Android data collection: Difference between revisions
Added new section about telemetry shared by OEMs who use a modified version of android Tags: Mobile edit Mobile web edit |
m link GrapheneOS |
||
| (14 intermediate revisions by 9 users not shown) | |||
| Line 13: | Line 13: | ||
==Background== | ==Background== | ||
'''[[Android]]''', the global top mobile operating system,<ref>{{Cite web |title=Mobile Operating System Market Share Worldwide |url=https://gs.statcounter.com/os-market-share/mobile/worldwide |url-status=live |archive-url=https:// | '''[[Android]]''', the global top mobile operating system,<ref>{{Cite web |title=Mobile Operating System Market Share Worldwide |url=https://gs.statcounter.com/os-market-share/mobile/worldwide |url-status=live |archive-url=http://web.archive.org/web/20260221164626/https://gs.statcounter.com/os-market-share/mobile/worldwide |archive-date=21 Feb 2026|access-date=15 Mar 2025 |website=[[StatCounter]]}}</ref> is used to power billions of devices globally. Tests have shown that Android phones with [[List of Google products|Google Services]] transmit user data to Google on multiple occasions even when users try to restrict sharing of data via settings. This has encouraged increasing alarm over user privacy, transparency, and personal data control. | ||
A study found that data collection happens without any chance to opt out even before the user has even opened their first app.<ref>{{Cite web |last=Jones |first=Connor |date=4 Mar 2025 |title=How Google tracks Android device users before they've even opened an app |url=https://www.theregister.com/2025/03/04/google_android/ |url-status=live |archive-url=https:// | A study found that data collection happens without any chance to opt out even before the user has even opened their first app.<ref>{{Cite web |last=Jones |first=Connor |date=4 Mar 2025 |title=How Google tracks Android device users before they've even opened an app |url=https://www.theregister.com/2025/03/04/google_android/ |url-status=live |archive-url=http://web.archive.org/web/20260214065909/https://www.theregister.com/2025/03/04/google_android/ |archive-date=14 Feb 2026|access-date=2025-03-05 |website=The Register}}</ref> | ||
Moreover, most phone vendors do their own tracking on top and pre-install so-called [[bloatware]] in exchange for payment from the respective company, such as social media and shopping apps | Moreover, most phone vendors do their own tracking on top and pre-install so-called [[bloatware]] in exchange for payment from the respective company, such as social media and shopping apps [[Meta]], [[TikTok]], Aliexpress, [[eBay]], …), which transmit data in the background without user consent even if the apps are never even opened and the user never agreed to their TOS.<ref>{{Cite web |last=Trinity College Dublin |date=October 11, 2021 |title=Study reveals scale of data-sharing from Android mobile phones |url=https://techxplore.com/news/2021-10-reveals-scale-data-sharing-android-mobile.html |url-status=live |archive-url=http://web.archive.org/web/20251117171125/https://techxplore.com/news/2021-10-reveals-scale-data-sharing-android-mobile.html |archive-date=17 Nov 2025|access-date=2025-03-05 |website=TechXplore}}</ref> | ||
==Data sharing with Google== | ==Data sharing with Google== | ||
A research examined the frequency of data sharing between Google and Android phones with Google services.<ref name=":0">{{Cite web |last=Leith |first=Douglas J. |date=25 Mar 2021 |title=Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google |url=https://www.scss.tcd.ie/doug.leith/apple_google.pdf |url-status=live |archive-url=https:// | A research study examined the frequency of data sharing between Google and Android phones with Google services.<ref name=":0">{{Cite web |last=Leith |first=Douglas J. |date=25 Mar 2021 |title=Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google |url=https://www.scss.tcd.ie/doug.leith/apple_google.pdf |url-status=live |archive-url=http://web.archive.org/web/20251219165022/https://www.scss.tcd.ie/doug.leith/apple_google.pdf |archive-date=19 Dec 2025|access-date=15 Mar 2025}}</ref> The study describes that even if minimally configured and in idle mode, the handset will share data with Google on an average of every 4.5 minutes. The shared data includes the following sensitive information: | ||
*IMEI (International Mobile Equipment Identity) | *IMEI (International Mobile Equipment Identity) | ||
| Line 27: | Line 27: | ||
*SIM serial number and IMSI (International Mobile Subscriber Identity) | *SIM serial number and IMSI (International Mobile Subscriber Identity) | ||
*Handset phone number | *Handset phone number | ||
{| class="wikitable sortable mw-collapsible" | |||
|+SUMMARY OF HANDSET DATA SHARED WITH APPLE AND GOOGLE WHEN USER IS NOT LOGGED IN. | |||
! | |||
!<small>IMEI</small> | |||
!<small>Hardware</small> | |||
<small>Serial</small> | |||
<small>Number</small> | |||
!<small>SIM</small> | |||
<small>Serial</small> | |||
<small>Number</small> | |||
!<small>Phone</small> | |||
<small>Number</small> | |||
!<small>Device IDs</small> | |||
