how smartphone apps track users and share data te chnolo gy...s h o w w h o g e t s t h e s e a p p...

23/10/2018 How smartphone apps track users and share data

https://ig.ft.com/mobile-app-data-trackers/ 1/21

Technology

How smartphone apps track users and share data

Almost 9 in 10 Android apps are able to share data with Google, says study

FT Montage

By Aliya Ram, Aleksandra Wisniewska, Joanna S. Kao, Ændrew Rininsland, Caroline Nevitt 12 HOURS AGO

A peer-reviewed study of almost 1m Android apps has revealed how datafrom smartphones are harvested and shared, with nearly 90 per cent ofapps set up to transfer information back to Google.

http://www.ft.com/

https://www.ft.com/technology

https://www.ft.com/aliya-ram

https://www.ft.com/aleksandra-wisniewska

https://www.ft.com/joanna-s-kao

https://www.ft.com/%C3%A6ndrew-rininsland

https://www.ft.com/caroline-nevitt

https://twitter.com/intent/tweet?url=https://ig.ft.com/mobile-app-data-trackers/&text=Here%27s%20how%201m%20apps%20are%20tracking%20users%20and%20sharing%20their%20data&related=&via=FinancialTimes

https://arxiv.org/pdf/1804.03603.pdf



Researchers at Oxford university analysed approximately a third of the appsavailable in Google’s Play Store in 2017 and found that the median appcould transfer data to 10 third parties, with one in five apps able to sharedata with more than 20.

This year has seen unprecedented scrutiny over how websites use the datathey collect from their users, but little attention has so far been paid to thesprawling and fast-growing world of smartphone apps.

Reuben Binns, the computer scientist who led the project, said that becausemost apps have now moved to a “freemium” model, where they makerevenues from advertising rather than sales, data sharing has spiralled outof control.

Users, regulators and sometimes even the app developers and advertisersare unaware of the extent to which data flow from smartphones to digitaladvertising groups, data brokers and intermediaries that buy, sell and blendinformation, he said.

“This industry was growing already on the web . . . when smartphones camealong, that was a new opportunity,” he said. “It feels like this legitimatebusiness model has gone completely out of control and created a kind ofchaotic industry that is not understood by the people who are most affectedby it.”

Data collected by third parties through smartphone apps can includeanything from profile information such as age and gender to locationdetails, including data about nearby cell phone towers or Wi-Fi routers, andinformation about every other app on a phone.



Clear all

Select mobile apps in which you are interested

SELECTED APPS

ADD MORE APPS

Add

Show who gets these apps’ data

The rapid growth of the app economy has seen almost 10m apps released inthe decade since Google created an app store for Android smartphone users,according to App Annie, the research group. As of August, there were 2.8mapps available on the store.

The researchers at Oxford looked at the code in apps that indicates data arebeing transferred, and showed both how widely data are shared, and howthat data often flow upwards to a handful of companies, notably Google’sparent company Alphabet, as well as Facebook, Twitter, Verizon, Microsoftand Amazon.

Facebook ✕ PayPal ✕ Candy Crush Saga ✕ AccuWeather ✕

Spotify Music ✕

Search for app...



The concentration of data in the hands of the world’s biggest techcompanies is often masked by a network of subsidiaries that collect datafrom smartphone apps. The analysis showed that as of January last year 88per cent of apps could transfer data to third parties ultimately owned byAlphabet, while 43 per cent could transfer data to businesses ultimatelyowned by Facebook.

“This is important if we are to empower individuals and also understand themonopoly and concentration issues surrounding tracking companies,” saidNigel Shadbolt, co-founder of the Open Data Institute and head of thegroup that carried out the research.

Because data are ultimately transferred to the same businesses, it can beused to create detailed profiles, said academics. If information from a



dating app, for example, were shared with the same parent company as datafrom a banking app, it could be possible to deduce the sexuality of a bank’scustomers.

“Mobile phone are stores of sensitive information and if your phone is on,they’re just sending the information all the time to the same third parties,”said Joel Reardon, assistant professor of computer science at the Universityof Calgary. “Even just the characterisation of what apps you have on yourphone is quite an insight into a person’s life, you can learn informationabout their age, sexual orientation, health and link it back to their device.”

Google disputed the implications of the research, saying it mischaracterised“ordinary functions” such as an app reporting back when it had crashed andits analytics.

“Across Google and in Google Play we have clear policies and guidelines forhow developers and third-party apps can handle data and we requiredevelopers to be transparent and ask for user permission. If an app violatesour policies, we take action,” said Google.



