5 ms·

Buy a phone, get a tracker: unauthorized tracking code on Android

57 points by Daho0n 6y ago

deleted 6y ago
[deleted]
loa_in_ 6y ago
It's not unauthorized. You are presented with terms while setting up your smartphone for the first time. This article also sounds like GPT generated text optimized for mild outrage. It offers nothing substantial to the issue
- anticristi 6y ago
  I was definitely not asked for consent on being tracked online for advertisement purposes. Consent needs to be explicit, specific, unambiguous and freely given. Hiding this behind sugar coated language is illegal in the EU. I very much appreciate the work on NOYB to remind companies that privacy is not optional. P.S. While "building something useless" is not illegal, I find the usage of this information shitty. "You bought X, we'll display ads for X for the next two weeks." How likely is one to buy another bike? Or another pram? Why is the AdTech industry insisting on collecting information that it can't use and is invasive?
  - kllrnohj 6y ago
    The complaint isn't that you're actually being tracked nor that the ID is being used without your consent. The complaint is that the (resettable) ID exists at all. These IDs (Android and iOS) were introduced to push apps off of using globally unique device identifiers that couldn't be reset like the IME number. They were a massive improvement over what previously existed, and on their own don't do any tracking nor contain any user data. This complaint feels like it's a stretch, and if the complaint succeeds the inevitable alternative is much worse for users.
    - throwaway3699 6y ago
      It's like the cookie dilemma. Get rid of them and fingerprinting will become the norm (and user's lose the ability to reset them). I don't know how much fingerprinting you can be done within a JVM, but I imagine it's a lot.
      - anticristi 6y ago
        Just as no amount of technical implementation will save the environment, I now believe that no amount of technical implementation (by itself) will enable privacy. GDPR is clear: Any data that allows an individual to be directly or indirectly identified is personal data. Fines are now targeting "lower hanging fruits", i.e., more obvious violations. However, as the landscape shifts, I'm looking forward to the first fine related to non-consented fingerprinting.
        kllrnohj 6y ago
        But right now they aren't targeting improper usage of identifying data, but instead that identifying data exists at all. This doesn't seem like a GDPR violation at all?
        anticristi 6y ago
        Collection of identifying data also needs consent. It would be perfectly legal to have an AAID and never disclose it to anyone, but that wouldn't be very useful. :)
        kllrnohj 6y ago
        Right, but they aren't complaining about collection of identifying data. Google/Android (or iOS) isn't collecting the AAID themselves in an unauthorized way. The complaint is purely that the AAID is generated, fully independent of whether or not it's ever used.
        6y ago
  - TeMPOraL 6y ago
    > Why is the AdTech industry insisting on collecting information that it can't use and is invasive? - The "dumb" approach to targeted advertising is good enough, they're stuck in a local minimum. When they try to be more clever, ROI drops. - That might change in the future, so it's better to have the data than to not have it. - A lot of that data is also useful for the problem of ad attribution - i.e. determining who should be paid and how much if a person buys something somewhere (possibly off-line).
- Daho0n 6y ago
  If you read it you would know it isn't a debate post but information about a Complaint filed to the Data Protection Authority by someone who has done so against big corps before and won multiple times. This will likely end up with both Apple and Google getting fined by the EU. Again.
pixelpanic360 6y ago
WOW Awesome!! Android is so freedom that freedom until they cannot reset ad ID! wow this is the freedom I want!
- curiousgal 6y ago
  And the alternative is? iOS? Apple is also tracking its users, to a greater extent even. At least on Android you can still block ads, block internet access to apps you don't trust and flash custom ROMs.
  - new299 6y ago
    You can turn off tracking on iOS: https://www.forbes.com/sites/kateoflahertyuk/2020/11/16/apple-iphone-tracking-heres-how-to-turn-it-off/?sh=68d35a723398 https://www.forbes.com/sites/kateoflahertyuk/2020/11/16/appl...
    - pixelpanic360 6y ago
      yes the so-called walled system DO let user to reset ad if and switch off tracking. While to so-called freedom system doesn’t do any of this. I will see this as hypocritical
      - Daho0n 6y ago
        Your English is hard to understand. But you can reset the ID in Android too.
    - fsflover 6y ago
      Tracking should be opt-in, not opt-out.
  - Bud 6y ago
    No, Apple is not tracking its users to a greater extent. You wish that were true, clearly, but you can't support it. As for "flashing custom ROMs", well, if you could support your main argument, you wouldn't be trying to change the subject three times.
bwindels 6y ago
You can only do recurring donations, no thank you.
- noja 6y ago
  You can donate once for a year, and cancel.
  - fsflover 6y ago
    Still inconvenient.
SMAAART 6y ago
What about installing https://lineageos.org/ https://lineageos.org/ ? Does it matter the choice of hardware? Does it matter if one were to use google services on lineageos ?
superkuh 6y ago
Of course. All cell phones are inherently trackers. That is how the cell phone system works at all. The base stations use increasingly accurate clocks to multi-laterate the handset position and decide which base station will handle it. This is accurate to about 50m these days. And since a handset pings out it's existence every 30s or so while it's on and telcos store the data for 2-5 years (in the USA) they have a very accurate record of your movements to sell for commercial profit. And then those companies can re-sell the data to the government. The idea that anything you do in the userspace of a phone can make you 'safe' from tracking is just ignorant. The greatest danger will always be the baseband modem which you will never have acess or control of due to FCC regulations.
- vbezhenar 6y ago
  And new wireless standards AFAIK require very precise antenna focusing which provides even more accurate locations.
merricksb 6y ago
Related discussion a few days ago: https://news.ycombinator.com/item?id=26723355 https://news.ycombinator.com/item?id=26723355
smitty1e 6y ago
Face it: the modern coveniences come at the expense of the users becoming the product.

