There is no privacy at all with mobile phones: Study reveals large scale of data-sharing from Android mobile phones

Android and Google data sharing. Credit: Trinity College Dublin

An in-depth analysis of a range of popular Android mobile phones has revealed significant data collection and sharing, including with third parties, with no opt-out available to users.

Even when minimally configured and the handset is idle, with the notable exception of e/OS, these vendor-customized Android variants transmit substantial amounts of information to the OS developer and to third parties such as Google, Microsoft, LinkedIn, and Facebook that have pre-installed system apps. There is no opt-out from this data collection.

While occasional communication with OS servers is to be expected, the authors of the study say the observed data transmission goes well beyond this and raises a number of privacy concerns.

Key findings from the study:

With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, e.g., a mental health app, a Muslim prayer app, a gay dating app, a Republican news app. There is no opt out from this data collection.

The Xiaomi handset sends details of all the app screens viewed by a user to Xiaomi, including when and how long each app is used. This reveals, for example, the timing and duration of phone calls. The effect is akin to the use of cookies to track people's activity as they move between web pages. This data appears to be sent outside Europe to Singapore.

On the Huawei handset the Swiftkey keyboard sends details of app usage over time to Microsoft. This reveals, for example, when a user is writing a text, using the search bar, searching for contacts.

Samsung, Xiaomi, Realme and Google collect long-lived device identifiers, e.g., the hardware serial number, alongside user-resettable advertising identifiers. This means that when a user resets an advertising identifier the new identifier value can be trivially re-linked back to the same device, potentially undermining the use of user-resettable advertising identifiers.

Third-party system apps, e.g., from Google, Microsoft, LinkedIn and Facebook, are pre-installed on most of the handsets and silently collect data, with no opt out.

There may exist a data ecosystem where data collected from a handset by different companies is shared/linked. Notably, the privacy focused e/OS variant of Android was observed to transmit essentially no data.

Tech Xplore

TACS is a leading top consultancy in the field of information, communication and energy technologies (ICET).

The heart of our consulting spectrum comprises strategic, organizational, and technology-intensive tasks that arise from the use of new information, communication and energy technologies. 
 
The major emphasis in our work is found in innovative consulting and implementation solutions which result from the use of modern information, communication and energy technologies.

TACS 

• Delivers the insight and vision on technology for strategic decisions
• Drives innovations forward as part of our service offerings to customers worldwide 
• Conceives integral solutions on the basis of our integrated business and technological competence in the ICET sector 
• Assesses technologies and standards and develops architectures for fixed or mobile, wired or wireless communications systems and networks
• Provides the energy and experience of world-wide leading innovators and experts in their fields for local, national or large-scale international projects.