But Mr Binns said the data transfer rights built into the apps often gobeyond simple uses such as crash reporting because many apps ask for“excessive permissions” to transfer data and reserve the right to retain it foranalysis and resale.

The Financial Times app was one of the apps analysed by the researchers,who found that it sends data to seven third parties. A spokesperson for theFT said: “We send data to these providers to enable services such as pushnotifications, crash tracking, Google sign-on and personalised advertising.

“We are extremely careful with how we collect and handle customer data,and set out in detail how we use it in our privacy policy. Readers can easilymanage their cookie settings for ft.com and our apps.”



News apps, games and apps targeting children were among those with theability to transfer data to the most third parties, the research found, despiteregulations in the US and Europe that limit how children’s data can beprocessed.

The privacy policies of many apps analysed by the FT shifted the burden ofcompliance on to users, stating that people under the age of 13 should notuse their services.

Most smartphone users often do not realise the extent to which their dataare passed to third parties, or repackaged and passed on again, said lawyersand privacy campaigners.

“There is a lot of sharing of data that we cannot as users immediatelyidentify or realise,” said Gabriel Voisin, a partner at Bird & Bird, the lawfirm. Users cannot easily control who their apps share data with, or the factthat only “two or possibly three super-dominant” companies such as Googlesit at the top of the data pyramid. “There are no easily accessible settings orwidget to switch this off,” he said.

The Oxford research found that 90 per cent of apps could transfer data tothird parties in the US, with 5 per cent able to send data to third parties inChina and 3 per cent to those in Russia.

The EU does not consider China and Russia to have adequate data privacystandards, while the US is only considered adequate if companies use extrasafeguards. “All we can see is the first hop or step in the process, data goingout,” said Mr Binns. “But what happens to it next, we don’t know.”

Both Apple and Google have launched tools to mask data.



“De-anonymisation”, the practice of linking data to a user, is prohibited bythe EU’s General Data Protection Regulation.

But Frederike Kaltheuner, head of the data exploitation practice atcampaign group Privacy International, said an industry of data brokers suchas Acxiom operate in a legal grey area, offering services to link datatogether, matching offline data such as spending with online data fromsmartphones. “In practice we know it’s very easy to link data back together,”she said.

Alexander Hazell, data protection officer at Acxiom, said the companyinsisted data should be legally and responsibly sourced and used bypartners in a “legal, proportionate and fair” way.

“Acxiom takes data protection very seriously and goes further than legalcompliance by applying an ethical framework to how it processes data forothers,” he said.

The introduction of GDPR in May was a watershed moment for privacyregulation, but the world of smartphone data has so far remained largely inthe dark.

“The whole ecosystem has grown so much so quickly, it’s got to a scalewhere it’s very difficult to manage,” said Narseo Rodriguez, professor atImdea Networks, a publicly funded research institute. “Phone [data]transfers have got to a scale where it’s going to be very, very difficult tomanage.”

Adrienne Hall, general manager at Microsoft, said the company “has adifferent business model than other tech companies that rely principally on



advertising revenue”.

LinkedIn, which is owned by Microsoft, said it “places limits on any use orcombination of data with third parties or Microsoft”.

Oath said: “The research also appears to account for data that may beshared with us as part of an app’s use of our digital ad technologies. GDPRrequires app developers offering services to European users to disclose theirprivacy policies, including third party data sharing, as well as user datamanagement options.”

Facebook, Twitter and Amazon declined to comment.

‘Third Party Tracking in the Mobile Ecosystem’ was peerreviewed andfunded by the British government’s Engineering and Physical SciencesResearch Council.

The researchers used a partly automated “static” analysis method thatinvolves downloading an app, extracting its code and searching forelements that look like website URLs. Any possible URLs were comparedwith a list of manually compiled URLs judged by the researchers to beused by third party “tracking” companies for analysis and profiling. Thelist was based on publicly available information about the ownership andbusiness activities of companies. The research might have identified URLsthat do not actually always take data from apps. Several apps, includingUber, have been excluded because it was unclear to which parties theysend data if they send any

Copyright The Financial Times Limited 2018. All rights reserved. You may share using our article tools.

