I think the "the data was supposed to be stored on the phone" thing is a little misleading. I've never owned a Huawei phone, butwhen I looked at my Motorola ph

I think the "the data was supposed to be stored on the phone" thing is a little misleading. I've never owned a Huawei phone, butwhen I looked at my Motorola phone five years ago[1], I found that it was getting Facebook data via a proxy service that Motorola had set up. This was probably partly as an abstraction layer, but do you really think no one in their marketing (or similar) department thought "as long as that data about their FB contacts is passing through our systems, maybe we should analyze it in some way"? Even if they weren't explicitly collecting it, it probably ended up cached on their servers somewhere, and it was typically sent over plaintext HTTP (even though FB supported HTTPS), so someone else could have easily collected it too. I've looked at a lot of mobile apps, and I don't think what Motorola was doing was at all unusual, but again, I haven't done a comprehensive analysis of other vendors. I do agree that the vendor could always configure the phone to explicitly upload anything to them even if something like the FB APIs were accessed directly, but IMO that seems less likely than siphoning off the data as it passes through their middleware. [1] https://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html https://www.beneaththewaves.net/Projects/Motorola_Is_Listeni...