8 ms·

Stop tracking me: Austrian citizen files complaint over Android Advertising ID

177 points by newsreview1 6y ago

kerng 6y ago
Surprised that Google didn't take proper pre-cautions here to not run into this. If there is indeed such an identifier, enabled by default its pretty obvious that its technically possible to track a user. And with all the other data Google has, they also can link to the actual identity pretty easily.
- JadeNB 6y ago
  Surely it's easier for Google to ask forgiveness than permission. Why wouldn't they do this if they want to track you, especially if they can muster even a shred of plausible deniability to allow them to keep it in place longer?
  - thoraway1010 6y ago
    Plausible deniability? They put it there so you can be tracked - that is what it is for. Have you confirmed that the click through agreements and privacy policies don't mention anything like this?
    - JadeNB 6y ago
      > Have you confirmed that the click through agreements and privacy policies don't mention anything like this? No …? I'm not sure why I would have; I was just responding to @kerng's surprise at its presence (https://news.ycombinator.com/item?id=23180801 https://news.ycombinator.com/item?id=23180801).
  - PeterisP 6y ago
    It's not easier to ask forgiveness than permission - asking permission is free but having to 'ask forgiveness' under GDPR if you've intentionally not asked permission may involve fines up to 4% of annual global turnover which comes out to something like 6 billion dollars for google.
    - JadeNB 6y ago
      It is easier, at least in the short term, because it gets right away to that tracking sweetness. It might be regretted in the long term, although global companies don't seem to be taking GDPR seriously yet, probably because they don't sufficiently fear the enforcing bodies. (Let's see those consent walls come down first.) In the meantime, who knows how much Google made off the tracking information that they got this way?
- LargoLasskhyfv 6y ago
  There is no if ! https://developers.google.com/android/reference/com/google/android/gms/ads/identifier/AdvertisingIdClient https://developers.google.com/android/reference/com/google/a... https://support.google.com/admanager/answer/6274238?hl=en https://support.google.com/admanager/answer/6274238?hl=en
- izacus 6y ago
  The identifier itself it made to track the user by 3rd party apps, so it's pretty clear why its there :) Apple provides the exact same API - https://developer.apple.com/documentation/adsupport/asidentifiermanager https://developer.apple.com/documentation/adsupport/asidenti... although IIRC it manages it better (users can revoke it, but it's on by default). I wonder why Google is singled out here though - if Apple is also mining our data, they should also be on the hook. I wonder if all other OS vendors could be fined as well because the OSes are full of tracking identifiers - device MACs, device install identifiers, serial numbers, etc. There's plenty of apps out there that use those identifiers to track user behaviour.
  - greglindahl 6y ago
    Apple's identifier can't be turned off; you can manually change it as often as you like, but it involves enough clicks that I bet few people do.
    - gingerlime 6y ago
      It can be turned off (although I think under the hood they just send zeros). But it’s on by default. https://blog.gingerlime.com/2020/does-apple-care-about-your-privacy/ https://blog.gingerlime.com/2020/does-apple-care-about-your-... EDIT also https://support.apple.com/en-us/HT202074 https://support.apple.com/en-us/HT202074
      - als0 6y ago
        I don't interpret "Limit Ad Tracking" as "off". As another comment mentioned, the only effective mechanism is to reset the identifier periodically. That's not a disable mechanism, though.
        weswpg 6y ago
        > When Limit Ad Tracking is enabled on iOS 10 or later, the Advertising Identifier is replaced with a non-unique value of all zeros to prevent the serving of targeted ads. It is automatically reset to a new random identifier if you disable Limit Ad Tracking. Shouldn't that be enough?
- m463 6y ago
  if you posit that google is an identification service, and they have lots of machine learning experts... why can't google train a neural net on each person they've gathered data on and track them using a custom model?
chipperyman573 6y ago
For anyone complaining about this: the advertising ID is a very good thing for us tech people Nobody know how to change it or turn it off. That means a lot of developers and advertisers assume it is actually a good way to track users. So if you go in and reset/disable it, you'll be in such a small minority that you'd become an edge case and they'd lose the historical data on you. Obviously this isn't true 100% of the time but if it didn't exist then advertisers would use a hardware fingerprint probably, which is a lot harder to spoof
- Nextgrid 6y ago
  There's no reason they can't do both especially considering privacy-conscious people and those adverse to advertising are the very people advertisers would pay a lot of money to reach.
  - xthreen 6y ago
    People who avoid ads aren't even considered a target audience. They exercise too much critical thinking for advertisers who want to grab people by the feels and get them to buy their product for a dopamine rush.
    - twox2 6y ago
      This isn't true for publishers. They want everyone to see ads so they can get paid.
      - xthreen 6y ago
        Thanks for the added perspective, you're definitely correct. Measuring penetration is a big deal for price setting ad space. Even still, it doesn't seem to push Google to include their Ad ID system in AOSP instead of the Play Store. They could have forced ROM developers to go digging for the API to remove it.
        TeMPOraL 6y ago
deleted 6y ago
[deleted]
ckastner 6y ago
The title should have mentioned the person by name: it's Max Schrems [1]. He has a legal background, and has fought a number of high-profile privacy cases in Europe. The day the GDPR came into effect, he filed violations complaints against Facebook and Google in four different jurisdictions. He's a spearhead figure in this regard. [1] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
- dewey 6y ago
  I already knew it was him when reading the headline, weird that they skipped over that. It's kind of a household name if you are at all interested in privacy or are aware of the Facebook privacy issues at this point.
- chrisseaton 6y ago
  > The day the GDPR came into effect, he filed violations complaints against Facebook and Google in four different jurisdictions. When people do this it comes across as malicious harassment rather than a genuine legal complaint for harm caused. Why so many jurisdictions, and why on the very day it came into effect?
  - foepys 6y ago
    Oh no, somebody save Google, please. A single lawyer is harassing this poor trillion dollar company. He has any right to use all existing laws to file complaints. When a new law is being introduced it should be followed immediately, especially when it impacts the lives of many. Would you argue that a speeding ticket is harassment when the fines were raised just the day before? No, you wouldn't because that would be ridiculous.
    - chrisseaton 6y ago
      > When a new law is being introduced it should be followed immediately, especially when it impacts the lives of many. Would you argue that a speeding ticket is harassment when the fines were raised just the day before? When there's a new law or a new speeding limit on an existing road the police do usually spend a while just politely warning people about it before they charge anyone. He's an activist. Not someone who's genuinely been harmed and seeking a legal resolution as a last resort after trying to resolve in good faith first.