Please don't cut articles from FT.com and redistribute by email or post to the web.

http://www.ft.com/servicestools/help/copyright



Technology

Tech regulation: politically correctTUESDAY, 23 OCTOBER 2018

Australia’s Uber drivers earn less than minimum wageTUESDAY, 23 OCTOBER 2018

European tech stocks fall on lower earnings guidanceTUESDAY, 23 OCTOBER 2018

The cyber secrets of TaiwanTUESDAY, 23 OCTOBER 2018

Shares fall in French IT group Atos as it cuts forecastsTUESDAY, 23 OCTOBER 2018

There is a fight over data brewing on Wall StreetTUESDAY, 23 OCTOBER 2018

Please keep comments respectful. By commenting, you agree to abide by our community guidelines and these terms and conditions.We encourage you to report inappropriate comments.

Newest | Oldest | Most recommended

COMMENTS (56)

2 hours agomkgsoub

Behind the scenes in the FT offices:

+ Follow Submit Comment

https://www.ft.com/stream/e58e66fe-7cc6-4382-b781-1161bae8b905

http://www.ft.com/cms/s/0473aa84-d657-11e8-ab8e-6be0dcf18713.html

http://www.ft.com/cms/s/f9ce2cd8-d5c2-11e8-a854-33d6f82e62f8.html

http://www.ft.com/cms/s/1b184f14-d69e-11e8-ab8e-6be0dcf18713.html

http://www.ft.com/cms/s/fca36400-d69e-11e8-ab8e-6be0dcf18713.html

http://www.ft.com/cms/s/0739f260-d697-11e8-a854-33d6f82e62f8.html

http://www.ft.com/cms/s/e7236410-d3cc-11e8-a9f2-7574db66bcd5.html

http://www.ft.com/servicestools/help/comments-policy

http://www.ft.com/servicestools/help/terms



Report

"Quick! post an article on how and why we share data before we get called out for it"

Share 2 Recommend Reply

2 hours ago

Report

Crowbar

and... this website page currently sends your data to...

amazonaws.com

cloudfront.net

doubleclick.net

fyre

various google

gravatar.com

storify.com

wp.com

Try the Ublock origin addon


1 hour ago

Report

Owlish

@Crowbar Also Noscript. Perhaps also Ghostery.


1 hour ago

Report

I am not a cyclist

@Owlish @Crowbar all good, may be Privacy Badger too.


1 hour agoIptegrity



Report

@Crowbar Thanks for this. Just curious - what happens if there's a hard Brexit? Do we

know whether any of this will be legal? Will it matter in what jurisdiction these apps are

located?

Share Recommend Reply

3 hours ago

Report

JPMit

These people seem to know a lot about this sort of thing

https://www.fsf.org/


4 hours ago

Report

Press5for

I rarely post comments; however the ft response that ft makes it easy to turn off tracking is simply

untrue. I counted at least 14 websites that needed to be visited; one of which says it needs to put

cookies on my device to turn off tracking !!!’ I agree with the comments by rationality. As I have

paid a subscription to the ft I expect it to be easy to turn off the tracking.

I will not be renewing my ft subscription unless the ft takes its responsibility seriously.


5 hours agoRationality

FT: Nonsense.

I use your app and website (clearly) - you do not make it easy to disable cookies. You provide 3

steps. The first step is easy enough, disable personalised cookies from you by selecting 'off'.

However step 2 involves going to multiple websites to read lots of policies and work out a way to

disable them - in fact for some you can't disable it!

Step 3 is similarly convoluted.

https://www.fsf.org/



Report

Look at your own doorstep and don't gloss over the fact your own privacy policy and 'opt out'

policies are absolutely ridiculous to the point that it's actually borderline impossible to rescind

permissions to all your third party links! Get some stats on how many people are even able to opt

out entirely: I suspect it's zero!


5 hours ago

Report

Rationality

Why don't you, FT, provide a single option: Accept all, manage some, deny all? Most

GDPR-compliant websites allow a 'decline all' cookies option.

I suspect your'e worried most of us will, to protect our privacy, choose 'decline all'!


4 hours ago

Report

me

@Rationality good point!


4 hours ago

Report

Rationality

Final point, which I omitted: the choices made on the FT cookie preferences section are

NOT maintained when browser cookies are cleared, when the app is shutdown on a

smartphone or when the FT subscriber account is signed into on another browser, even

another web browser on the same computer with identical external IP address; eg a

change from firefox to safari browser with account signed in. This means any preference

is temporary and not linked to the account, but instead limited to a single browser

session.

From guidance it is implied these settings are permanent, which is worse for maintaining

privacy, as users will think they have disabled tracking and advert personalisation from

yourself and numerous providers, whereas in actuality as soon as they reboot their

phone/computer/clear cookies then the settings reset to 'accept all' privacy invasions by

default once again, and so on.