57 points by Daho0n 6y ago

deleted 6y ago

[deleted]

It's not unauthorized. You are presented with terms while setting up your smartphone for the first time. This article also sounds like GPT generated text optimized for mild outrage. It offers nothing substantial to the issue

anticristi 6y ago
I was definitely not asked for consent on being tracked online for advertisement purposes. Consent needs to be explicit, specific, unambiguous and freely given. Hiding this behind sugar coated language is illegal in the EU. I very much appreciate the work on NOYB to remind companies that privacy is not optional. P.S. While "building something useless" is not illegal, I find the usage of this information shitty. "You bought X, we'll display ads for X for the next two weeks." How likely is one to buy another bike? Or another pram? Why is the AdTech industry insisting on collecting information that it can't use and is invasive?
- kllrnohj 6y ago
  The complaint isn't that you're actually being tracked nor that the ID is being used without your consent. The complaint is that the (resettable) ID exists at all. These IDs (Android and iOS) were introduced to push apps off of using globally unique device identifiers that couldn't be reset like the IME number. They were a massive improvement over what previously existed, and on their own don't do any tracking nor contain any user data. This complaint feels like it's a stretch, and if the complaint succeeds the inevitable alternative is much worse for users.
  - throwaway3699 6y ago
    It's like the cookie dilemma. Get rid of them and fingerprinting will become the norm (and user's lose the ability to reset them). I don't know how much fingerprinting you can be done within a JVM, but I imagine it's a lot.
    - anticristi 6y ago
      Just as no amount of technical implementation will save the environment, I now believe that no amount of technical implementation (by itself) will enable privacy. GDPR is clear: Any data that allows an individual to be directly or indirectly identified is personal data. Fines are now targeting "lower hanging fruits", i.e., more obvious violations. However, as the landscape shifts, I'm looking forward to the first fine related to non-consented fingerprinting.
      - kllrnohj 6y ago
        But right now they aren't targeting improper usage of identifying data, but instead that identifying data exists at all. This doesn't seem like a GDPR violation at all?
        anticristi 6y ago
        Collection of identifying data also needs consent. It would be perfectly legal to have an AAID and never disclose it to anyone, but that wouldn't be very useful. :)
        kllrnohj 6y ago
        Right, but they aren't complaining about collection of identifying data. Google/Android (or iOS) isn't collecting the AAID themselves in an unauthorized way. The complaint is purely that the AAID is generated, fully independent of whether or not it's ever used.
        6y ago
- TeMPOraL 6y ago
  > Why is the AdTech industry insisting on collecting information that it can't use and is invasive? - The "dumb" approach to targeted advertising is good enough, they're stuck in a local minimum. When they try to be more clever, ROI drops. - That might change in the future, so it's better to have the data than to not have it. - A lot of that data is also useful for the problem of ad attribution - i.e. determining who should be paid and how much if a person buys something somewhere (possibly off-line).
Daho0n 6y ago
If you read it you would know it isn't a debate post but information about a Complaint filed to the Data Protection Authority by someone who has done so against big corps before and won multiple times. This will likely end up with both Apple and Google getting fined by the EU. Again.

pixelpanic360 6y ago

WOW Awesome!! Android is so freedom that freedom until they cannot reset ad ID! wow this is the freedom I want!

curiousgal 6y ago
And the alternative is? iOS? Apple is also tracking its users, to a greater extent even. At least on Android you can still block ads, block internet access to apps you don't trust and flash custom ROMs.
- new299 6y ago
  You can turn off tracking on iOS: https://www.forbes.com/sites/kateoflahertyuk/2020/11/16/apple-iphone-tracking-heres-how-to-turn-it-off/?sh=68d35a723398 https://www.forbes.com/sites/kateoflahertyuk/2020/11/16/appl...
  - pixelpanic360 6y ago
    yes the so-called walled system DO let user to reset ad if and switch off tracking. While to so-called freedom system doesn’t do any of this. I will see this as hypocritical
    - Daho0n 6y ago
      Your English is hard to understand. But you can reset the ID in Android too.
  - fsflover 6y ago
    Tracking should be opt-in, not opt-out.
- Bud 6y ago
  No, Apple is not tracking its users to a greater extent. You wish that were true, clearly, but you can't support it. As for "flashing custom ROMs", well, if you could support your main argument, you wouldn't be trying to change the subject three times.

bwindels 6y ago

You can only do recurring donations, no thank you.

noja 6y ago
You can donate once for a year, and cancel.
- fsflover 6y ago
  Still inconvenient.

SMAAART 6y ago

What about installing https://lineageos.org/ https://lineageos.org/ ? Does it matter the choice of hardware? Does it matter if one were to use google services on lineageos ?

superkuh 6y ago

Of course. All cell phones are inherently trackers. That is how the cell phone system works at all. The base stations use increasingly accurate clocks to multi-laterate the handset position and decide which base station will handle it. This is accurate to about 50m these days. And since a handset pings out it's existence every 30s or so while it's on and telcos store the data for 2-5 years (in the USA) they have a very accurate record of your movements to sell for commercial profit. And then those companies can re-sell the data to the government. The idea that anything you do in the userspace of a phone can make you 'safe' from tracking is just ignorant. The greatest danger will always be the baseband modem which you will never have acess or control of due to FCC regulations.

vbezhenar 6y ago
And new wireless standards AFAIK require very precise antenna focusing which provides even more accurate locations.

merricksb 6y ago

Related discussion a few days ago: https://news.ycombinator.com/item?id=26723355 https://news.ycombinator.com/item?id=26723355

smitty1e 6y ago

Face it: the modern coveniences come at the expense of the users becoming the product.