177 points by newsreview1 6y ago

Surprised that Google didn't take proper pre-cautions here to not run into this. If there is indeed such an identifier, enabled by default its pretty obvious that its technically possible to track a user. And with all the other data Google has, they also can link to the actual identity pretty easily.

JadeNB 6y ago
Surely it's easier for Google to ask forgiveness than permission. Why wouldn't they do this if they want to track you, especially if they can muster even a shred of plausible deniability to allow them to keep it in place longer?
- thoraway1010 6y ago
  Plausible deniability? They put it there so you can be tracked - that is what it is for. Have you confirmed that the click through agreements and privacy policies don't mention anything like this?
  - JadeNB 6y ago
    > Have you confirmed that the click through agreements and privacy policies don't mention anything like this? No …? I'm not sure why I would have; I was just responding to @kerng's surprise at its presence (https://news.ycombinator.com/item?id=23180801 https://news.ycombinator.com/item?id=23180801).
- PeterisP 6y ago
  It's not easier to ask forgiveness than permission - asking permission is free but having to 'ask forgiveness' under GDPR if you've intentionally not asked permission may involve fines up to 4% of annual global turnover which comes out to something like 6 billion dollars for google.
  - JadeNB 6y ago
    It is easier, at least in the short term, because it gets right away to that tracking sweetness. It might be regretted in the long term, although global companies don't seem to be taking GDPR seriously yet, probably because they don't sufficiently fear the enforcing bodies. (Let's see those consent walls come down first.) In the meantime, who knows how much Google made off the tracking information that they got this way?
LargoLasskhyfv 6y ago
There is no if ! https://developers.google.com/android/reference/com/google/android/gms/ads/identifier/AdvertisingIdClient https://developers.google.com/android/reference/com/google/a... https://support.google.com/admanager/answer/6274238?hl=en https://support.google.com/admanager/answer/6274238?hl=en
izacus 6y ago
The identifier itself it made to track the user by 3rd party apps, so it's pretty clear why its there :) Apple provides the exact same API - https://developer.apple.com/documentation/adsupport/asidentifiermanager https://developer.apple.com/documentation/adsupport/asidenti... although IIRC it manages it better (users can revoke it, but it's on by default). I wonder why Google is singled out here though - if Apple is also mining our data, they should also be on the hook. I wonder if all other OS vendors could be fined as well because the OSes are full of tracking identifiers - device MACs, device install identifiers, serial numbers, etc. There's plenty of apps out there that use those identifiers to track user behaviour.
- greglindahl 6y ago
  Apple's identifier can't be turned off; you can manually change it as often as you like, but it involves enough clicks that I bet few people do.
  - gingerlime 6y ago
    It can be turned off (although I think under the hood they just send zeros). But it’s on by default. https://blog.gingerlime.com/2020/does-apple-care-about-your-privacy/ https://blog.gingerlime.com/2020/does-apple-care-about-your-... EDIT also https://support.apple.com/en-us/HT202074 https://support.apple.com/en-us/HT202074
    - als0 6y ago
      I don't interpret "Limit Ad Tracking" as "off". As another comment mentioned, the only effective mechanism is to reset the identifier periodically. That's not a disable mechanism, though.
      - weswpg 6y ago
        > When Limit Ad Tracking is enabled on iOS 10 or later, the Advertising Identifier is replaced with a non-unique value of all zeros to prevent the serving of targeted ads. It is automatically reset to a new random identifier if you disable Limit Ad Tracking. Shouldn't that be enough?
m463 6y ago
if you posit that google is an identification service, and they have lots of machine learning experts... why can't google train a neural net on each person they've gathered data on and track them using a custom model?

