Facebook SDK Tracks Android Users at App Launch Without Consent

media.ccc.de

Default settings in Facebook's mobile SDK transmit behavioral data and advertising IDs the second an app opens, enabling shadow profiling of non-users while offloading regulatory liability onto developers.

AI-assisted summary of 35C3 - How Facebook tracks you on Android — original source. Check the original for full context.

Source published: 2018-12-30

Key ideas

Privacy International tested 34 popular Android apps and found that 61% (21 apps) automatically transmit device telemetry and the Google Advertising ID to Facebook the instant they are opened, before any user consent can be requested. (6:22)
Apps transmitting telemetry via the Facebook SDK leak sensitive context-specific data, including flight search parameters and internal scores from Kayak, and previously read Bible verses from the King James Bible app. (8:30)
Opting out of ad personalization on Android does not stop data collection; in the case of Skyscanner, opting out actually increased the volume of telemetry data transmitted to Facebook. (20:45)
None of the tested applications implemented SSL/TLS certificate pinning for Facebook SDK traffic, allowing transparent decryption and inspection of background data flows. (23:38)

Detailed notes

## Background Published on YouTube by media.ccc.de on December 30, 2018, this presentation from the 35th Chaos Communication Congress (35C3) features Frederike Kaltheuner and Christopher Weatherhead of Privacy International. The talk explores third-party tracking on Android, revealing how captured and decrypted network traffic shows that popular mobile apps routinely transmit device and usage data to Facebook the instant they are opened, even if a user does not have a Facebook account.

## TL;DR Researchers from Privacy International examined network traffic across 34 popular Android applications to assess the data-sharing behavior of the embedded Facebook Software Development Kit (SDK). They discovered that over 61% of tested apps immediately beam lifecycle telemetry and the Google Advertising ID (GAID) to Facebook upon launch without obtaining prior user consent, with some apps transmitting granular data like flight searches and religious readings. Although Facebook's terms place legal liability entirely on application developers to obtain consent under regulations like the GDPR, the SDK's default behavior makes pre-launch consent functionally impossible. The talk demonstrates that standard opt-out toggles fail to halt collection and emphasizes the urgent need for platform accountability and privacy by default rather than relying on flawed user workarounds.

## Atmosphere & style The presentation carries the ambiance of a cozy yet chilling late-night tech campfire story, delivered with conversational warmth, dry British humor, and rigorous investigative gravity. Christopher Weatherhead and Frederike Kaltheuner balance each other naturally, pairing technical network captures and MITM proxy demonstrations with sharp regulatory critique. The audience frequently reacts with chuckles of disbelief and supportive applause, creating a collegial hacker-conference environment united by a shared frustration over dark adtech patterns and the persistent myth of meaningful user consent.

## Bulletin - [06:22](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=382s) Privacy International tested 34 popular Android apps and found that 61% (21 apps) automatically transmit device telemetry and the Google Advertising ID to Facebook the instant they are opened, before any user consent can be requested. - [08:30](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=510s) Apps transmitting telemetry via the Facebook SDK leak sensitive context-specific data, including flight search parameters and internal scores from Kayak, and previously read Bible verses from the King James Bible app. - [20:45](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1245s) Opting out of ad personalization on Android does not stop data collection; in the case of Skyscanner, opting out actually increased the volume of telemetry data transmitted to Facebook. - [23:38](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1418s) None of the tested applications implemented SSL/TLS certificate pinning for Facebook SDK traffic, allowing transparent decryption and inspection of background data flows.

## Key takeaways - [01:47](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=107s) Subject access requests to adtech brokers like Quantcast demonstrate that extensive behavioral and demographic dossiers are built from a single persistent browser cookie without consumer awareness. - [03:25](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=205s) University of Oxford research established that 42% of free Android apps in the US and UK Google Play Stores integrate the Facebook SDK, positioning Facebook as the second-largest mobile tracker after Alphabet. - [08:30](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=510s) Facebook builds shadow profiles on mobile device users regardless of whether they have a Facebook account, are logged out, or deliberately avoid the platform. - [06:22](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=382s) The Facebook SDK automatically emits default lifecycle events (SDK Initialized, Activated App, Deactivated App), enabling Facebook to reconstruct exact usage timelines and session durations. - [11:40](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=700s) Combining app usage data linked by the Google Advertising ID (GAID) allows trackers to infer intimate traits such as religion, parental status, and employment seeking. - [11:40](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=700s) Aggregating SDK lifecycle telemetry across millions of Android installs provides Facebook with real-time strategic market intelligence on competitor apps and ecosystem trends. - [13:17](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=797s) Facebook contractually designates app developers as sole data controllers under GDPR while providing an SDK that transmits personal data upon launch by default before consent can be gathered. - [13:17](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=797s) Although Facebook added a feature to delay automatic event logging in SDK 4.34, earlier versions transmitted an unblockable initialization payload pairing the app ID with the user's GAID. - [16:07](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=967s) Developer responses to Privacy International ranged from immediate bug fixes by Skyscanner to a widespread lack of technical understanding regarding SDK background data flows. - [19:10](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1150s) Platforms fail the principle of Privacy by Design and by Default when their default configurations broadcast telemetry without user authorization and shift all legal liability to publishers. - [20:45](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1245s) Android's built-in ad personalization opt-out merely flips a boolean flag in network payloads while data transmission to Facebook servers continues unabated. - [23:38](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1418s) Facebook responded to a formal GDPR Subject Access Request based on an advertising ID only past the statutory deadline and after being warned of an impending report, claiming it held zero data. - [33:35](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2015s) Google's contractual rules for opting out of ad personalization only restrict using data for ad delivery, leaving collection intact for surveying, market research, or internal analytics. - [34:58](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2098s) App stores enforce developer compliance policies on paper but fail to audit or disclose embedded third-party trackers to users prior to app installation.

## Detailed walkthrough ### [00:18](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=18s) Introduction: Spooky Campfire Stories and Congress Welcome

The session opens late in the evening as the Herald introduces the final talk of the day, pitching it as a spooky campfire story with one chilling distinction: unlike typical folklore, this one is entirely real. The presentation, delivered by Frederike Kaltheuner and Christopher Weatherhead, centers on shadow profiling and the invisible mechanics of how Facebook monitors mobile device users—even those who have never registered for a Facebook account.

Stepping up to the microphone, Christopher expresses his genuine awe at attending his very first Chaos Communication Congress, describing the experience as an absolute dream. Before diving into the technical findings, he leads an appreciative round of applause for the Congress angels, live translators, and heralds whose behind-the-scenes work keeps the conference running smoothly. To take the pulse of the room, Christopher asks for a show of hands to see how many attendees are Android developers. Seeing only about five hands go up across the hall, he follows up by asking how many have implemented the Facebook Software Development Kit (SDK). After spotting a couple of hands, he hands the presentation over to Frederike.

[01:47](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=107s) The Dark Reality of AdTech Profiling and the Quantcast Subject Access Request

Frederike begins by grounding the research in a series of formal regulatory complaints filed earlier in 2018 against seven companies spanning adtech, data brokerage, and credit scoring. She explains that these entities were targeted precisely because they operate far from public awareness. Most consumers have never heard of them, making it practically impossible for ordinary citizens to understand who holds their records or how their behaviors are packaged and traded.

To demonstrate the invasiveness of this ecosystem, Frederike shares the results of a data access request she submitted to the tracking company Quantcast. Displaying a blurred, heavily redacted slide of her personal browsing logs, she reveals an exhaustive dossier compiled from her web activity. Alongside sensitive workplace browsing records, timestamps, and device specs, Quantcast recorded algorithmic inferences about her gender, whether she has children, and her household income. Data brokers partnered with Quantcast went even further, sorting her into bizarre, blunt marketing classifications such as "heavy alcohol spender at home" or tagging her with an affinity for baby products and diapers. The most striking element of the disclosure was not just the volume or inaccuracy of the dossiers, but its origin: every single data point was tied to a solitary tracking cookie deposited in one browser on one of her devices.

Frederike stresses that this lack of transparency is the core problem: > “The reason for our complaints and the reason why we focused on these companies that are really not household names to most people is that it is currently impossible for most people to understand how they're being tracked and profiled and in whose hands all of this data ends up.”

- Seven formal complaints were submitted against adtech firms, data brokers, and credit-scoring agencies. - Inferred profile attributes included gender predictions, parental status, income level, and commercial affinity labels. - The entire corporate profile was assembled using a single persistent browser cookie on one device.

[03:25](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=205s) Oxford Research and the Ubiquity of the Facebook SDK on Android

Frederike shifts the focus to newly published research uncovering mobile tracking on Android, with special emphasis on how Facebook monitors individuals who deliberately avoid the social network. She highlights foundational research conducted earlier in the year by the University of Oxford, which revealed that 42% of free apps in the Google Play Store across the US and the UK were equipped to transmit telemetry back to Facebook. This scale firmly positions Facebook as the second-largest tracker on the mobile platform, trailing only Google’s parent company, Alphabet.

Explaining why their investigation focused on Facebook rather than Google or other pervasive trackers, Frederike notes that users generally do not expect seemingly standalone utilities—such as period trackers or simple LED flashlights—to send sensitive behavioral telemetry to Mark Zuckerberg's platform. For people who made an explicit, conscious choice never to join Facebook or deleted their accounts to protect their digital footprint, discovering that their everyday mobile apps quietly report back to the company comes as a profound shock.