!<small>Location</small> | |||
!<small>Tele-</small> | |||
<small>metry</small> | |||
!<small>Cookies</small> | |||
!<small>Local</small> | |||
<small>IP</small> | |||
<small>Address</small> | |||
!<small>Device WiFi MAC</small> | |||
<small>Address</small> | |||
!<small>Nearby</small> | |||
<small>WiFi MAC</small> | |||
<small>Addresses</small> | |||
|- | |||
|<small>Apple iOS</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>UDID, Ad ID</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|x | |||
|<small>✓</small> | |||
|- | |||
|<small>Google Android</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|<small>Android ID,</small> | |||
<small>RDID/Ad ID,</small> | |||
<small>Droidguard</small> | |||
<small>key</small> | |||
|x | |||
|<small>✓</small> | |||
|<small>✓</small> | |||
|x | |||
|<small>✓</small> | |||
|x | |||
|} | |||
In addition, Google services on Android sends telemetry data to Google even when customers directly decline to have their data collected. For instance, each time a SIM card is inserted into the device, Google services sends its information to Google automatically. | In addition, Google services on Android sends telemetry data to Google even when customers directly decline to have their data collected. For instance, each time a SIM card is inserted into the device, Google services sends its information to Google automatically. | ||
Data exchanged with Google by Google Messages and Google Dialer applications on an Android smartphone was also researched.<ref>{{Cite web |last=Leith |first=Douglas J. |date=28 Feb 2022 |title=What Data Do The Google Dialer and Messages Apps On Android Send to Google? |url=https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf |url-status=live |archive-url=https:// | Data exchanged with Google by Google Messages and Google Dialer applications on an Android smartphone was also researched.<ref>{{Cite web |last=Leith |first=Douglas J. |date=28 Feb 2022 |title=What Data Do The Google Dialer and Messages Apps On Android Send to Google? |url=https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf |url-status=live |archive-url=http://web.archive.org/web/20251219161507/https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf |archive-date=19 Dec 2025|access-date=15 Mar 2025}}</ref> These applications report to Google whenever messages are being sent/received or calls are being received/made. Precisely: | ||
*Google Messages sends a message text hash so Google can match the sender and receiver in a message exchange. | *Google Messages sends a message text hash so Google can match the sender and receiver in a message exchange. | ||
| Line 45: | Line 99: | ||
Google misled some Android users into thinking that the setting titled “Location History” was the only Google account setting that affected whether the company collected, kept and used personally identifiable data about their location. In fact, another account setting titled “Web & App Activity” also enabled Google to collect, store and use personally identifiable location data when it was turned on, and that setting was turned on by default. | Google misled some Android users into thinking that the setting titled “Location History” was the only Google account setting that affected whether the company collected, kept and used personally identifiable data about their location. In fact, another account setting titled “Web & App Activity” also enabled Google to collect, store and use personally identifiable location data when it was turned on, and that setting was turned on by default. | ||
For this, Google was sued in the United States<ref>{{Cite web |last=Gatlan |first=Sergiu |date=14 Nov 2022 |title=Google will pay $391M to settle Android location tracking lawsuit |url=https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/ |url-status=live |archive-url=https:// | For this, Google was sued in the United States and in Australia.<ref>{{Cite web |last=Gatlan |first=Sergiu |date=14 Nov 2022 |title=Google will pay $391M to settle Android location tracking lawsuit |url=https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/ |url-status=live |archive-url=http://web.archive.org/web/20260218125205/https://www.bleepingcomputer.com/news/google/google-will-pay-391m-to-settle-android-location-tracking-lawsuit/ |archive-date=18 Feb 2026|access-date=15 Mar 2025 |website=[[BleepingComputer]]}}</ref><ref>{{Cite web |date=12 Aug 2022 |title=Google LLC to pay $60 million for misleading representations |url=https://www.accc.gov.au/media-release/google-llc-to-pay-60-million-for-misleading-representations |url-status=live |archive-url=https://web.archive.org/web/20220816180655/https://www.accc.gov.au/media-release/google-llc-to-pay-60-million-for-misleading-representations |archive-date=16 Aug 2022 |access-date=15 Mar 2025 |website=[[ACCC]]}}</ref> | ||
==Data sharing with OEM’s custom Android== | ==Data sharing with OEM’s custom Android== | ||
{{Incomplete section}} | |||
==Privacy respecting alternatives== | ==Privacy respecting alternatives== | ||