chipperyman573 6y ago

For anyone complaining about this: the advertising ID is a very good thing for us tech people Nobody know how to change it or turn it off. That means a lot of developers and advertisers assume it is actually a good way to track users. So if you go in and reset/disable it, you'll be in such a small minority that you'd become an edge case and they'd lose the historical data on you. Obviously this isn't true 100% of the time but if it didn't exist then advertisers would use a hardware fingerprint probably, which is a lot harder to spoof

Nextgrid 6y ago
There's no reason they can't do both especially considering privacy-conscious people and those adverse to advertising are the very people advertisers would pay a lot of money to reach.
- xthreen 6y ago
  People who avoid ads aren't even considered a target audience. They exercise too much critical thinking for advertisers who want to grab people by the feels and get them to buy their product for a dopamine rush.
  - twox2 6y ago
    This isn't true for publishers. They want everyone to see ads so they can get paid.
    - xthreen 6y ago
      Thanks for the added perspective, you're definitely correct. Measuring penetration is a big deal for price setting ad space. Even still, it doesn't seem to push Google to include their Ad ID system in AOSP instead of the Play Store. They could have forced ROM developers to go digging for the API to remove it.
      - TeMPOraL 6y ago

deleted 6y ago

[deleted]

ckastner 6y ago

The title should have mentioned the person by name: it's Max Schrems [1]. He has a legal background, and has fought a number of high-profile privacy cases in Europe. The day the GDPR came into effect, he filed violations complaints against Facebook and Google in four different jurisdictions. He's a spearhead figure in this regard. [1] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems

dewey 6y ago
I already knew it was him when reading the headline, weird that they skipped over that. It's kind of a household name if you are at all interested in privacy or are aware of the Facebook privacy issues at this point.
chrisseaton 6y ago
> The day the GDPR came into effect, he filed violations complaints against Facebook and Google in four different jurisdictions. When people do this it comes across as malicious harassment rather than a genuine legal complaint for harm caused. Why so many jurisdictions, and why on the very day it came into effect?
- foepys 6y ago
  Oh no, somebody save Google, please. A single lawyer is harassing this poor trillion dollar company. He has any right to use all existing laws to file complaints. When a new law is being introduced it should be followed immediately, especially when it impacts the lives of many. Would you argue that a speeding ticket is harassment when the fines were raised just the day before? No, you wouldn't because that would be ridiculous.
  - chrisseaton 6y ago
    > When a new law is being introduced it should be followed immediately, especially when it impacts the lives of many. Would you argue that a speeding ticket is harassment when the fines were raised just the day before? When there's a new law or a new speeding limit on an existing road the police do usually spend a while just politely warning people about it before they charge anyone. He's an activist. Not someone who's genuinely been harmed and seeking a legal resolution as a last resort after trying to resolve in good faith first.