Breaking News

Remove these Android apps that are sending data to Facebook without your permission!

by VARINDIA 2019-01-02

A report published by a global organization - Privacy International has found that at least 20 Android apps are sending user data to Facebook, within one second of opening and are accessed on a phone even before the users can be asked for permission. This data is sent without user knowledge or user consent and ranges from innocuous to personal. This practice obviously raises some questions of legality, although it is difficult to say who is to blame for the violation of user privacy. Privacy International have tested 34 Android apps with an install base greater than 10 million users. This data is sent regardless of whether or not the user has a Facebook account and occurs immediately without notifying the user or asking for consent to send the data.

After the the Cambridge Analytica scandal, the landscape of online privacy has drastically changed. Users have been made more aware of exactly how they are being tracked by companies like Google and Facebook, and lawmakers have tried to combat invasive tracking with efforts like GDPR. Despite all these efforts to curtail companies’ surreptitiously keeping tabs on their user base (and even non-users), it doesn’t seem that the big players in take care of personal data.

For the most part, this data is simply a trigger that the app has been opened and Facebook’s Software Development Kit (SDK) has been initialized. However, some apps also send personal data, such as user location, family size, whether or not the user has children, gender, and more. All of this data is tied to a specific Google advertising ID (AAID). This can potentially create a profile of the user based on their app usage.

Facebook is placing the blame squarely at the feet of app developers. In an email to Privacy International, Facebook said that developers have long had the option to fully disable the automatic transmission of event logging and that the update (made in June of this year) gives developers better control over implementing event logging in a way that complies with GDPR. In responses sent to PI, many app developers stated they were unaware of the problems and will work to update their applications to better comply with privacy law. It’s possible that these app developers were ignorant of how the Facebook SDK was tracking users automatically and instantaneously without consent. It’s also possible that these app developers are simply playing dumb now that they’ve been caught.

In reality, it’s likely that both Facebook and the app developers should share responsibility. On the one hand, Facebook has a reputation for tracking users and non-users in any way possible and may not have encouraged app developers of the updates to their SDK (or made the updates obvious). On the other, app developers are responsible for complying with user data protection laws in every region in which their apps are distributed.

It should be noted that the iOS versions send similar datasets to Facebook, but due to the way that Apple’s advertising IDs work, user consent must first be given. In that vein, iOS apps still track user data but are unable to send it on to Facebook without notifying the user and asking for consent.

Here is a full list of the apps tested. The following 20 bold ones are sending immediate data -

* Bible

* BMI Calculator and weight tracker

* Calorie Counter - MyFitnessPal

* Candy Crush

* Clean Master

* Dropbox

* Duolingo

* Family Locator GPS Tracker

* HP ePrint

* Indeed Job Search

* Instant Heart Rate: Heart Rate & Pulse Monitor