Frederike underscores the jarring nature of these tracking integrations: > “The reason we focus on Facebook and not Google or any of the other tracking companies is because the very fact that apps like a period tracker or an LED flashlight shares data with Facebook in the first place will come as a surprise for many people and especially for those who have made a conscious decision not to be on Facebook.”

```mermaid flowchart LR accTitle: Mobile App Tracking Ecosystem Dominance accDescr: Diagram illustrating Google and Facebook dominance in free Android apps based on Oxford research.

subgraph Market["Google Play Store (US & UK Free Apps)"] A["Alphabet / Google"] B["Facebook SDK"] C["Other Trackers"] end

A -->|"#1 Tracker Ecosystem"| M["User Devices"] B -->|"#2 Tracker Ecosystem (42% of Apps)"| M C --> M ```

[04:34](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=274s) Methodology: Inspecting Traffic Across Popular Android Applications

Christopher steps back in to outline the testing setup. Drawing directly from the Oxford University Computer Science department's dataset of the top 5,000 Android applications integrating the Facebook SDK, the team curated a target group of 34 high-profile applications. They prioritized apps with massive install bases exceeding 10 million downloads each, ensuring the sample reflected software widely used by the general public rather than obscure edge cases.

The curated test suite combined massive commercial platforms like Spotify and Indeed with independent utilities, casual games, and sensitive services covering health, menstruation, and religion. Christopher makes it clear that the goal of the investigation was not to shame developers or single them out for poor coding practices, but to scrutinize the behavior of the Facebook SDK itself and evaluate whether it transmits telemetry with or without meaningful user consent.

To inspect the outgoing network traffic without altering application behavior, Christopher set up a dedicated hardware and software lab: - **Test Device**: LG Google Nexus 5 running stock Android 8.1. - **Interception Proxy**: mitmproxy running within a virtual machine configured as a transparent network gateway. - **Decryption & Inspection**: Capturing, decrypting, and parsing all TLS-encrypted communications flowing between the mobile apps and Facebook's backend infrastructure (`graph.facebook.com`).

Christopher clarifies their core stance toward app creators: > “We're not here to criticize developers for the way they make their apps, this is all about the SDK and the way it transmits data with or without user consent.”

[06:22](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=382s) Immediate Transmission: App Launch Beacons and the Kayak Example

The team's primary technical finding was immediate and striking: out of the 34 apps examined, 21 of them (roughly 61%) broadcasted data to Facebook servers the exact instant the app process launched, before the user could interact with the screen, view a prompt, or configure privacy settings.

To illustrate this, Christopher demonstrates the startup network traffic of the travel search engine Kayak. The very millisecond the user taps the Kayak app icon, its first outbound HTTP request bypasses user interaction and heads straight to `graph.facebook.com`, alongside requests to several other third-party tracking endpoints. Christopher humorously points out the irony on Kayak's final onboarding screen, which greets the user with an explicit reassurance: *"Don't worry, we'll never share anything without your permission."*

Examining the payload structure using VK (the popular Russian social network) as a standard baseline, Christopher explains the default lifecycle events baked into the Facebook SDK: - `SDK Initialized`: Fires the moment the SDK runtime is instantiated in memory. - `Activated App`: Fires every time the application enters the foreground. - `Deactivated App`: Emitted the moment the app transitions into the background or terminates.

By simply listening to these lifecycle pings, Facebook can construct an exhaustive timeline of a user’s engagement habits: precisely how frequently an app is opened, how long each session lasts, and the exact intervals of daily use. Alongside these timestamps, the payload contains a unique identifier—which the researchers argue constitutes personal data—as well as detailed device parameters including the exact Android OS version, hardware model, keyboard localization settings, and system time zone.

Pointing out the immediate telemetry dispatched on boot, Christopher observes: > “Our first finding was that over 61% of the apps we tested automatically transferred data before the user has any other like they literally just open the app so that's 21 out of 34.”

```mermaid flowchart TD accTitle: Facebook SDK Initialization Lifecycle Telemetry accDescr: Sequence showing lifecycle events transmitted by the Facebook SDK to graph.facebook.com upon opening an app.

subgraph MobileDevice["Android Client Execution"] Tap["User taps App Icon"] --> Init["SDK Instantiation"] Init --> FG["App enters Foreground"] FG --> BG["App enters Background / Closed"] end

subgraph Metadata["Captured Profile Context"] P1 & P2 & P3 --> Meta["Device ID, Android Version, Hardware Model, Timezone, Keyboard Locale"] end ```

[08:30](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=510s) Detailed In-App Telemetry: Travel Itineraries, Scripture, and Device State

Moving beyond baseline initialization events, the researchers' second core finding revealed that numerous apps feed extraordinarily granular, context-sensitive personal data directly into Facebook's infrastructure. Christopher points out that while independent groups like Exodus Privacy (which analyzed the Baby+ app) and Mobile Shirz (which exposed pregnancy tracker telemetry) had documented individual occurrences, the systematic nature of this data pipeline remained startling.

Christopher showcases specific examples captured from the network traces: - **Kayak**: Dispatches full, unredacted search parameters directly to Facebook whenever a user runs a flight or hotel query. The payload incorporates search criteria, proprietary internal metrics such as a "user score," and obfuscated session identifiers. - **King James Bible**: In earlier iterations of the software tested during the project, the app relayed the exact biblical passages and verses the user was reading directly to Facebook. - **Ad Network Requests**: Telemetry queries routed to Facebook’s advertising network routinely package deep hardware-state diagnostics, including whether the device is currently plugged into a charger, exact battery percentage, available storage space, and accelerometer orientation coordinates.

Christopher highlights an ironic configuration flag embedded in the header of an ad network telemetry payload: `COPPA: false` (referencing the United States Children's Online Privacy Protection Act). The application simply declared that the user was not a child without ever asking for an age verification check.

Crucially, Christopher emphasizes that these deep behavioral dossiers are constructed completely agnostic of a person's Facebook status. Whether an individual has a Facebook account, is logged out, or intentionally refuses to touch the platform, apps carrying the SDK stream device identifiers and personal habits into Facebook’s data collection apparatus regardless.

Christopher drives home the reality of shadow profiling across non-users: > “Profiles are being made regardless of whether you're having a Facebook account or you don't have a Facebook account; what you have to use is some of these apps and a profile is being built potentially.”

```mermaid flowchart TD accTitle: App Data Flow to Facebook Ad Infrastructure accDescr: Diagram illustrating how specific app data points flow from apps directly into Facebook's tracking servers.

subgraph UserInteractions["User In-App Behavior"] KSearch["Kayak: Flight Search & User Score"] BRead["Bible App: Chapter & Verse Lookups"] DevState["System State: Battery %, Charging, Free Space, Accelerometer"] end

subgraph IdentifierBundle["Tracking Envelope"] AAID["Google Advertising ID (AAID)"] COPPA["COPPA Flag: Hardcoded 'False'"] end

subgraph CollectionPoint["Facebook Graph API & Ad Network"] FB["graph.facebook.com"] end

KSearch --> IdentifierBundle BRead --> IdentifierBundle DevState --> IdentifierBundle IdentifierBundle --> FB ```

- Kayak sends comprehensive flight search details, session tokens, and proprietary user scores straight to `graph.facebook.com`. - The King James Bible application previously reported the specific Bible verses and passages being read by the user. - Device state telemetry captures hardware metrics like charging status, exact battery levels, free storage capacity, and accelerometer sensor readings. - Identity tracking functions regardless of whether the user possesses an active Facebook account or is logged in.

[11:40](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=700s) Profiling Users and Market Surveillance via the Google Advertising ID

Analyzing what applications an individual uses and exactly when they open them provides an extraordinarily intimate window into their private life. Frederike Kaltheuner illustrates this by highlighting four specific apps tested in their research: a Muslim prayer app, a period tracker, the job search platform Indeed, and the children's game My Talking Tom. Taken in isolation, each serves a specific functional purpose, but viewed together, they instantly sketch a granular demographic profile: an individual who is likely a Muslim woman, currently looking for employment, and raising a child.

```mermaid flowchart TD accTitle: Profile Construction via App Tracking accDescr: Diagram showing individual app data streams linking together via the Google Advertising ID to infer a personal profile and provide market surveillance data.

subgraph Apps["Installed Apps"] A["Muslim Prayer App"] B["Period Tracker"] C["Indeed (Job Search)"] D["My Talking Tom (Kids)"] end

subgraph Linkage["AdTech Tracking"] GAID["Google Advertising ID (GAID)"] end

subgraph Intelligence["Inferred Intelligence"] Prof["Detailed User Profile:<br/>Muslim, Female, Job Seeking, Parent"] Market["Market-Wide Usage Analytics:<br/>Installed, Initialized, Deactivated"] end

A --> GAID B --> GAID C --> GAID D --> GAID GAID --> Prof GAID --> Market ```

In the test environment, the apps that transmit telemetry automatically bundle this behavioral data with the user's Google Advertising ID (GAID). Although this unique identifier can be reset by the user, Privacy International's prior investigations into data brokers and adtech firms revealed that it functions primarily as the universal glue connecting fragmented behavioral profiles across disparate services. Kaltheuner notes that while outside observers cannot see what happens behind closed doors inside Facebook's data centers, “even though we don't know what is happening to this data, it would be pretty straightforward to link it up.”

Beyond personal profiling, this telemetry grants Facebook unparalleled strategic market intelligence. Tracking lifecycle events—such as when an app is installed, when its SDK is initialized, and when an app is deactivated—across hundreds of millions of Android devices exposes real-time aggregate consumer behavior across the wider ecosystem. Privacy International deliberately evaluated high-reach services, choosing apps with at least 10 million and up to 500 million downloads, accounting for a combined footprint of more than two billion installs.

---

[13:17](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=797s) The SDK Default Implementation and the Consent Dilemma

Developers integrate the Facebook SDK for Android for legitimate, practical reasons, utilizing its core functional components: developer analytics, audience network ads, and Facebook Login. However, this creates a major regulatory conflict. Facebook places the entire burden of legal data collection squarely on developers, treating them as sole data controllers contractually obligated to obtain explicit user consent before transmitting any personal data over the SDK.

Yet the SDK’s default behavior undermines this requirement. As documented in Facebook's own Android Quick Start guide, the standard implementation immediately starts logging and transmitting events the exact millisecond an app launches. When the European General Data Protection Regulation (GDPR) took effect in May 2018, app developers began posting bug reports on Facebook's developer portal. A bug filed on July 24, 2018, highlighted that an app trying to support Facebook Login was automatically transmitting the user's Advertising ID upon launch before any prompt could be displayed, putting the developer in direct breach of the law. Kaltheuner explains that “the reason why developers complained is that when apps share data the second they're opened, you're unable to ask people for their explicit and unambiguous permission which is the bar for consent that GDPR requires.”

In June 2018, Facebook introduced a configuration option allowing developers to delay automatic event logging. Prior to this, developers could disable certain background telemetry, but Facebook confirmed in writing that this switch did not suppress a baseline signal reporting that the SDK had been initialized. Because that initialization payload still pairs the app's identity with the user's unique Google Advertising ID, Facebook continues to receive immediate confirmation of who is opening which app regardless of whether user permission has been granted.

