Same problem with Facebook login and many other commonly used libs. The default setup is always set to be as permissive as possible. At some point we need to un

Same problem with Facebook login and many other commonly used libs. The default setup is always set to be as permissive as possible. At some point we need to understand this is deliberate and fine the companies for not having GDPR complaint products (in default configuration) Edit: to answer your question, a British privacy organisation tested this on mobile apps and found that almost all were using third party components with default configuration that would phone home. This is btw why I closed my Spotify account. Not sure if they have fixed it now but back then it contacted Facebook regularly despite me not using Facebook login and turning off all analytics. Researcher found that this was due to premissive defaults. Now if Spotify can't get it right, I don't think your average startup can either. Hence the problem should be fixed at the root. Edit 2: https://privacyinternational.org/report/2647/how-apps-android-share-data-facebook-report https://privacyinternational.org/report/2647/how-apps-androi...