• A new study from Privacy International has revealed that Facebook automatically collected data from Android apps with a total install base of over 500 million users between August 2018 and December 2018
• This data was collected regardless of whether the app user had a Facebook account
• The study analyzed many free, popular Android apps in the Google Play store including MyFitnessPal, Spotify, TripAdvisor, and Yelp
• Some of the apps sent highly personalized data to Facebook such as flight search data which included the departure city, departure airport, departure date, arrival city, arrival airport, arrival date, number of tickets, and class of tickets
A study from Privacy International, a charity that promotes the right to privacy across the world, has found that a number of popular Android apps automatically sent data to Facebook between August 2018 and December 2018.
This data was sent to Facebook regardless of whether app users were logged into their Facebook accounts, and more worryingly, it was even sent when app user didn’t have a Facebook account.
In total, the study analyzed the data that 34 Android apps from the Google Play store sent to Facebook. Each of these apps has an install base of between 10 million and 500 million.
The study found that at least 61% of the apps automatically sent data to Facebook as soon as a user opened the app and this data typically tells Facebook which specific app is being used every time a user opens the app.
This data is often transmitted with a unique identifier known as the Google Advertising ID (AAID) which allows Facebook to build a detailed user profile by linking together the data it’s collecting from different apps and websites. This user profile often contains far more information than the apps people are using.
For example, two of the apps which automatically sent data to Facebook during the study were the job search app Indeed and the children’s app My Talking Tom. Facebook could use this data to profile users who install these apps as most likely being parents and job seekers.
Another worrying find from this study is that some of the apps sent very detailed and sensitive data to Facebook. For example, the travel search and booking app KAYAK sent detailed information about people’s flight searches to Facebook which included departure city, departure airport, departure date, arrival city, arrival airport, arrival date, number of tickets, and class of tickets.
It’s unclear how Facebook uses this data when people opt-out of targeted advertising or don’t have a Facebook account.
In this study, Privacy International tested the opt-out solutions for non-Facebook users and found they had no discernible impact on the data sharing described in the study.
In a similar study, Facebook was asked if data from users who opt-out of targeted advertising is discarded after transmission and it responded with the following written statement:
“If a person utilizes one of these controls, then Facebook will not use data gathered on these third-party apps (e.g. through Facebook Audience Network), for ad targeting.”
This statement suggests Facebook does still gather data that is sent from Android apps when users opt-out but uses it for some purpose other than targeted advertising.
Here’s a list of the main Android apps that sent data to Facebook during the study:
1. Calorie Counter – MyFitness Pal (over 50 million app installs)
2. Duolingo: Learn Languages Free (over 100 million app installs)
3. Family Locator – GPS Tracker (over 10 million app installs)
4. Indeed Job Search (over 50 million app installs)
5. Instant Heart Rate: HR Monitor & Pulse Checker (over 10,000,000 app installs)
6. KAYAK Flights, Hotels & Cars (over 10 million app installs)
7. King James Bible (KJV) Free (over 10 million app installs)
8. Muslim Pro – Prayer Times, Azan, Quran & Qibla (over 10 million app installs)
9. My Talking Tom (over 500 million app installs)
10. Period Tracker Clue: (Period & Ovulation Calculator) (over 10 million app installs)
11. Qibla Connect® Find Direction- Prayer, Azan, Quran (over 10 million app installs)
12. Shazam (over 100 million app installs)
13. Skyscanner – Cheap Flights, Hotels and Car Rental (over 10 million app installs)
14. Spotify Music (over 100 million app installs)
15. Super-Bright LED Flashlight (over 500 million app installs)
16. The Weather Channel: Local Forecast & Weather Maps (over 100 million app installs)
17. TripAdvisor Hotels Flights Restaurants Attractions (over 100 million app installs)
18. VK (vkontakte) (over 100 million app installs)
19. Yelp (over 10 million app installs)
20. Salatuk (Prayer time) (over 10 million app installs)
Here’s a list of the main Android apps that didn’t transmit data to Facebook during the study:
1. Bible – Audio, Daily Verse, Study & Offline, Free (over 100 million app installs)
2. BMI Calculator & Weight Loss Tracker (over 10 million app installs)
3. Candy Crush Saga (over 500 million app installs)
4. Clean Master – Antivirus, Cleaner & Booster (over 1 billion app installs)
5. Dropbox (over 500 million app installs)
6. HP ePrint (no longer in the Google Play Store)
7. Opera Browser (over 100 million app installs)
8. Period Tracker, My Calendar (over 100 million app installs)
9. Phone Tracker By Number (over 10 million app installs)
10. Security Master – Antivirus, VPN, AppLock, Booster (over 500 million app installs)
11. Skater Boy (over 100 million app installs)
12. Speedtest by Ookla (over 100 million app installs)
13. WeChat (over 100 million app installs)
