More than three in four Android apps contain at least one third-party “tracker”, according to a new analysis of hundreds of apps.
The study by French research organisation Exodus Privacy and Yale University’s Privacy Lab analysed the mobile apps for the signatures of 25 known trackers, which use various techniques to glean personal information about users to better target them for advertisements and services.
Among the apps found to be using some sort of tracking plugin were some of the most popular apps on the Google Play Store, including Tinder, Spotify, Uber and OKCupid. All four apps use a service owned by Google, called Crashlytics, that primarily tracks app crash reports, but can also provide the ability to “get insight into your users, what they’re doing, and inject live social content to delight them”.
Other less widely-used trackers can go much further. One cited by Yale is FidZup, a French tracking provider with technology that can “detect the presence of mobile phones and therefore their owners” using ultrasonic tones. FidZup says it no-longer uses that technology, however, since tracking users through simple wifi networks works just as well.
The Yale researchers said: “FidZup’s practices closely resemble those of Teemo (formerly known as Databerries), the tracker company that was embroiled in scandal earlier this year for studying the geolocation of 10 million French citizens, and SafeGraph, who ‘collected 17tn location markers for 10m smartphones during [Thanksgiving] last year’. Both of these trackers have been profiled by Privacy Lab and can be identified by Exodus scans.”
Yale Privacy Lab is using its research to call on developers, as well as Google, “for increased transparency into privacy and security practice as it relates to these trackers.”
The researchers added: “Android users, and users of all app stores, deserve a trusted chain of software development, distribution, and installation that does not include unknown or masked third-party code.
“Scholars, privacy advocates and security researchers should be alarmed by the data, and can provide further analysis now that these findings and the Exodus platform have been made public.”
Although Yale didn’t examine iOS apps, the company warns that the situation may be no better on Apple’s App Store. “Many of the same companies distributing Google Play apps also distribute apps via Apple, and tracker companies openly advertise Software Development Kits (SDKs) compatible with multiple platforms,” said the researchers. “Thus, advertising trackers may be concurrently packaged for Android and iOS, as well as more obscure mobile platforms.”
- Google has been tracking Android users even with location services turned off
- Uber pulls U-turn on controversial tracking of users after trip has ended