3 replies



6 hours ago

Report

David Tallboys

Back to using an old 2g phone for calls and texts.

I'm not planning worldwide insurrection I'm just sick of all my stuff being shared around. It is like

coming home from work each day knowing that someone has been in the house looking though

the drawers and cupboards. It doesn't matter that everything is still there; it's just that it is now

tainted and unsavoury.


4 hours ago

Report

Rationality

@David Tallboys

To be fair, planning worldwide insurrection on an old Nokia brick would require such

powerful thumb prowess that anybody would surely give up after a few hours and pacify

themselves with a donut, if they could muster the coordination to lift it up with such

contorted muscular extremities; given the keypads on those old phones required regular

thumb exercises to enable one to write a full 160 character message - T9 or no T9.

Other baked goods for enjoyment do indeed exist, yes.


3 hours ago

Report

JHA1

I have noticed even if you avoid the main players you get trapped by unrelated websites

as everybody tries to obtain your data irrespective if that is their business. The terms

and conditions also require you to give up data making difficult to do anything

nowadays without being affected. It is terrible.


6 hours ago

Report

BillH

I have just had fibre installed: shocked by the swift delivery of movie style adverts with sounds ! I’m

paying for a better service to have the band width hijacked!


7 hours agoCustodia Legis



Report

First article I've read in ages that acknowledges 'data' are plural.


7 hours ago

Report

jspart

@Custodia Legis Agree but, ironically, shouldn't you say ""data" is plural" because you

are referring to a word, not "data" itself (otherwise I would have written "data"

themselves there).


7 hours ago

Report

praxis22

Before the hand wringing gets too advanced about the technological monster we have birthed, I

think people should stop and read this frankly amazing article from the NYT

https://www.nytimes.com/2009/05/17/magazine/17credit-t.html about credit card profiling.

What "old fashioned" credit card firms do to avoid bad debts from deadbeat borrowers.

If you want a look at what all the data being gathered will be used for, the future that that builds

then check "knights of the Rainbow Tables" an early bit of speculative fiction written by a

chronicler of such things, Cory Doctorow, in this case written for Intel:

https://www.intel.com/content/dam/www/public/us/en/documents/technology-briefs/intel-labs-tomorrow-project-rainbow-table-brief.pdf it's a great read too.

There are things you can do on Android, such as installing the xposed framework Which exists

below the level of the operating system, and intercept calls from it, etc. This allows you to do all

manner of things, from spoofing GPS locations, to actively blocking or redirecting traffic, etc. Most

people however would be better served by not succumbing to boredom that causes them to install

random junk, (as well as Facebook and Instagram) in the first place. but as we all know, "Grant me

chastity and continence, but not yet."


7 hours ago

Report

Casual Commentator

How did we survive in the early 2000s?


3 hours agoSmurf from Kent

https://www.nytimes.com/2009/05/17/magazine/17credit-t.html

https://www.intel.com/content/dam/www/public/us/en/documents/technology-briefs/intel-labs-tomorrow-project-rainbow-table-brief.pdf



Report

I think we just had more fun ......


8 hours ago

Report

protein for snorlax

Are we able to do GDPR requests to third party data intermediaries? Surely the regulation extends

to them as well, as its still our personal data that they hold and bring together.

Would be good if the FT could persue that as a line of investigation on how they react to such

requests


8 hours ago

Report

Asimon

apps : kick them before they kick you


8 hours ago

Report

Eyeball doc

Just looked on my iphone FT app, and in the generic iphone 'privacy' settings: no way to exclude

FT from gathering data, unlike what is claimed in the article.

But then : conflict of interest, FT!!


6 hours ago

Report

Esther Bintliff, FT FT

@Eyeball doc hi there, one of our product team has let me know that unfortunately this

is not available via your mobile but you can manage it on FT.com

via https://www.ft.com/preferences/privacy - and this will then apply across FT.com

and apps. Hope that helps


5 hours agoRationality

@Esther Bintliff, FT @Eyeball doc

Total nonsense Esther!

https://www.google.com/url?q=https://www.ft.com/preferences/privacy&sa=D&source=hangouts&ust=1540372435256000&usg=AFQjCNH21nWDbBVYQ-F76ied2nn2P-DoNA



Report

The setting is a cookie and so isn't maintained when the app is closed or the browser is

closed; this is on Apple IOS. You provide the most difficult and convoluted cookie-disable

setting from any newspaper media provider.