Some alternatives are available to users for completely avoiding this data sharing. Attempts to disable data collection via settings, Android integration with Google services does make it impossible to fully discontinue the passing on of person and device details.<ref name=":0" /> | |||
The use of [[wikipedia:List_of_custom_Android_distributions|custom ROMs]] or privacy-focused applications, do cut down on sharing data, these are likely to require technical know-how and are not necessarily in the hands of the average user. | The use of [[wikipedia:List_of_custom_Android_distributions|custom ROMs]] or privacy-focused applications, do cut down on sharing data, these are likely to require technical know-how and are not necessarily in the hands of the average user. | ||
| Line 59: | Line 115: | ||
A privacy replacing alternative should therefore have an alternative for these functions. | A privacy replacing alternative should therefore have an alternative for these functions. | ||
The only fully degoogled alternate configuration comprises of MicroG applications, which is an open source reimplementation of Google services. It provides necessary dependencies so that most of the applications which depend on Google services can function on a device without those Google services. | |||
Another option is [[GrapheneOS]], an optionally de-googled privacy and security focused Android ROM. While not replacing google play services completely, GrapheneOS offers a sandboxed version of the google play services. The sandboxing allows users to control the permissions of the google play services, limiting the privacy risk they pose. GrapheneOS has many other privacy features like more control over app permissions and automatic time-based Wifi and Bluetooth off switches. Despite these features, users may choose not to consider this Android ROM due to its development history and other controversies.<ref> https://youtube.com/watch?v=4To-F6W1NT0 ([https://preservetube.com/watch?v=4To-F6W1NT0 Archived])</ref><ref> https://youtube.com/watch?v=Dx7CZ-2Bajg ([https://preservetube.com/watch?v=Dx7CZ-2Bajg Archived])</ref> | |||
As for application distribution, alternate channels, such as [https://f-droid.org/ F-droid], [https://auroraoss.com/aurora-store Aurora Store], [https://accrescent.app/ Accrescent], and [https://obtainium.imranr.dev/ Obtanium], do exist. These alternative application sources allow users to install applications of their choosing without a single entity to regulate the applications. | As for application distribution, alternate channels, such as [https://f-droid.org/ F-droid], [https://auroraoss.com/aurora-store Aurora Store], [https://accrescent.app/ Accrescent], and [https://obtainium.imranr.dev/ Obtanium], do exist. These alternative application sources allow users to install applications of their choosing without a single entity to regulate the applications. | ||
These application sources have different uses, with F-droid acting as an app store for only free and open source apps, Aurora Store acts as an anonymized version of the Google Play Store, Accrescent focuses on app-installation security, and Obtanium acts as an update-grabber from code repositories like Github, Gitlab, and Codeberg. | These application sources have different uses, with F-droid acting as an app store for only free and open source apps, Aurora Store acts as an anonymized version of the Google Play Store, Accrescent focuses on app-installation security, and Obtanium acts as an update-grabber from code repositories like Github, Gitlab, and Codeberg. | ||
[https://murena.com/ Murena], Fairphone and [https://iode.tech/ Iodé] sells devices pre-installed with de-googled Android based on LineageOS and MicroG, making privacy friendly Android phones accessible to non-technical users. However, the operating system called /e/ on Murena devices has a history of not always addressing security vulnerabilities in a timely manner<ref>{{Cite web |last=Duval |first=Gael |date=Sep 2023 |title=Some clarification regarding security vs privacy in /e/OS |url=https://community.e.foundation/t/some-clarification-regarding-security-vs-privacy-in-e-os/51839 |url-status=live |archive-url=https:// | [https://murena.com/ Murena], Fairphone and [https://iode.tech/ Iodé] sells devices pre-installed with de-googled Android based on [https://lineageos.org/ LineageOS] and MicroG, making privacy friendly Android phones accessible to non-technical users. However, the operating system called /e/ on Murena devices has a history of not always addressing security vulnerabilities in a timely manner.<ref>{{Cite web |last=Duval |first=Gael |date=Sep 2023 |title=Some clarification regarding security vs privacy in /e/OS |url=https://community.e.foundation/t/some-clarification-regarding-security-vs-privacy-in-e-os/51839 |url-status=live |archive-url=http://web.archive.org/web/20251107035830/https://community.e.foundation/t/some-clarification-regarding-security-vs-privacy-in-e-os/51839 |archive-date=7 Nov 2025|access-date=15 Mar 2025 |website=[[e]]}}</ref> However the situation is still much better than the millions of phones in active use that no longer get manufacturer support. | ||
==References== | ==References== | ||