Free Android Apps Connect To Thousands Of Tracking And Ad URLs, Research Shows
The average free Android app silently connects to more than 100 different web addresses to serve adverts and track users, according to a paper from French research institute Eurecom.
The worst offenders found on the Google Play store connect to orders of magnitude of up to 20 times more sites. One app that does nothing more than control volume “connects to almost 2,000 distinct URLs” when it’s booted up on a phone.
After downloading more than 2,000 free apps from the Google Play store on to an older Samsung phone, the researchers, led by Luigi Vigneri, opened them one by one.
By routing all the traffic through their own network, they were able to find out every web address requested by the applications, and then categorise them based on what they were returning, from adverts to tracking information.
The researchers found that “unsurprisingly, nine of the top 10 in this set correspond to various web services run by Google. The most popular domain in the list, doubleclick.net, is an advertising platform that tracks end users, and also serves up advertisements”.
More than 40% of the apps examined connected to DoubleClick alone, and the only non-Google service in the top ten was a Samsung site used to serve video ads.
While the presence of advertising in free apps is unlikely to surprise users, the frequent involvement of sites that track personal information is less expected. The good news is that the “vast majority” (73.2%) of apps do not connect with any tracking website; but “a small number of apps do indeed communicate with them”.
One app, Eurosport Player, connected with more than 800 individual tracking URLs; all of the top ten ranked by number of unique connections send information to more than 200 different URLs, with downloads ranging from just 100 up to 10m. Typically, such websites track information such as the “unique device identifier” (UDID) to follow a user across apps. “The issue of online tracking has been vigorously debated in the recent past, and privacy advocates argue that it allows for open-ended profiling of end users,” the paper argues. “Importantly, users are rarely aware of the actual entities that are tracking them, and to what degree … the tracking ecosystem today lacks transparency.”
Again, Google provided the most dominant tracking service applied on the Play Store, Google Analytics, but “in contrast to the results about ad-related destinations”, the researchers found “the mobile tracking ecosystem to be significantly more fragmented, with many more players”.
The researchers argue that the findings demonstrate the downside of the relatively open nature of Android app stores. “The lack of oversight in Android Play Store makes it all too easy for end users to install applications of dubious origin, or those which silently carry out activity that might not be seen favourably by the user … Our results underscore the need for greater transparency in the network interaction of mobile applications on the Android App store [s],” they conclude.
For many years, the Google Play Store only moderated apps after they had already gone live, in contrast to Apple, which has always acted as a rigid gatekeeper to its own mobile app store. But in March, the company shook up its store, introducing human moderators to check apps before they go live.