---

[16:07](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=967s) Legal Ambiguities and Developer Privacy Practices

Evaluating whether this automatic transmission is lawful requires looking across multiple frameworks, including the GDPR, the ePrivacy Directive, and European competition law. Privacy International rejects Facebook's stance that legal responsibility rests entirely on application publishers. Nevertheless, the researchers emphasize that app developers must dramatically improve their compliance practices. Several tested apps with tens of millions of installs provided privacy policies consisting of only two paragraphs, an approach that Kaltheuner characterizes as “unambiguously non-compliant.”

When Privacy International contacted the 21 apps identified as transmitting data immediately upon opening, the responses varied widely: - Some developers demonstrated a complete lack of technical understanding regarding how the Facebook SDK operates or what payloads it sends in the background. - Others relied on conflicting legal interpretations or seemed unaware of the background data leakage and pledged to update their software. - Skyscanner emerged as a rare positive example, responding within three days to report that they had deployed an immediate app update to halt the behavior. - The Weather Channel updated its application in December immediately following Privacy International's test cycle.

Kaltheuner urges developers to reconsider integrating third-party trackers altogether. Because Facebook contractually pushes legal liability onto developers, incorporating the SDK exposes publishers to significant legal and regulatory jeopardy. Developers must never presume that an SDK's default configuration meets legal standards; instead, they should implement third-party tools selectively, practice strict data minimization, and remain fully transparent with their users.

---

[19:10](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1150s) Platform Accountability and Challenging "Standard Internet Features"

Platform operators such as Facebook and Google bear a fundamental duty to uphold the principle of Privacy by Design and by Default. Although Facebook detailed numerous methods for developers to delay or customize data logging, the company provided no compelling technical or business justification for why the SDK transmits data immediately by default. If a platform supplies developer tools that feed data back to its own servers while contractually offloading legal liability onto those developers, the tools must be configured defensively out of the box.

When challenged, both tech giants defended their tracking practices by arguing that everyone else in the industry does the same. During 2018 congressional and parliamentary hearings, lawmakers pressed Facebook about "shadow profiling"—the systematic tracking of individuals who do not even possess a Facebook account across the web and mobile apps. In its written follow-ups to the United States Senate, Facebook insisted that such background tracking is merely a standard feature of the modern internet, while Google similarly pointed to tracking executed by Amazon and Twitter. Kaltheuner forcefully rejects this justification:

> “In a way we need to reclaim the internet; like there's no natural law that says that every website, every app you use, sends such detailed data to hundreds of different companies every time you use them.”

---

[20:45](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1245s) The Illusion of Opt-Outs and Limited User Recourse

Turning to what everyday users can actually do to protect themselves, Christopher Weatherhead examines Google's official advice. Google contends that users can resolve tracking concerns through two built-in Android privacy settings: - Opting out of ad personalization. - Resetting the Google Advertising ID.

Weatherhead demonstrates the real-world outcome of toggling these settings by comparing captured network requests before and after opting out. The audience laughs as he shows the side-by-side payload comparison: while an ad personalization boolean flag in the payload successfully switches from `true` to `false`, the total volume of data transmitted to Facebook actually increases, and the transmission continues unabated. Weatherhead dryly observes: “The real improvement is that the flag has been changed from true to false, but the data is increased and it's still being sent, so yeah, it's... so you can't really opt out then.”

For technically inclined users, such as attendees at the Chaos Communication Congress, running a rooted Android handset makes it possible to block outbound traffic to domains like `graph.facebook.com`, though doing so risks breaking unrelated application functionality. For the vast majority of ordinary consumers who do not possess rooted devices, practical defenses are virtually nonexistent. Avoiding apps that bundle the Facebook SDK is functionally impossible because app marketplaces provide zero upfront disclosure about which third-party tracking libraries are embedded inside an application before installation.

[22:04](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1324s) Mitigation Strategies and Open-Sourcing the Research Environment

Addressing steps users can take to protect themselves, Christopher Weatherhead notes that one option is to segregate apps by creating separate user profiles on an Android device for every single application. By doing this, the advertising IDs remain completely separated, meaning an ID is tied strictly to that individual app. Users can also opt out and manually reset their advertising ID. Christopher concedes that while resetting does not truly solve the root issue, “it doesn't really solve much but it does at least you know it keeps your profile fresh,” noting that the timeframe of tracking plays a massive role in how detailed a profile can become. However, Frederike Kaltheuner cuts straight to the core injustice: “why should you have to do all of this?”

Christopher announces that he will release the entire testing environment on the Privacy International (PI) website so anyone can replicate their findings. He jokes that he plans to upload it the next day because he needs to get home and sleep first. All project documentation will also be published on PI's website. Christopher specifically recommends that people examine the data flows for Kayak and the LED Flashlight app, noting that the flashlight app features particularly interesting consent flows. The formal talk concludes to applause as the Q&A session begins.

- Android user profiles allow isolating advertising IDs per app, keeping profiles separate. - Resetting the advertising ID does not stop tracking, but it resets the profiling timeline. - Privacy International will host both the full test environment and documentation for independent replication. - Notable app analyses highlighted by the researchers include Kayak and LED Flashlight.

---

[23:38](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1418s) Q&A: Subject Access Requests and Certificate Pinning

The audience lines up across five microphones, and the first question asks whether the researchers submitted their advertising ID to Facebook to request their data under access rights, suggesting that a user could query Facebook, complain to the app developers, query Facebook again, and repeat the loop weekly. Christopher reveals that he did submit a data access request (DSAR) to Facebook based on his advertising ID. Facebook responded well outside the statutory timeframe, and only replied after PI formally notified the company that an investigative report was about to be released. In their eventual response, Facebook claimed they held no data on that ID. Frederike emphasizes how deeply flawed this system is, stating, “this experience just shows that it's excruciatingly difficult to actually exercise your data rights if you don't have an account.” Even though Facebook provides an official web form, the hurdle remains immense.

```mermaid flowchart LR accTitle: Data Subject Access Request Flow accDescr: Diagram showing Christopher's DSAR attempt to Facebook using an advertising ID and the resulting denial. subgraph UserFlow["User Action"] A["Submit DSAR with Advertising ID"] end subgraph Delay["Response Delay"] B["Facebook misses statutory deadline"] C["PI notifies Facebook of upcoming report"] end subgraph Outcome["Resolution"] D["Facebook replies claiming 'no data' held"] end A --> B B --> C C --> D ```

An online question asks whether any tested apps prevented interception by pinning Facebook's SDK certificates. Christopher answers bluntly: “none of them did of the ones I tested at least of them they were quite happy to send data to a man in the middle.”

- Christopher performed a formal GDPR Subject Access Request against Facebook using his mobile advertising ID. - Facebook only replied past the legal deadline after learning of the upcoming public report, asserting they held zero data on the ID. - None of the tested Android applications implemented SSL/TLS certificate pinning for Facebook's SDK traffic, allowing transparent man-in-the-middle decryption.

---

[25:06](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1506s) Privacy Defaults, the Monetization Myth, and Paid Apps

A questioner asks whether open-source libraries exist to replace these SDKs with privacy-sensitive defaults, and whether Facebook or Google terms of service would even permit them. Christopher replies that he is unaware of any such privacy-preserving wrapper projects, and while they have read the SDK terms of service, he cannot say off the top of his head whether modified libraries would violate them.

Another attendee asks about the conventional wisdom given to non-technical users: "buy your app so you won't be the product." The audience member asks whether paid apps also engage in this tracking or if the study only covered free apps. Frederike tackles the underlying industry narrative, explaining that when companies are confronted about third-party tracking, the standard defense is that publishers and app creators must monetize through invasive surveillance to survive. Frederike points out that this justification has been recycled for years while tracking has grown exponentially worse:

> “there are ways to use analytic software there are ways to even show ads that are fair and transparent to people but sort of like but there's such a gap between what's considered sort of industry practice or what's happening on a massive scale and what would be considered transparent and fair so there's like a massive room for improvement movement and that's why I'm not buying the argument that that apps or companies like Facebook and Google say but people need to sell ads”

When the attendee clarifies whether the research specifically checked paid apps, Christopher clarifies that his testing focused strictly on free-to-download apps. Frederike notes that because tracking is baked into the SDK by default, testing paid applications would be an interesting avenue for future research.

---

[27:32](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1652s) Competitor SDKs, Legal Ramifications, and Automated Ad ID Resets

Asked whether other major tech companies (like the rest of the "Big Five") provide tracking SDKs that operate like Facebook's, Christopher explains that while he did not conduct dedicated deep-dives into them, network logs clearly revealed widespread third-party tools. He specifically observed telemetry going to tools like Amplitude and Google Crashlytics, noting their consistent payload formats indicate they are delivered via SDKs, though PI has not yet analyzed the contents of those payloads.

A two-part question asks whether Facebook's failure to answer access requests makes them legally vulnerable to lawsuits despite their formidable legal team, and whether users could automate resetting their advertising ID on Android to disrupt tracking. On legal action, Frederike hints that Privacy International is weighing next steps, advising everyone to read the detailed legal chapter in their published report. She notes existing legal precedents surrounding the tracking of non-users via social plug-ins and tracking pixels, suggesting that the mobile SDK ecosystem presents clear parallels.

Regarding the automated resetting of advertising IDs, Frederike notes that Android buries the setting under `Settings -> Google -> Ads -> Reset advertising ID`. Because the operating system assigns a shared advertising identifier, resetting it clears it for both Google and Facebook simultaneously. However, Frederike highlights the flawed default design:

> “the privacy settings of both Google and Facebook are still sort of counterintuitive and there is no good reason to why the ad ID only resets when you reset it manually because we know that many people will not understand or know what the ad ID is used for and what implications resetting it has”

The session moderator pauses to remind the audience that Privacy International's report is going live at that very moment, meaning the attendees in the hall are the first public audience to see the findings, prompting a round of applause.

---

[30:50](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1850s) Delayed SDK Initialization and Android Factory Reset Anomalies

An audience member asks if developers can delay loading the Facebook SDK so that it cannot execute code or transmit telemetry until a specific feature (such as Facebook login) is actually invoked. Christopher responds that Facebook claims SDK versions 4.34 and above include a delay function. However, developer bug reports as late as December indicate that the effectiveness of this feature remains questionable. Furthermore, Christopher suspects that several large apps that did not exhibit automatic background tracking—such as WeChat and Dropbox—may avoid using the full SDK altogether, choosing instead to implement manual calls directly to the Facebook Graph API using their developer keys. When pressed on whether developers can simply lazy-load the standard Facebook library binaries into memory only when needed, Christopher clarifies that he cannot definitively say whether that is technically supported.

Another questioner asks whether resetting the advertising ID is even meaningful given the extensive fingerprinting and data transmitted. Frederike defends the practice while acknowledging its limits: while it technically creates a new profile rather than altering historical logs, and relinking data remains trivial for ad tech giants, manual resets still break profile continuity and signal a user's intent to resist granular targeting.

Frederike shares a bizarre anomaly discovered during their testing: when resetting test devices to factory settings, the Google Advertising ID unexpectedly failed to reset. When Privacy International confronted Google about this behavior, Google stated they tested multiple devices and observed the ID resetting as intended. The researchers could not replicate Google's results, leaving open the possibility that the behavior was tied to their specific testing environment.

The section closes with an audience member asking whether similar background tracking occurs on Apple's iOS devices. Christopher smiles, hinting that investigating Apple's platform may become his major project for the following year.

[33:35](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2015s) Opting Out of Ad Personalization and the Skyscanner Anomaly

An audience member at microphone 3 asks about a paradoxical finding shown earlier on the slides: when a user opts out of ad personalization on Android, the volume of transferred data actually increases. Looking back at the specific data payload, Christopher Weatherhead points out that this occurred in Skyscanner's custom app data during origin selection. When a user went through the flight booking flow and chose the departure city, the app transmitted data back to Facebook; unexpectedly, opting out of personalization caused the app to transmit even more data. Weatherhead admits they do not know the technical rationale behind why Skyscanner's payload expands when opted out, but he highlights the underlying policy reality regarding Google's enforcement.

When Privacy International questioned Google about this behavior, Google responded that opting out legally binds parties not to use the data for personalized advertising. However, the speakers emphasize the huge loophole inherent in that defense. A contractual promise restricts how the data is used downstream, but it does nothing to restrict its collection in the first place. Furthermore, the restriction applies solely to advertising; nothing stops companies from using the collected data for other purposes, such as behavioral surveying, market research, or internal analytics.

- **App examined**: Skyscanner (specifically transmitting custom app event data when choosing origin flight cities). - **Google's defense**: Contractual rules prohibit using the data for personalized ads once opted out. - **Privacy International's critique**: Christopher Weatherhead notes, “First of all that's like a restriction on the on use it's not a restriction on collection but also it's only a restriction on use for advertisement we still think you could be using it for different purposes EEG surveying or whatever things.”

---

[34:58](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2098s) App Store Privacy Indicators and the Scope of Trackers

At microphone 5, an attendee asks whether alternative app repositories like F-Droid or commercial app stores could introduce clear privacy indicators—such as alongside the standard five-star user rating, having a separate one-star to five-star privacy rating—to warn users if an app has invasive tracking before they download it. Christopher Weatherhead agrees that this is an excellent idea and points out that Privacy International recommended something similar to Google. Since the Google Play Store already flags attributes like in-app purchases or contains ads, it could easily disclose whether an app bundles trackers or includes the Facebook SDK.

Frederike Kaltheuner elaborates on the institutional gap between store rules and reality. App stores require developers in their terms of service to comply with all applicable privacy laws, yet observational testing shows a massive discrepancy between what policies mandate and how apps behave in practice. She also reminds the room that Privacy International’s study intentionally isolated Facebook as a single tracking entity, but the broader ecosystem contains thousands of ad-tech vendors.

