Three quarters of Android apps track users with third party tools

I'm not too much in the know about Android permissions. I know it improved a lot lately but I think still some permissions are still accepted silently on install.

Gathering data about the movements of your users within your application can really be helpful, I draw the line where things get shared with third parties or excessive data is gathered.

Try launching one of the top games with XPrivacy installed. You get to click allow for the dev's server and block to 5+ 3rd party analytics, crash reporting and ad services. I'm sure many of these provide developer value, but there's definitely a harm to user privacy.

The people conducting the analytics are doing it 'for the right reasons'. The people being analysed don't trust anyone to do anything 'for the right reasons' or without some amount of scope creep around the edges of 'the right reasons'. Self versus someone else. I've got the best intentions, but I don't think anyone else has.

It touches on the theory of: if a company was a person it would have the traits of a psychopath / sociopath. The ends justifies the means. Grow the business, and analytics is the best way to do it, or to visualise the progress and adjust the method.

Human as part of the business: We gotta do these things to give ourselves the greatest chance of success

Human as consumer of app: Why would they possibly need access to THAT?

There are definitely multi-personalities involved. WHich seems increasingly normal. Wasn't there an HN article on that recently?

The brain is a denial-machine. It enables hypocrisy, and I can only theorise that this is due to our inability to survive if that wasn't the case.

To be a successful marketer in this day and age, proper analytics is a non-negotiable requirement. If I was interviewing somewhere and they told me that I had to market and advertise for an app or website, but that I couldn't track things, that would be the end of that discussion. I would be set up for failure from day one. If anyone wants to make a case otherwise, I'd ask that they share their credentials as someone sufficiently experienced and qualified to make such a case, and how they would go about being successful without that data when pretty much any significant digital (or non-digital to an extent) strategy these days requires that data to measure success and optimize for it.

So there's that piece.

As an end-user, this is often a source of cognitive dissonance for me, and it has grown over the years. 8+ years ago, I had very different feelings when people talked to me about what was being tracked and how it was being used. It was less audience-centric, cross-device/channel tracking was not really a thing yet, and we didn't have anywhere near the aggressive tracking that FB and Google have today (even though some of the first signs of that were showing up publicly perhaps).

Today I'm pretty paranoid about the data out there, who has access to it, and how that data can be used, both for anti-competitive business purposes, as well as more nefarious uses, even if unintended (such as via a data breach). I run noscript at home, and Firefox with uBlock Origin at home and on my phone.

I personally don't have an issue with people collecting usage data for improving the product and their business, but there's a weird gray area for me when they start using that data against me for things like dynamic pricing, dark patterns, selling email hashes to cookie onboarding services for retargeting, etc. I also recognize that while I may not have much to hide, I know I'm pretty lucky in that regard compared to others who may not want to be identified by certain means, and I fully respect and appreciate their desires to remain untracked in that way.

For example, I am pretty upset at how Reddit is moving towards increased tracking and verification as they march towards heavier monetization. That's an example of a community with many people who NEED to remain untracked for safety purposes, and that data, were it to fall into the wrong hands, could prove dangerous for them. Likewise, the simple act of forcing the collection of it could turn them away from such a platform which could indirectly cause them harm (suicidal users seeking help, abuse victims, whistle-blowers, etc.).

So where do I net out with all of this and how do I sleep at night? Well, for my part I do what I can to be sensitive to protecting PII, not collecting data that I'm likely to never need, and really weighing heavily the tradeoffs and risks when I implement something like the Google or FB tracking tags anywhere, and what I may pass into them. I also make an effort to set the record straight and educate people on what I know of tracking, and how to best limit collection if you are concerned, because I think it is something everyone should be educated about so they can make those decisions in an informed matter themselves.

I respect that some people hate my profession and think I'm evil, and I'm never going to win those people over, nor do I really feel the need to. But I'll say that to be competitive with marketing a product or service in this day and age, you dramatically hurt your chances of success if you DON'T have some decent tracking, and so the realities of the situation often dictate what happens in many businesses. My guess is the people who have such black and white views haven't ever been tasked with marketing a product in a true professional capacity, and if they have I'd love to hear their stories and what led them to their views.

We're not trying to sell the user, or their data. We just want to know which features are being used and whether or not it's meeting our performance criteria, thus doing the user a favor by meeting those criteria.

We really need to get over this notion that developer time is the most important thing in the world, it's having negative affects on privacy, performance and probably more. Gigabytes of usage data is really not that much anyway, but even if it is, you don't need to track every single user, just a representative sample.

And don't forget the age old option of not doing analytics, except for marketing purposes I've rarely seen analytics provide more value than it's worth.

I came to say exactly this

Mobile engineer here, I don't know any mobile app without some form of tracking because at the very least you want to know when your app crashes and have a way to get the stacktrace.

Enter firebase crashreporting / crashlytics

The problem is your development process is not capable of producing stable enough software. I don't know why that's the case, but you should work on that first.

Deming: "Inspection does not improve the quality, nor guarantee quality. Inspection is too late. The quality, good or bad, is already in the product. As Harold F. Dodge said, “You can not inspect quality into a product"". This goes even more for crash-reporting quality into a product.

We don't care who tapped button A instead of button B, we just want to know how many people tapped button A instead of button B.

Given IP addresses, device identifiers, application identifiers, and timestamps - these 3rd party applications now have some pretty valuable signals that can be aggregated with other signals from other tracking methods to create a detailed profile linking users across devices, browsers, and geo locations.

These "free" analytics services have a dark side. The price for using them is that they get to build profiles of your users, with varying degrees of invasiveness. And once you sign up with them, you are selling out your users.

I also wouldn't use Crashlytics due to a study that we've conducted in the last 3 months on 200 of the most used apps in Germany. We have collected real network traffic with a setup consisting of Wireshark and sslsplit (https://github.com/droe/sslsplit). We have discovered that Crashlytics will send GPS location data alongside bug reports. Probably it tries to collect as much data as possible.

Not really a solution, seen in that light, is it?

https://github.com/exodus-privacy/exodus

https://github.com/YalePrivacyLab/tracker-profiles

From my anecdotal experience I can tell you that whatever data we collect on Android we collect on iOS too (crashes, usage, etc) .

Or, set up virtual desktops that people can connect to that also use VPNs that could allow people to originate their traffic from a given region.

I'm primarily interested in created a sanitized stream more than anything. People have a right to surf without being tracked.

- AOSP email client

- Silence

- F-droid

- Simon Tatham's Portable Puzzle Collection

I don't think any of those are tracking my behaviour.