |archive-url=https://archive.ph/Jn1fd |archive-date=17 Aug 2022 |access-date=15 Mar 2025 |website=[[ACCC]]}}</ref>
For this, Google was sued in the United States and in Australia.<ref>{{Cite web |last=Gatlan |first=Sergiu |date=14 Nov 2022 |title=Google will pay $391M to settle Android location tracking lawsuit |url=https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/ |url-status=live |archive-url=http://web.archive.org/web/20260218125205/https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/ |archive-date=18 Feb 2026|access-date=15 Mar 2025 |website=[[BleepingComputer]]}}</ref><ref>{{Cite web |date=12 Aug 2022 |title=Google LLC to pay $60 million for misleading representations |url=https://www.accc.gov.au/media-release/google-llc-to-pay-60-million-for-misleading-representations |url-status=live |archive-url=https://web.archive.org/web/20220816180655/https://www.accc.gov.au/media-release/google-llc-to-pay-60-million-for-misleading-representations |archive-date=16 Aug 2022 |access-date=15 Mar 2025 |website=[[ACCC]]}}</ref>
==Data sharing with OEM’s custom Android==
{{Incomplete section}}


==Privacy respecting alternatives==
==Privacy respecting alternatives==
Not many alternatives are available to users for completely avoiding this data sharing. Attempts to disable data collection via settings, Android integration with Google services does make it impossible to fully discontinue the passing on of person and device details.<ref name=":0" />
Some alternatives are available to users for completely avoiding this data sharing. Attempts to disable data collection via settings, Android integration with Google services does make it impossible to fully discontinue the passing on of person and device details.<ref name=":0" />


The use of [[wikipedia:List_of_custom_Android_distributions|custom ROMs]] or privacy-focused applications, do cut down on sharing data, these are likely to require technical know-how and are not necessarily in the hands of the average user.
The use of [[wikipedia:List_of_custom_Android_distributions|custom ROMs]] or privacy-focused applications, do cut down on sharing data, these are likely to require technical know-how and are not necessarily in the hands of the average user.
Line 59: Line 115:
A privacy replacing alternative should therefore have an alternative for these functions.
A privacy replacing alternative should therefore have an alternative for these functions.


Perhaps the only Google -free alternate configuration comprises of MicroG applications, which is an open source reimplementation of Google services. It provides necessary dependencies so that most of the applications which depend on Google services can function on a device without those Google services.
The only fully degoogled alternate configuration comprises of MicroG applications, which is an open source reimplementation of Google services. It provides necessary dependencies so that most of the applications which depend on Google services can function on a device without those Google services.  


As for application distribution, few alternate channels, such as F-droid and Aurora Store exists.  
Another option is [[GrapheneOS]], an optionally de-googled privacy and security focused Android ROM. While not replacing google play services completely, GrapheneOS offers a sandboxed version of the google play services. The sandboxing allows users to control the permissions of the google play services, limiting the privacy risk they pose. GrapheneOS has many other privacy features like more control over app permissions and automatic time-based Wifi and Bluetooth off switches. Despite these features, users may choose not to consider this Android ROM due to its development history and other controversies.<ref> https://youtube.com/watch?v=4To-F6W1NT0 ([https://preservetube.com/watch?v=4To-F6W1NT0 Archived])</ref><ref> https://youtube.com/watch?v=Dx7CZ-2Bajg ([https://preservetube.com/watch?v=Dx7CZ-2Bajg Archived])</ref>
As for application distribution, alternate channels, such as [https://f-droid.org/ F-droid], [https://auroraoss.com/aurora-store Aurora Store], [https://accrescent.app/ Accrescent], and [https://obtainium.imranr.dev/ Obtanium], do exist. These alternative application sources allow users to install applications of their choosing without a single entity to regulate the applications.
These application sources have different uses, with F-droid acting as an app store for only free and open source apps, Aurora Store acts as an anonymized version of the Google Play Store, Accrescent focuses on app-installation security, and Obtanium acts as an update-grabber from code repositories like Github, Gitlab, and Codeberg.


[https://murena.com/ Murena], Fairphone and [https://iode.tech/ Iodé] sells devices pre-installed with de-googled Android based on LineageOS and MicroG, making privacy friendly Android phones accessible to non-technical users. However, the operating system called /e/ on Murena devices has a history of not always addressing security vulnerabilities in a timely manner<ref>{{Cite web |last=Duval |first=Gael |date=Sep 2023 |title=Some clarification regarding security vs privacy in /e/OS |url=https://community.e.foundation/t/some-clarification-regarding-security-vs-privacy-in-e-os/51839 |url-status=live |archive-url=https://archive.ph/APVqP |archive-date=7 Jan 2026 |access-date=15 Mar 2025 |website=[[e]]}}</ref>. However the situation is still much better than the millions of phones in active use that no longer get manufacturer support.
[https://murena.com/ Murena], Fairphone and [https://iode.tech/ Iodé] sells devices pre-installed with de-googled Android based on [https://lineageos.org/ LineageOS] and MicroG, making privacy friendly Android phones accessible to non-technical users. However, the operating system called /e/ on Murena devices has a history of not always addressing security vulnerabilities in a timely manner.<ref>{{Cite web |last=Duval |first=Gael |date=Sep 2023 |title=Some clarification regarding security vs privacy in /e/OS |url=https://community.e.foundation/t/some-clarification-regarding-security-vs-privacy-in-e-os/51839 |url-status=live |archive-url=http://web.archive.org/web/20251107035830/https://community.e.foundation/t/some-clarification-regarding-security-vs-privacy-in-e-os/51839 |archive-date=7 Nov 2025|access-date=15 Mar 2025 |website=[[e]]}}</ref> However the situation is still much better than the millions of phones in active use that no longer get manufacturer support.


==References==
==References==