```mermaid flowchart TD accTitle: App Store Reality vs Policy Gap accDescr: Discrepancy between Google Play Store contractual requirements and the actual tracking behavior observed in apps.

subgraph StorePolicy["App Store Terms of Service"] P1["Mandates compliance with existing privacy laws"] P2["Requires consent for profiling under GDPR"] end

subgraph AppBehavior["Observed App Behavior"] A1["Immediate transmission of AAID upon launch"] A2["Bundles Facebook SDK and thousands of ad trackers"] A3["No pre-consent gate before exfiltrating device telemetry"] end

StorePolicy -.->|"Discrepancy in practice"| AppBehavior ```

Kaltheuner references broader academic research by Reuben Binns and colleagues at the University of Oxford, who analyzed thousands of Android apps and uncovered staggering numbers of concurrent third-party trackers embedded within individual applications.

- **Proposed store feature**: Clear privacy ratings or tracker disclosures directly on app listing pages. - **Ecosystem context**: While Facebook is ubiquitous, thousands of specialized ad-tech trackers operate across popular Android apps. - **Academic reference**: Oxford research led by Reuben Binns documenting the sheer density of third-party tracking libraries in mobile software.

---

[37:07](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2227s) Disclosing App Developer Communications

A participant at microphone 4 asks whether Privacy International plans to make the full correspondence with app developers public, arguing that publishing the back-and-forth exchanges would give privacy-minded consumers a tangible angle to challenge these companies directly. Frederike Kaltheuner explains that Privacy International initially contacted the affected app companies on December 19, just prior to the Christmas holidays, fully recognizing that late December is an unusually demanding time of year for organizations to respond.

Kaltheuner clarifies that while they cannot release internal, unredacted message threads, they have published the formal statements and replies received from the companies at the end of their report for each specific app. Some developers responded that they needed more time to review the technical findings internally before making a statement. Frederike cautions the audience against reading malice into silence, saying: “And also to be fair some said they need more time to evaluate that internally so just to be fair um I wouldn't interpret a lack of response as anything negative just yet.” If late responses come in, Privacy International intends to update their public reporting accordingly.

---

[38:48](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2328s) Malicious Compliance: Payload Flooding and Ad ID Poisoning

