Highly relevant study on how 24,000 out of 570k identified free Android and iOS apps transmit personal data to third-party companies shows a massive failure of GDPR enforcement. By @KKollnig, Anastasia Shuba, @RDBinns et al, based on code+traffic analysis: arxiv.org/pdf/2109.13722… 
@KKollnig @RDBinns Examining also iOS apps is very worthy. Third-party tracking in iOS apps is notoriously underexamined because more difficult than in the Google ecosystem.
However, important to consider that the data is from 2020, and thus from *before* Apple introduced the IDFA request stuff.
However, important to consider that the data is from 2020, and thus from *before* Apple introduced the IDFA request stuff.
The 'Advertising ID' is a device identifier controlled by Google/Apple that points to the person using a phone. Thousands of companies use it to track, follow and profile everyone.
55.4% of Android apps and 31% of iOS apps shared the so-called Advertising ID with third parties.
55.4% of Android apps and 31% of iOS apps shared the so-called Advertising ID with third parties.
As soon as the AdID is being transmitted, everything else that is transmitted (all kinds of behavioral data) is clearly personal data and exploited to link profile data across the industry.
So, I wouldn't say that Apple/iOS was equally bad as Android in 2020, but still very bad.
So, I wouldn't say that Apple/iOS was equally bad as Android in 2020, but still very bad.
Google & Apple are responsible:
"Since the platforms take a share of any sales through the app stores (up to 30%), both Apple and Google have a natural interest in creating business opportunities for app publishers, and letting them collect data about users to drive such sales"
"Since the platforms take a share of any sales through the app stores (up to 30%), both Apple and Google have a natural interest in creating business opportunities for app publishers, and letting them collect data about users to drive such sales"
So, which companies did the examined apps share data with?
Mobile platform operators Google and Apple. Facebook, Microsoft, Amazon, Oracle, Salesforce/AppsFlyer, children/games tracking firm Unity, and many other data harvesting companies based in the US, in Russia and in China.
Mobile platform operators Google and Apple. Facebook, Microsoft, Amazon, Oracle, Salesforce/AppsFlyer, children/games tracking firm Unity, and many other data harvesting companies based in the US, in Russia and in China.
Not all data sharing with third parties is equal.
G, FB and others create extensive personal profiles on billions based on data shared by apps. Apple's profiling, to my knowledge, is less extensive.
Anyway, both large platforms and myriads of smaller data firms are problematic.
G, FB and others create extensive personal profiles on billions based on data shared by apps. Apple's profiling, to my knowledge, is less extensive.
Anyway, both large platforms and myriads of smaller data firms are problematic.
I would have expected that children's apps are at least a bit less contaminated by unscrupulous tracking by third-party companies, but no.
On Android, even *more* children's apps were observed to share the Advertising ID compared to all examined apps (59.3% compared to 55.5%).
On Android, even *more* children's apps were observed to share the Advertising ID compared to all examined apps (59.3% compared to 55.5%).
The analysis of third-party libraries embedded in apps may include companies that receive not very extensive personal data.
On the other hand, the paper only examined how apps shared data *before any user interaction*. The numbers would be much higher after pseudo 'consent'.
On the other hand, the paper only examined how apps shared data *before any user interaction*. The numbers would be much higher after pseudo 'consent'.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