You provide 3 steps to disable all cookies. The first one is the temporary cookie (not

permanent, as you suggest), the second is a procedure to visit a lot of providers (or, as

you call them, 'partners') to then read their particular privacy policies and try to disable

them. These are only maintained on a 'session' basis - meaning if you go use another

computer, clear your cookies (as we are wont to do to maintain privacy and tracking

from said providers) then this privacy is NOT maintained or respected even within a

browser or within the app. It is not permanent individually or across the platforms. Does

this sound easy to you or not? That's right, it's not easy to maintain privacy and disable

sharing of data with FT third parties and you make it purposefully cumbersome.

Now: Can you please provide a comprehensive correct response on what you plan to do

about this? You and your team clearly do not really understand how cookies/GDPR

applies to you or how privacy works.


5 hours ago

Report

Eyeball doc

Thank you. I hope that this will be fixed quickly. As you can see, I am not the only one.

Regards


2 replies

8 hours agoViews From Nowhere

I don't sit up worrying about this all the time. My approach is to avoid as much as possible of the

junk on the web and stupid apps for phones. Some things are almost unavoidable however for the

convenience to me but if I go to extremes I could get by.

This behaviour tracking is supplemented of course by all the other lower tech stuff - loyalty cards

etc - that know what we are buying and when. At its basic level you can see that this is fairly

sensible business practice to make sure stores can plan but it is the other end where we are

basically little more than human IOT devices where the nasty stuff starts. It's one thing tempting

shoppers with a purchase they might like to want based on buying patterns, it's quite another

using this to profile people for political campaigns and targeted news.



Report

Life is complicated these days because of pervasive IT. It has helped in countless ways but as

usual, it opens the door to unscrupulous people without morals. As it has been shown, it is difficult

to separate their influence from the benefits we want from IT.


9 hours ago

Report

Steve Chandler

So they share data. So what? In exchange I get enterprise class email, office productivity tools, web

search, mapping, design tools etc. etc.

Nothing is for free. I accept the deal. Those who don’t wish to accept the exchange are free to go

without the considerable benefits that the likes of Google offer.


8 hours ago

Report

Dubh

@Steve Chandler They are compiling information on your school walk with your child

and selling it to the highest bidder. Is that the deal you support?


8 hours ago

Report

praxis22

@Dubh @Steve Chandler the GSM system does that anyway, it's how the phone system

knows which cell you're in to route your calls to you.


7 hours ago

Report

Steve Chandler

Should that data lead to improved road planning, intelligent street lighting, greater

pedestrian safety yes I am.


6 replies

9 hours agoMaru Kun

Credit should go to Private Eye for the spoof article along these lines:



Report

"Facebook Outraged at Hacker Data Theft: Facebook executives today condemned hackers that

stole and then sold personal data on 50 million Facebook users. "How dare they do this" enraged

Facebook executives said, "This is our core business. How dare these unscrupulous hackers

interfere".


9 hours ago

Report

CBil

"Facebook, Twitter and Amazon declined to comment."

Does that not say it all?


10 hours ago

Report

Praxis

I just read the paper cited by the article, the work shoud be completed with a field study on what

really happen not on what can happen. A more focused FT article will follow.


7 hours ago

Report

praxis22

@Praxis interesting username :)


10 hours ago

Report

LondonerJ

When we input all the apps we use, what does FT use the data for?

“Even just the characterisation of what apps you have on your phone is quite an insight into a

person’s life, you can learn information about their age, sexual orientation, health and link it back

to their device.”


10 hours agoLoggedOut

I used the tool in this article and found out Spotify COULD send data to various apps.



Report

However, the meaning of COULD needs to be explained otherwise IMO this sounds like scare

mongering.

Under which circumstances WILL the app share? This is what I want to know.


6 hours ago

Report

The World is Quiet

@LoggedOut Almost certainly articles like these are scare-mongering. Everything is

the evil companies' fault - absolutely no responsibility is placed on users who download

apps willy-nilly.


10 hours ago

Report

FTexplorer

Why can't this article be shared to non-subscribers?


9 hours ago

Report

Smurf from Kent

Coz the lads and ladettes writing the stuff need to make money ....


9 hours ago

Report

FTexplorer

@Smurf from Kent Of course. I'm a full subscriber which includes and I can email 20 free

articles per month to non-subcribers on all other articles.


7 hours ago

Report

Esther Bintliff, FT FT

@FTexplorer @Smurf from Kent good question re: gifting the article to others - let us

look into it and come back to you asap


1 reply

Show more comments



Show more comments

how smartphone apps track users and share data te chnolo gy...s h o w w h o g e t s t h e s e a p p...

Documents