The Q&A takes a humorous yet technically provocative turn when an audience member asks whether anyone has attempted to modify the outgoing JSON payloads to flood Facebook's ingestion endpoints with massive files—such as uploading a one-gigabyte payload—to see if their servers would ingest it. Christopher Weatherhead laughs and replies, “I think that would give our general counsel a heart attack.” However, he notes that testing these apps already pushed local testing tools to their breaking point; several tested apps sent traffic to so many distinct trackers simultaneously that the logging overhead ran the testing environment out of memory and crashed it.

```mermaid flowchart LR accTitle: mitmproxy Crash on Opt-Out HTTP2 Connections accDescr: Flow showing how switching off ad personalization triggers unheralded HTTP2 connections from Android that overwhelm mitmproxy.

subgraph Android["Android Device"] D1["Opt out of Ad Personalization"] --> D2["Initiates HTTP/2 connections without preamble"] end

subgraph Proxy["mitmproxy Environment"] M1["Cannot handle unexpected HTTP/2"] M2["Drops connections & floods logs with garbage"] M3["Environment out-of-memory crash"] end

D2 --> M1 M1 --> M2 M2 --> M3 ```

Weatherhead adds that toggling ad personalization off exposed a documented upstream bug in mitmproxy on GitHub: the Android operating system starts initiating HTTP/2 connections without an expected preamble, which mitmproxy cannot properly negotiate. The proxy continuously drops the connections, filling the debug logs with junk data. A follow-up question from microphone 2 asks whether a privacy tool could collect the last 1,000 advertising IDs (AAIDs) and randomly shuffle them across requests to poison tracking profiles. The speakers caution against such counter-measures, with Kaltheuner and Weatherhead noting that deliberately scrambling or spoofing personal identifiers introduces severe legal and GDPR complications.

- **Payload experimentation**: Deliberate denial-of-service or garbage data injection would trigger immediate legal liability. - **mitmproxy HTTP/2 bug**: Turning off personalization causes Android to open raw HTTP/2 streams lacking a handshake preamble, causing proxy packet drops and log bloat. - **Data poisoning suggestion**: Swapping AAIDs between users to pollute advertising models is warned off with: “I said it raises a lot of GDPR questions you might not want to do that I guess.”

---

[41:08](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=2468s) Account Deletion, Re-Identification, and Shadow Profiling

The final question of the session focuses on how effectively Facebook links an Android Advertising ID to an individual user's registered account, and what happens when an account is deleted. The attendee asks whether Facebook retains persistent records and uses telemetry to re-identify and track individuals even after they terminate their accounts.

Frederike Kaltheuner explains that Facebook addresses this across its public documentation—including its Privacy Policy, Cookie Policy, and Business Tools Terms—where sections specifically describe how the company handles data belonging to non-users. However, Privacy International finds those official descriptions persistently vague. While the documentation and company statements claim data is processed for specific, limited purposes and retained for varying lengths of time, they offer little technical clarity about how SDK-generated app telemetry is mapped behind the scenes.

Kaltheuner recalls that during United States congressional hearings, the issue of "shadow profiling" was raised repeatedly, yet the responses provided by Facebook remained evasive. Because outsiders cannot inspect Facebook’s server-side data lakes, researchers are forced to rely on opaque corporate disclosures. She emphasizes: “Because we don't know you can we have to sort of like trust statements that are made in the policies and that the company made elsewhere but what's interesting the responses to Congress where shadow profiling was a big issue is the response sort of like various purposes are given and the data is stored for varying length of time and so that's why it's very sometimes a bit tricky to figure out exactly what's happening with this we'd appreciate if that's a bit more transparent.” The talk concludes to sustained applause for Frederike Kaltheuner and Christopher Weatherhead of Privacy International.

## Notable quotes > [19:10](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1150s) there's no natural law that says that every website, every app you use, sends such detailed data to hundreds of different companies every time you use them. — Frederike Kaltheuner

> [13:17](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=797s) when apps share data the second they're opened, you're unable to ask people for their explicit and unambiguous permission which is the bar for consent that GDPR requires. — Frederike Kaltheuner

> [01:47](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=107s) it is currently impossible for most people to understand how they're being tracked and profiled and in whose hands all of this data ends up. — Frederike Kaltheuner

> [23:38](https://www.youtube.com/watch?v=y0vlD7r-kTc&t=1418s) it's excruciatingly difficult to actually exercise your data rights if you don't have an account. — Frederike Kaltheuner

## Mentioned 35C3, Amazon, Amplitude, Android, Apple, Baby+, Children's Online Privacy Protection Act (COPPA), Christopher Weatherhead, Dropbox, ePrivacy Directive, Exodus Privacy, Facebook, Facebook SDK, F-Droid, Frederike Kaltheuner, General Data Protection Regulation (GDPR), Google, Google Advertising ID, Google Crashlytics, Google Play Store, Indeed, Kayak, King James Bible, LG Google Nexus 5, Mark Zuckerberg, mitmproxy, Mobile Shirz, My Talking Tom, Privacy International, Quantcast, Reuben Binns, Skyscanner, Spotify, The Weather Channel, Twitter, University of Oxford, VK, WeChat

## Video description https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android

(even if you don’t have a Facebook account)

In this talk, we’re looking at third party tracking on Android. We’ve captured and decrypted data in transit between our own devices and Facebook servers. It turns out that some apps routinely send Facebook information about your device and usage patterns - the second the app is opened. We’ll walk you through the technical part of our analysis and end with a call to action: We believe that both Facebook and developers can do more to avoid oversharing, profiling and damaging the privacy of their users.

Frederike Kaltheuner Christopher Weatherhead

https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9941.html

[Source](https://www.youtube.com/watch?v=y0vlD7r-kTc)

中文简报

Facebook SDK在未经同意下于应用启动时追踪安卓用户 Facebook移动SDK的默认设置在应用打开瞬间即传输行为数据和广告ID，在将监管责任转嫁给开发者的同时，实现了对非用户的影子画像。隐私人权组织（Privacy International）的研究人员分析了34款热门安卓应用程序的网络流量，以评估其内置的Facebook软件开发工具包（SDK）的数据共享行为。他们发现，超过61%的受测应用在启动时未经用户事先同意，便立即向Facebook发送生命周期遥测数据和谷歌广告ID（GAID），部分应用还会传输航班搜索和宗教阅读等细颗粒度数据。尽管Facebook的条款将根据GDPR等法规获取同意的法律责任完全推给了应用开发者，但该SDK的默认行为使得在启动前获取同意在实际上无法实现。演讲表明，标准的退出（opt-out）开关无法阻止数据收集，并强调迫切需要平台承担责任并实现默认隐私保护，而不是依赖存在缺陷的用户规避手段。隐私人权组织测试了34款热门安卓应用，发现其中61%（21款应用）在打开瞬间就会自动向Facebook传输设备遥测数据和谷歌广告ID，而此时根本无法征求任何用户同意。 (6:22) 通过Facebook SDK传输遥测数据的应用会泄露敏感的特定场景数据，包括来自Kayak的航班搜索参数和内部评分，以及来自King James Bible应用此前阅读过的圣经经文。 (8:30) 在安卓系统上选择停用个性化广告并不能停止数据收集；就Skyscanner而言，停用后传输至Facebook的遥测数据量反而有所增加。 (20:45) 受测应用均未针对Facebook SDK流量实施SSL/TLS证书固定（certificate pinning），从而允许对后台数据流进行透明解密和检查。 (23:38)

Source quotes

[19:10] Frederike Kaltheuner: there's no natural law that says that every website, every app you use, sends such detailed data to hundreds of different companies every time you use them. [13:17] Frederike Kaltheuner: when apps share data the second they're opened, you're unable to ask people for their explicit and unambiguous permission which is the bar for consent that GDPR requires. [1:47] Frederike Kaltheuner: it is currently impossible for most people to understand how they're being tracked and profiled and in whose hands all of this data ends up. [23:38] Frederike Kaltheuner: it's excruciatingly difficult to actually exercise your data rights if you don't have an account.

Original transcript

[0:02] [Music] [0:18] and now welcome to the last Talk of the [0:22] day and it's very close to night and [0:27] it's time to tell spooky campfire [0:30] stories except this one is 100% real [0:34] spooky as it is it is a talk on Shadow [0:38] profiling and then how Facebook tracks [0:41] you even if you don't have a Facebook [0:43] account so let's give a warm Round of [0:45] Applause to Christopher and freder and [0:48] invite them on [0:50] stage [0:52] [Music] [0:58] and thank you hi everyone um just [1:01] amazing to be at Congress this is my [1:03] first Congress so uh yeah it's just been [1:05] an absolute [1:07] like [1:09] dream I really enjoyed it um and it's it [1:12] wouldn't be possible without like the uh [1:14] the angels and the the translators and [1:17] the Heralds so can we give them a bit of [1:18] a round of [1:19] [Music] [1:23] applause thank you just by a little show [1:26] of hands how many people in here are [1:27] Android developers just [1:31] there's like five of them [1:33] cool and how many of you have used the [1:36] Facebook [1:36] SDK any any of you a couple cool so I'm [1:41] going to hand over to Fred who's going [1:43] to take us for our first couple of [1:47] slides earlier this year we have filed [1:49] complaints against seven companies those [1:52] are data Brokers attech companies and [1:55] companies that do credit scoring and the [1:57] reason for our complaints and the reason [2:00] why we focused on these companies that [2:01] are really not household name names to [2:03] most people is that it is currently [2:06] impossible for most people to understand [2:08] how they're being tracked and profiled [2:11] and in whose hands all of this data ends [2:13] up as part of this research I asked one [2:16] of these tracking companies a company [2:18] called Quant that many of you probably [2:20] haven't heard of but that has certainly [2:22] heard of you for all of my [2:25] data so what you see here this is a [2:28] heavily edited and deliberately blurred [2:31] version of my browsing history so what [2:34] you see here are those are the websites [2:36] I've opened time stamps device [2:39] information um this is work related so [2:42] it's quite sensitive sometimes it also [2:44] includes inferred data uh a predicted [2:47] value for my gender whether I have [2:49] children my income and with all of this [2:52] came partner data from all other all [2:54] kinds of companies different data [2:56] brokers who placed me into infuriating [2:59] categories like heavy alcohol spender at [3:01] home or affinity for baby products and [3:05] nappies here's what's so very [3:07] fascinating about that data except that [3:09] it's a lot of data some of it is heavily [3:12] personal and some of it is very wrong [3:14] but what's so fascinating is that all of [3:16] this data is from one cookie from One [3:19] browser that was placed on one of my [3:22] devices this is why today we have just [3:25] published right now um research about [3:28] how a very different tracking company [3:30] tracks people on apps that are built for [3:33] for Android and we've focused especially [3:36] uh on how Facebook tracks people who do [3:39] not have a Facebook [3:41] account earlier this year research by [3:44] the University of Oxford showed that 42% [3:48] of apps of free apps in the Google Play [3:50] Store in the US and the UK should could [3:52] share data with Facebook and what's [3:55] interesting is that this makes Facebook [3:57] the second largest tracker after [3:59] Google's parent company [4:02] alphabet with this research that we just [4:04] published we wanted to build on this and [4:06] show what exactly this data sharing [4:08] looks like particularly for people who [4:10] don't have a Facebook account the reason [4:12] we focus on Facebook and not Google or [4:14] any of the other tracking companies is [4:17] because the very fact that apps like a [4:19] period tracker or an LED flashlight [4:22] shares data with Facebook in the first [4:23] place will come as a surprise for many [4:25] people and especially for those who have [4:27] made a conscious decision not to be on [4:34] Facebook here's what we did so we took [4:38] uh Oxford University's research from [4:41] their computer science department they [4:43] gave us a copy of their list and they [4:45] gave us a list of all of the apps of the [4:47] top 5,000 apps that use Facebook SDK we [4:51] chose the number of the L or some of the [4:53] largest ones and we also chose a few [4:56] apps that were uh that were had data [5:00] like they were either to do with [5:02] religion or they were to do with health [5:03] or some of the other stuff and a few [5:05] utility apps out of that selection um [5:08] because utility apps may also have [5:10] information about other [5:11] apps so this is the 34 that we chose as [5:15] you can see it's a real mix of uh both [5:17] big big name applications you know like [5:20] Spotify um indeed and then much smaller [5:25] applications that are made by more Indie [5:27] developers either just games that they [5:29] make that sort of thing and uh but all [5:32] of these apps have over 10 million [5:34] installs