Irish researchers from Trinity College in Dublin have found that Google starts tracking devices based on Android as soon as they are turned on, storing identifiers, cookies, and other data without user consent even if pre-installed applications are never opened.
This discovery contradicts Google’s recent efforts to increase transparency, such as the planned ban on Cookies in Chrome, as it appears that Android device owners are still being monitored. Google Play and Play Services were identified as key players in this data collection system.
This information is especially pertinent in light of the recent Safetycore scandal, involving a module installed on millions of Android smartphones without user knowledge. Despite user backlash, Google has not provided a way to disable this function, and similarly, it is not possible to opt out of the surveillance highlighted by the researchers.
In a report by Trinity College, it is revealed that Google is tracking advertising clicks and views of ads using the Android ID identifier, which can be linked to specific users and devices. Factory resetting a smartphone does not eradicate this surveillance as data continues to be collected.
Google recently permitted developers to utilize “digital prints” to identify users again, a practice previously banned due to its irremovable nature. These actions are in contradiction to Google’s statements in 2019 regarding user privacy rights.
Questions arise as to how Google’s actions align with data protection laws such as the European Directive E-Privacy and GDPR. The stringent requirements for data collection and processing in EU countries, including Ireland where the study was conducted, could lead to legal challenges. The E-Privacy Directive stipulates that data storage on a device is only permissible with explicit user consent unless it is essential for the requested service.
Google responded to the study findings by asserting compliance with data protection laws and dismissing the report’s legal interpretations as inaccurate. The company has no plans to make changes to the operations of Play Services and Play Store in response.
This is not the first time Trinity College has criticized Google for data collection practices, as researchers previously reported on the privacy risks associated with Android apps capturing phone calls and phone numbers.