and we we chose apps that [5:36] had decent install bases because we this [5:39] isn't this isn't really about the apps [5:42] themselves and developers we're not [5:44] critici we're not here to criticize [5:45] Developers for um the way they make [5:48] their apps this is all about the SDK and [5:50] the way it transmits data with or [5:53] without user [5:55] consent so take you quickly through our [5:58] analysis methodology [6:00] had a Android uh an Nexus 5 running [6:03] Android 8.1 connected through a virtual [6:06] machine running mitm peroxy which is a [6:10] man- inthe middle proxying tool um and I [6:12] did it transparently so the app didn't [6:14] know that it was being intercepted and [6:15] we had a look at what the data was that [6:17] was going between the app and [6:22] Facebook so our first finding was that [6:25] over 61% of the apps we tested [6:28] automatically transferred [6:30] dat before the user has any other like [6:32] they literally just open the app so [6:34] that's 21 out of [6:38] 34 so for example here's kayak and uh as [6:42] you'll see pretty much immediately from [6:45] when the at is clicked that first [6:46] request is straight to graph. [6:48] facebook.com and it sends a whole load [6:50] of other data to many other companies [6:52] and besides and it well I could let this [6:56] go on for a while but ultimately you end [6:58] up on their home screen which is kind of [6:59] amusing cuz it's got this at the bottom [7:01] of it which is don't worry we'll never [7:04] share anything without your [7:08] [Music] [7:13] permission so so let's take a look at [7:15] some of this in slightly more detail and [7:17] this is a this is pretty standard this [7:19] is a VK the Russian social network um [7:24] and there ra is pretty typical of how [7:27] the SDK is implement M and I'm guessing [7:30] probably in the default state which is [7:32] the app doesn't have initialize when the [7:34] SDK is first load saying SDK initialized [7:37] and then when the app is in foreground [7:39] it's got activated app and then when the [7:41] app goes to background it sends a [7:42] message saying deactivated app and when [7:43] it comes back and when you close the app [7:45] it says deactivated app so you can [7:47] actually start to profile like how long [7:48] a user using an app how often they're [7:50] opening the app this kind of stuff and [7:52] uh if you look at some of this data if [7:54] you're able to see it well clearly um [7:58] you got a unique ID that [8:00] is well we we proport is personal data [8:03] because it's uniquely attached to your [8:06] browsing and whatever your app usage and [8:09] there's some other extraneous data on [8:10] here that's also quite quite telling [8:13] it's got um it's got stuff like what [8:16] version of Android you're running what [8:18] the device you're running on what your [8:19] keyboard local localization is you know [8:21] your time zone you're getting quite a [8:23] picture just from this one app of like [8:26] someone and then it doesn't take much to [8:28] go be Beyond [8:30] that so our second finding is some apps [8:33] also routinely send Facebook data that [8:35] is incredibly detailed and sometimes [8:36] sensitive this isn't a particularly new [8:38] finding there have been other people so [8:41] a good shout out to Exodus privacy who [8:43] also reported about the baby Plus app [8:45] and uh and mobile shiz who also earlier [8:50] this week week I think reported about um [8:53] the pregnancy Plus app that sends [8:54] granular data so here's some examples we [8:56] found in our data search so the top [8:59] example here here is kayak and kayak [9:01] sends your entire search to Facebook [9:04] every time you do a search in their app [9:05] which is lovely so and it's interesting [9:08] what they send because it's not just um [9:11] it's not just the content of your search [9:13] it's also some other stuff like your [9:15] user score whatever that is and it's got [9:17] uh OB fiscated session IDs and all sorts [9:20] of other things that they're sending to [9:21] Facebook um the other one that's on the [9:24] bottom here is the King James Bible uh [9:27] and it's quite typical of a lot of ways [9:29] the app developers implement the SDK it [9:31] allows them to track your usage through [9:34] the app so um this one when I originally [9:39] tested it they've actually made their [9:40] data slightly less granular but when I [9:41] originally tested this app um it [9:44] actually told you which verse and [9:45] passage of the Bible you'd read which is [9:48] what Facebook needs to [9:53] know so and then the last bit is the the [9:56] actual advertising data that Facebook [9:58] uses and this is a a a request to the ad [10:02] Network and uh some slightly interesting [10:04] stuff that that comes from here is that [10:07] you know like the device is on charge [10:09] the M the battery percentage is full [10:11] there's free space and this isn't this [10:13] isn't even uh the most comprehensive [10:15] example I've seen other data on there [10:17] such as accelerometer positions other [10:20] slight interesting thing again all [10:22] linked with the uh the app ID the other [10:25] thing here is it's got at the top there [10:26] copper false which is the American Child [10:29] Protection uh child Privacy Act and uh [10:34] it's somehow decided that I'm not a [10:36] child even though it never asked me [10:42] so so and yeah and it's crucial to [10:45] remember this happens whether you're a [10:46] Facebook user or you're not a Facebook [10:48] whether you're logged in or you're not [10:49] logged in so it's making profiles are [10:52] being made regardless of whether you're [10:54] having a Facebook account or you don't [10:55] have a Facebook account what you have to [10:56] use is some of these apps and a profile [10:58] is being built [11:07] potentially so why does this matter why [11:09] does any of this [11:12] matter so our analysis obviously only [11:15] focus on the data that ABS transmit and [11:17] we can't possibly uh say with def [11:21] definity how this data is being used but [11:24] here's what's really interesting is [11:26] that our first finding is that the vast [11:28] majority of apps share data the second [11:30] it's opened and the data that is being [11:32] transmitted um indicates what kinds of [11:35] app you use when you use them combined [11:38] with a unique ad ID and knowing what [11:40] kinds of apps somebody uses and when can [11:43] give quite a detailed uh picture of [11:44] someone's life so these are four apps [11:47] that we have actually tested the first [11:48] one is a Muslim prayer app the second [11:51] one is a period tracker indeed is a job [11:53] search um app and My Talking Tom is a [11:56] children's app so what kind of person [11:58] could that be that looks like a person [12:00] who is likely Muslim likely female [12:03] likely looking for a job and likely have [12:05] who likely has a [12:07] child so in our analysis the apps that [12:10] automatically transmit data it all comes [12:12] together with a Google ad ID that's a [12:14] user resettable unique ID that also in [12:18] our previous work on data Brokers and [12:19] attech companies is primarily used for [12:23] uh connecting different profiles [12:24] together even though we don't know what [12:26] is happening to this data it would be [12:28] pretty straightforward to link it [12:30] up there's also a second reason why this [12:32] data is uniquely interesting and that is [12:35] knowing what kinds of app hundreds of [12:37] millions of people use and when they use [12:39] them gives gives quite a unique insight [12:42] into the Android app market so if [12:44] combined event data such as app [12:47] installed SDK initialized and deactivate [12:49] app from different apps uh offer a very [12:52] detailed insight into the usage behavior [12:54] of hundreds of millions uh of people on [12:57] abs [13:00] and again we have deliberately focused [13:02] on app that have a lot of installs at [13:04] least 10 million and some have even 500 [13:06] million installs so combined we're [13:09] looking at over two billion installs and [13:11] the kinds of data that these apps share [13:13] that really matters because it's a lot [13:15] of [13:17] data the question though is why do so [13:20] many apps share data with Facebook the [13:22] second that the app opens there are [13:25] obviously many reasons and some of these [13:27] are even good reasons y app use y apps [13:30] use third party tracking and sdks such [13:33] as the Facebook SDK um so what the [13:36] Facebook SDK for Android does it allows [13:39] app developers to integrate their apps [13:41] with Facebook's platform and it contains [13:43] a number of main components such as [13:45] analytics ads or [13:47] login so this is the reason why apps or [13:49] some apps choose to use the SDK now [13:52] here's where it gets a bit [13:54] complicated Facebook places this sole [13:56] responsibility on apps to ensure that [13:59] the data that they collect and [14:01] ultimately transmit to Facebook has been [14:03] obtained legally and we've reached out [14:06] to Facebook and they confirm to us again [14:08] that um it places a legal and cont [14:11] contractual obligation on the developer [14:14] who they see as the data controller to [14:16] get consent as it is required for the [14:19] use from users before sharing data with [14:21] Facebook via the [14:23] SDK however the kind of data sharing [14:26] that we've observed in the majority of [14:28] apps is the called implementation of the [14:30] SDK that's nothing we discovered that's [14:33] clearly uh admitted by Facebook in the [14:36] quick start guide for Android so when [14:38] you use the SDK it's default [14:40] implementation automatically transmits [14:44] data since May and what happened in May [14:46] gdpr entered into Force um lots of [14:49] developers have been filing back reports [14:51] about The SDK um on the right you see [14:53] one of them but there are many you can [14:55] search uh Facebook's developers platform [14:57] for them this one from July 24th [15:00] somebody complains that they wanted to [15:01] integrate the login uh but the moment [15:04] the app opens it transmits people's ad [15:06] ID and they're not allowed to do this so [15:08] the reason why developers complained is [15:11] that when apps share data the second [15:13] they're opened you're unable to ask [15:14] people for their explicit and ambiguous [15:17] permission which is the bar for consent [15:19] that gdpr [15:22] requires so Facebook released the [15:24] feature uh and that feature delays what [15:26] they call the automatic event logging [15:29] but that feature was only released in [15:31] June and we in our conversation with [15:33] Facebook prior to this publication [15:36] Facebook confirmed to us in writing that [15:38] prior to the introduction of this delay [15:40] option developers were able to disable [15:43] the transmission of data but that [15:46] doesn't include something they call a [15:48] signal that the SDK has been initialized [15:50] and this is exactly what we've observed [15:52] in our research and just as a reminder [15:55] the signal that the SDK has been [15:57] initialized that's data that that that [15:59] gives a strong indication somebody's [16:01] what kind of app somebody uses and when [16:03] they're using this combined with their [16:05] Google ad [16:07] ID the big question is of course is this [16:10] even [16:11] legal and we have a very long section in [16:14] our report that explains this in a lot [16:16] of detail because it is very complicated [16:19] but what this analysis shares is that we [16:21] think that the responsibility is a lot [16:24] more complicated than saying this is [16:26] entirely the responsibility of ABS um um [16:30] so since we've done this analysis in the [16:32] UK and the UK is still a member of the [16:34] European Union and has implemented the [16:37] gdpr that's one legal framework that [16:39] applies we also looked at the eprivacy [16:41] and we also looked at competition law in [16:44] the underlying seam is who has what what [16:46] kind of [16:49] responsibility so the question is what [16:52] should Android developers do what should [16:53] Andro developers do well up your privacy [16:57] game again we looked at large abs that [16:59] have lots of significant resources at [17:01] the very least ABS should comply with [17:03] relevant privacy laws and I'm saying [17:05] this so clearly because we've seen ABS [17:07] that have like two paragraphs of privacy [17:09] policies and that is unambiguously [17:12] non-compliant [17:14] um but we also sort of like you have a [17:17] responsibility like to not transmit data [17:19] that doesn't need to be transmitted so [17:20] data minimization and giving people an [17:23] actual choice and it was quite [17:24] interesting we reached out to all of the [17:26] 21 apps that automatically transmit data [17:29] as well as those that share much more [17:31] detailed uh data and it was very [17:32] fascinating to see the very different [17:34] responses that we got from companies [17:36] some we had the impression didn't fully [17:39] understand the SDK and what the SDK does [17:41] when some had a very different [17:43] interpretation of what they should do [17:45] legally um some didn't really didn't [17:48] realize that this is happening and [17:49] promised that to update their apps um we [17:53] need to give some credit to Skyscanner [17:55] this is the only app that got back to us [17:57] within 3 days and said thanks very much [17:58] much we've already immediately updated [18:00] our app and this is no longer happening [18:02] we haven't been able to test it [18:09] um and there's also been an app the [18:11] Weather Channel they updated their app [18:13] immediately after we tested it in [18:14] December but basically the the responses [18:17] were quite VAR varied and the general [18:19] impression is that apps that have a [18:21] gigantic user base need to do a better [18:23] job at the same time however I think our [18:26] research also gives some thoughts to [18:29] rethink third party tracking on [18:31] ABS even if our legal analysis says it's [18:34] a little bit more complicated um the [18:36] Facebook says the responsibility is with [18:38] apps so integrating if you the moment [18:41] you integrated a third party tracker [18:43] this comes with risks and so the [18:45] question is do you really need to [18:46] integrate the SDK and if you integrate [18:48] it can you do it selectively you [18:51] shouldn't assume that the default [18:52] implementation is compliant and um [18:55] whenever you implement it be very fair [18:57] and transparent to both's user [18:59] about exactly what it is you're doing [19:00] and how you're collecting [19:02] data so what should Facebook and Google [19:10] do so privacy by Design and by default [19:13] is not just a principle for data [19:14] protection but it's also something [19:16] that's quite relevant here um we don't [19:20] really Facebook got back to us [19:21] explaining the many different ways that [19:23] developers are able to delay the kind of [19:25] logging and or like or change the way [19:28] that the SDK works but to the best of [19:30] our knowledge there's no good reason uh [19:33] why the default shares data [19:35] automatically so if you're selling a [19:37] product that allows people to send data [19:39] to you and you make place the [19:41] reliability on the people who do this [19:42] data sharing why shouldn't this be [19:45] privacy friendly by Design and by [19:47] default there's also something [19:49] interesting that happened in both the [19:50] responses that we got from Facebook and [19:52] also Google's initial reaction to the [19:54] research that was published by by the [19:56] Oxford researchers earlier this year and [19:58] that was sort of like but other [19:59] companies also track people um and [20:03] Facebook spent a lot of time in [20:04] parliamentary hearings this year and we [20:06] had the pleasure to watch all of them [20:08] and um in one of these hearings Facebook [20:11] followed up in writing on the US Senate [20:14] hearing and in one of these written [20:16] responses they said it was also the [20:18] topic was also Shadow profiling the [20:20] tracking of non-users across the [20:21] internet and the company said that's a [20:23] standard feature of the [20:25] internet um and Google also pointed like [20:29] Amazon does this Twitter does this Etc [20:32] so in a way we need to reclaim the [20:35] internet like there's no natural law [20:37] that says that every website every app [20:38] you use send such detailed data to [20:40] hundreds of different companies every [20:42] time you use [20:45] them so what can you do so what can we [20:48] do so our response from Google said [20:52] there there's two easy ways to fix this [20:54] problem you just you can Lop out of AD [20:57] personalization [20:59] and you can reset your ad ID so we gave [21:02] that a shot see how that works out so [21:04] this is what happens when you opt out of [21:05] AD personalization so the top is with ad [21:07] personalization on and this is opted out [21:11] it's a big Improvement [21:14] there the uh the actual the real the [21:16] real Improvement is that the flag has [21:18] been changed from True to false but the [21:21] data is increased and it's still being [21:23] sent so yeah [21:26] it's um so you can't really opt out then [21:30] so your best bet well an audience like [21:33] this has probably got one advantage [21:34] you've probably got if you've got an [21:36] Android phone it's probably rooted so [21:38] you could always just [21:39] block graph. facebook.com don't know [21:42] what the what the implications of that [21:44] might be there might be other stuff that [21:45] just stops working but but most users [21:48] don't have rooted phones and so the only [21:51] other real alternative is you could try [21:54] not install apps that use the Facebook [21:56] SDK but good luck working out which on [21:58] those are cuz it's not well indicated on [22:00] any app I ever [22:02] seen so the only other options you have [22:04] is to minimize what your the data you're [22:07] your saying so you could segregate your [22:08] apps have a a different profile in your [22:11] Android device for every app so that the [22:14] the the advertising IDs are separate and [22:17] then you you know your your ID will only [22:20] apply to that one app and obviously you [22:22] can always reset your ID and opt out it [22:24] doesn't really solve much but it does at [22:26] least you know it keeps your Prof [22:28] profile fresh keeps it you know it's the [22:31] time frame that also makes quite a big [22:33] difference to how you are [22:35] profiled so but why should you have to [22:38] do all of [22:39] this so I'm going to release all of my [22:43] uh environment um so anyone can re [22:47] replicate what we've done I'm going to [22:48] do that tomorrow because I need to get [22:50] home and sleep but um so yeah my [22:53] environment is going to go on Pi's [22:54] website um and then all of our [22:56] documentation is also a a on Pi's [22:59] website so if anyone else wants to look [23:00] through what all of the apps we looked [23:02] at do I'd definitely suggest you have a [23:05] look at kayak and I'd just have a look [23:08] at the LED flashlight it's quite [23:10] interesting especially the consent flows [23:13] but um yeah and we're also on tour [23:23] [Music] [23:33] thank you thank you Christopher thank [23:35] you freder for the amazing talk we are [23:38] taking questions uh just to remind you [23:40] there are five microphones two in the [23:42] front and three in the back so queue up [23:45] and we're going to take a question right [23:48] now from microphone too uh what did you [23:51] send to Facebook to get your data did [23:53] you send the advertisement ID because it [23:55] would be kind of nice to ask Facebook [23:57] and then complain to the app apps and [23:58] then ask Facebook again and repeat that [24:00] every week so I have actually done a d [24:02] to Facebook based on my advertising ID [24:05] and they responded out outside of time [24:09] it wasn't until we actually sent them [24:10] that we were going to release a report [24:12] they actually replied to my original daa [24:14] and they claimed they have no data and [24:16] we were going to follow up on this in a [24:17] not too distant future and they're [24:19] releasing a new tools like this clear [24:21] history tool because it's sort of like [24:23] this experience just shows that it's [24:25] excruciatingly difficult to actually [24:27] exercise your data rights if you don't [24:29] have an account so there's a process [24:31] there's a form you can fill out but it's [24:32] sort of like it should be way easier to [24:35] get access to the data that that [24:37] companies hold on you if you don't have [24:38] an account thank you thank you we are [24:41] going to take a question from the [24:42] internet real [24:44] quick uh the internet wants to know did [24:47] some of the apps prevent interception of [24:50] data by pinning Facebook's SDK [24:53] certificates none of them [24:55] did of the ones I tested at least of [24:58] them they were quite happy to send data [25:00] to a man in the [25:03] middle thank you microphone [25:06] one hi thanks for the talk are there any [25:09] open source projects that allow access [25:10] to these kind of sdks with privacy [25:13] sensitive uh [25:15] defaults uh not that I'm aware of I [25:19] don't think not sorry not that I'm aware [25:21] of would this even be permitted by the [25:23] SD terms of service sorry say again with [25:27] this kind of application or uh libraries [25:30] be permitted by Facebook or Google's uh [25:33] terms of API usage or SDK usage we we've [25:37] read them but I I couldn't answer that [25:39] on top of my head [25:41] sorry thank you thank you microphone one [25:45] again uh yeah thank you for the talk it [25:48] was very interesting and uh I think from [25:52] the top of my head that most of the apps [25:54] you researched were free to download and [25:57] now we use usually uh tell the late [26:00] person uh buy your app so you won't be [26:02] the product do you have any indication [26:05] of whether this is actually true this is [26:07] an excellent question and the reason [26:11] so when you confront companies about [26:13] third party tracking in general the the [26:16] the response that you usually get is but [26:18] apps need to monetize or Publishers need [26:20] to monetize and that's why we need that [26:22] much tracking however the truth is that [26:25] this has been the argument for a very [26:26] long time and at the same time the [26:28] tracking has become exponentially more [26:30] invasive and we the argument is still [26:32] that that this is all needed in order to [26:34] show relevant ads and we sort of say [26:38] there are ways to use analytic software [26:41] there are ways to even show ads that are [26:44] fair and transparent to people but sort [26:46] of like but there's such a gap between [26:48] what's what's considered sort of [26:50] Industry practice or what's happening on [26:52] a massive scale and what would be [26:54] considered transparent and fair so [26:56] there's like a massive room for [26:57] improvement movement and that's why I'm [26:59] not buying the argument that that apps [27:01] or companies like Facebook and Google [27:03] say but people need to sell [27:05] ads but [27:09] uh you know if um is the microphone on [27:13] oh yeah uh but do you know if uh Paid [27:15] for apps also participate in this [27:18] tracking we haven't I I didn't do any [27:20] analysis on any paid for apps thank you [27:24] thank you um microphone 5 but since it's [27:27] the default the SDK would be it would be [27:29] really interesting if somebody does that [27:32] test five thank you thank you for your [27:35] research um you focus very much on [27:39] Facebook do you know whether or not the [27:43] other companies such as the big five use [27:48] um um an SDK that similar to this [27:53] one um yeah I didn't really do much [27:56] digging on the other ones but just by [27:58] looking at the logs of they were coming [28:00] in you see an awful lot of other tools [28:03] that developers regularly lose there's a [28:06] tool I think it's called amplitude and [28:08] then there's a there's crash analytics [28:10] from Google I believe and they all I [28:13] believe they must all come in in SDK [28:14] because the way that they send [28:16] consistent data but I haven't tested [28:18] them for what data they're [28:21] sending thank you Mike [28:24] four so my question is twofold the first [28:27] part will be um as you've said and have [28:30] we seen that there is quite clearly a [28:33] legal like they break the law by not [28:37] answering the question and stuff um out [28:39] of experience we know that Facebook's [28:41] legal team is quite strong so would you [28:43] say that there is um a chance of like [28:46] suing them and the second part would be [28:49] uh what do you say if we just automate [28:52] the process to reset the ad [28:55] ID could you say the last part again [28:58] like is is there a way or is it like [29:02] useful if we automate the process to [29:05] reset the personal ad ID so that we can [29:08] just reset the tracking every time yeah [29:11] so to answer your first question we're [29:13] considering what we're going to do next [29:15] that's what I can say on that read the [29:17] legal section like we so read the legal [29:20] section in our analysis so we didn't [29:22] want to summarize it here to because we [29:24] wanted to do ad Justice and it's a bit [29:25] complicated but I think yes there it it [29:27] raises many questions and there have [29:29] been previous cases about the tracking [29:32] of non-users by social plugging and by [29:35] by pixels and so the question is sort of [29:37] like what's the what's the parallel here [29:41] and to answer your second question about [29:42] resetting your ad ID I believe that was [29:44] your question um it's it's it's not very [29:48] obvious because to reset your ad ID on [29:50] an Android device you go into settings [29:53] Google adds reset your Google [29:55] advertising ID and that resets your [29:58] Facebook ad ID as well because it's the [30:00] same ID and so one recommendation in the [30:02] report is also sort of like this is the [30:05] the privacy settings of both Google and [30:06] Facebook are still sort of [30:09] counterintuitive and there is no good [30:12] reason to why the ad ID only resets when [30:15] you reset it manually because we know [30:17] that many people will not understand or [30:19] know what the ad ID is used for and what [30:21] implications resetting it [30:24] has thank you and speaking of the report [30:27] I just like to point out again that it's [30:30] only being published now so you are the [30:33] first people to hear about it and I [30:35] think it deserves a round of [30:37] [Applause] [30:37] [Music] [30:46] applause so the next question is from [30:49] microphone [30:50] through hi um is there a way to delay [30:54] loading the Facebook SDK so that uh [30:56] Facebook wouldn't even have the ability [30:58] to execute code and then send the [31:00] analytics data until you really needed [31:03] to perform the function that you [31:04] initially integrated it for yes there's [31:07] A's a couple of answers to this question [31:09] it's a good question the um so Facebook [31:13] say that any version of the SDK 4.34 or [31:16] later has a delay function in it the [31:21] developers even in latest December are [31:23] still saying that functionality is [31:26] questionable as to whether it works but [31:28] the actual AP the actual graph API and [31:31] it is just an API that you need a key [31:34] for and we think that some of the larger [31:36] apps which we tested such as the wi [31:38] chats and the dropboxes might actually [31:41] Implement their own calls to the API [31:43] rather than going through the SDK which [31:46] is why they don't automatically make [31:47] calls to [31:49] graph [31:51] my thank [31:53] you um microphone tool for a followup [31:57] question so my point wasn't that uh was [32:00] actually not implementing the code [32:01] yourself but using the Facebook code but [32:03] only loading it as soon as you actually [32:05] need it is there a question oh is that [32:09] possible was the question I don't know [32:11] sorry okay thanks thank you microphone [32:16] five hi thank you um seeing the amount [32:19] of data that's transmitted um is [32:22] changing the at ID even making any sense [32:28] yes in the sense that it sends a signal [32:30] that I mean it doesn't change anything [32:32] and we say that very clearly in the [32:33] report you have a new profile it's not [32:35] your old one it's a new one and we know [32:38] how easy it is at least technically to [32:40] relink data Etc but I still think it [32:42] sends a signal that that sort of you do [32:44] want to minimize the granularity of the [32:47] targeting that's happening and at the [32:48] same time you do get a fresh profile um [32:52] we had a little bit of a curiosity and [32:54] that in our analysis the ID did not [32:57] reset when the phone was put reset on [33:00] factory reset uh and Google got back to [33:03] us they said they tested it for several [33:05] different Android devices and they they [33:08] had a different they had different [33:09] findings so we couldn't verify Google's [33:12] tests it might be that this is unique to [33:14] the environment in which we tested the [33:16] apps thank you thank you microphone [33:20] three yeah um hello uh do you have any [33:24] information how it is on Apple devices [33:28] that's a great question that might be my [33:30] project for next year so some of the uh [33:34] The Bu reports that developers filed [33:35] were also about the uh Apple ad ID but [33:38] we haven't we haven't done the the [33:40] research but I'd be really interested to [33:41] read [33:43] it thank you uh microphone three again [33:47] so you showed that when you opt out of [33:50] AD personalization the amount of [33:52] transferred data actually increases um [33:54] do you know what kind of additional data [33:57] that is [34:00] back on the [34:02] slides think that's like for this very [34:05] specific app yeah this and this is uh [34:07] this from skyscan and this is their [34:09] custom app data for origin selection so [34:11] when you go through their process or [34:13] when you when this was tested at least [34:14] when you went through their process and [34:16] you selected what city you wanted to fly [34:18] from it would send data um I don't know [34:22] why it sends more when the uh when [34:25] advertising uh per when person [34:27] personalization is opted out I don't [34:29] know that's but just contractually when [34:32] you opted out you're not allowed Google [34:34] got back to us to say when you've opted [34:35] out of AD [34:37] personalization you're not allowed to [34:39] use this data for ad [34:42] personalization first of all that's like [34:44] a restriction on the on use it's not a [34:46] restriction on collection but also it's [34:48] only a restriction on use for [34:50] advertisement we still think you could [34:52] be using it for different [34:54] purposes EEG surveying or whatever [34:57] things [34:58] thank you Mike five please uh hi so I [35:02] have a question would it make sense uh [35:04] for example that when we uh do this kind [35:07] of research and we say that uh these [35:09] applications are really uh violating the [35:12] privacies to to actually extend the so [35:16] we have the F Droid and this alternative [35:19] uh application stores to add additional [35:21] indication saying look this is a this [35:24] application is very much has a very low [35:26] privacy rate [35:28] and then if somebody wants to download [35:30] it he just can decide like there can be [35:33] like five stars the the user review and [35:36] like one star for the Privacy review and [35:38] just make sure that it's super obvious [35:40] if you're downloading a a privacy [35:43] intrusive app not to download it or just [35:46] just to be aware that what's happening [35:48] that's an excellent point and it would [35:50] be that would be a great feature to be [35:52] implemented um and one of our [35:54] recommendations for Google was that they [35:56] Implement something similar to show you [35:59] know to users on their Play Store they [36:01] already show certain other [36:03] characteristics about the app like [36:04] whether it has inapp purchases and other [36:07] things why don't they show that it's got [36:08] a Tracker attached to it or it's using [36:10] the SD a Facebook Implement integration [36:14] or any of the other things well two to [36:17] add two things one is sort of like the [36:19] play stores they have terms of terms of [36:21] services and and and and they all say [36:23] you have to comply with existing laws so [36:26] what we observe here is also sort of [36:28] like there's a discrepancy obviously uh [36:31] between the terms and how apps behave in [36:33] practice and the other thing I want to [36:35] stress is that for This research we only [36:37] looked at Facebook and Facebook is a a [36:40] Tracker that's present in many apps but [36:42] there are thousands of track of of [36:44] different tracking companies and sort of [36:46] like to assess how invasive an app is [36:49] it's really interesting to see how many [36:51] different trackers they have and the [36:53] research that we referred to at the [36:54] beginning um by Ruben bin and others at [36:58] the University of Oxford they really [36:59] looked at the number of trackers that [37:01] different apps have um and it's [37:03] sometimes it's quite a bit I mean I was [37:06] thank you there is a person at Mike 4 [37:09] who's been waiting since [37:10] forever hi um I was particularly [37:14] interested in your communication with [37:17] the app uh the apps you were like you [37:20] contacted the app developers uh is there [37:24] an option to make these conversations [37:27] public I feel like it would be really [37:30] interesting and it would give me [37:33] somewhat of an angle to attack this [37:38] problem from the customer point of [37:41] view so we contacted the app on December [37:44] 19 and we appreciate that this is an [37:46] unusually busy time of the year um and [37:49] we have added all responses we we [37:52] obviously can't publish the conversation [37:53] but we published the responses that the [37:55] apps shared with us [37:58] and you can find them for each of the [37:59] app you can see the response at the end [38:02] uh and sort of like many apps didn't get [38:05] back to us but if they get back to us we [38:07] would obviously consider to add their [38:09] statements at a later point this is this [38:11] is really brilliant thank you very much [38:13] we have time for a couple more questions [38:15] but and also to be fair some said they [38:17] need more time to evaluate that [38:19] internally so just to be fair um I [38:21] wouldn't interpret a lack of response as [38:24] anything negative just [38:26] yet thank [38:28] I would like to say thank you to [38:30] everyone who's asking questions today [38:32] because you are making talks even more [38:35] amazing than they are so round of [38:37] applause to everyone who has asked [38:39] speakers at least one [38:45] question please do that more often [38:48] microphone one um hi I uh hello um hi [38:55] um uh I have another question related to [38:57] communication sort of um I'm a bit [39:00] surprised of the all the amount of data [39:02] that Facebook is taking um have you ever [39:04] tried to modify the Json a little bit [39:06] and I don't know upload like one [39:08] gigabyte of them and see if Facebook [39:10] drinks it [39:11] [Music] [39:13] [Applause] [39:17] all I think that would give our our [39:20] general counsel a heart [39:23] attack it's interesting though actually [39:25] it actually raises a very interesting [39:27] side point is that some of the apps when [39:29] I tested them they have they're [39:31] communicating with so many trackers that [39:34] it actually like a few of them actually [39:36] crash my environment because it's just [39:38] using up way too much memory trying to [39:40] log all of The Trackers it's trying to [39:41] connect to um and yeah when I changed to [39:46] ad personalization off or opting out of [39:49] AD personalization it actually starts [39:52] well from my experience it's a [39:54] documented bargain on a mitm propy [39:57] that's in their GitHub there's a bug [40:00] where um the Android device starts [40:03] initiating http2 connections without any [40:07] Preamble and mitm broxy can't handle it [40:10] and it just keeps dropping all these [40:12] connections and eventually just floods [40:14] your log with [40:17] rubish thank you I feel like next year [40:19] we might have a talk from someone who [40:21] actually decides to try it out [40:24] microphone to please yeah along the same [40:27] uh ideas is uh since you already fetched [40:32] these [40:33] requests um and they are bound to the [40:35] app ID uh to the ad ID is it possible to [40:39] maybe if uh fun would collect like the [40:43] last [40:44] 1,000 uh ad IDs and just randomly mingle [40:48] them to different profiles so to poison [40:51] them [40:52] all I mean I'm not suggesting to do that [40:55] but would it be possible [40:57] I said it raises a lot of gdpr [41:00] questions you might not want to do that [41:03] I [41:04] guess don't try this at home yeah [41:08] microphone 3 please we have an [41:10] overwhelming number of questions but we [41:12] only have time for one more then thank [41:14] you very much that I can be the last one [41:16] thank you very much for your talk um one [41:19] question um have you any experience in [41:22] how successful is how successful [41:25] Facebook is to link your ad ID with your [41:29] account or what happens when you delete [41:32] your account and um I'm pretty sure [41:36] Facebook still keeps some record of you [41:38] and if they can they use any [41:41] measurements to find you again even if [41:44] you don't have your account anymore so [41:47] Facebook in their privacy policy in the [41:49] cookie policy and in the in the business [41:52] terms for Facebook Pro business terms I [41:55] don't know the exact word on top of my [41:56] head but they ex explain how they use [42:00] data and there are sections that explain [42:02] how the company uses data for people who [42:04] don't have an account um and also in our [42:07] conversation with the company that got [42:08] back to us to say this is how we use it [42:11] um we find that it's still not super [42:15] clear um and and sort of like for this [42:18] specific behavior that we're observing [42:23] um that's a very vague answer but it's [42:26] sort of like it's like we don't we don't [42:27] know what they're doing so we have to [42:28] because we don't know you could you can [42:30] we have to sort of like trust statements [42:32] that are made in the policies and that [42:34] the company made elsewhere but what's [42:36] interesting the responses to Congress [42:38] where Shadow profiling was a big issue [42:40] is the response sort of like various [42:42] purposes are given and the data is [42:45] stored for varying length of time and so [42:47] that's why it's very sometimes a bit [42:49] tricky to figure out exactly what's [42:50] happening with this we'd appreciate if [42:52] that's a bit more transparent yeah thank [42:56] you freder CER Christopher Weatherhead [43:00] from privacy International with an [43:02] amazing [43:03] [Music] [43:03] [Applause] [43:06] [Music] [43:12] talk thank you [43:16] [Music] [43:25] [Music] [43:27] oh [43:30] [Music]