Android App Tracking: Reddit and Google News are HORRIBLE!

Earlier this week, I downloaded and installed the DuckDuckGo app with App Tracking Protection in public beta, and what I found blew my mind. I naively thought that installing uBlock Origin on my mobile Firefox browser was enough. But I found that even beloved apps like Reddit were executing hundreds of thousands of tracking requests. Oh, and Google News is selling out your data to every provider imaginable.

Android App Tracking: 500,000 Tracking Requests from Reddit

I never imagined that Reddit would turn out to be the biggest culprit on my phone regarding tracking. DuckDuckGo’s app tracking report shows you who’s tracking you daily, and here’s a screenshot of my report when I woke up this morning:

Keep in mind that the above is only for one day. Reddit generates well over a hundred thousand app tracking requests daily. It appears to sell your data to a company called “Branch Metrics” and Google.

But if Reddit is the most copious app for tracking, Google News is on a whole new level.

The Google News App Tracks and Sells your Data to EVERYONE

I always thought that Google wouldn’t sell your data outright because…why would you sell to your competitors? It turns out that Google sells your data to a LOT of companies. The number of 3rd parties to whom Google sends your data is so large it doesn’t fit on the App Tracking Protection report. Here’s a screenshot:

Here’s a complete list of 3rd party providers to whom Google sells your data through Google News:

Facebook
The Trade Desk
Amazon
Integral Ad Science
Verizon Media
WarnerMedia
Adobe
Oracle
comScore
IPONWEB
Criteo
Salesforce.com
PubMatic
Microsoft
Index Exchange
DoubleVerify
Smartadserver
The Rubicon Project
LiveRamp
Segment.io
MediaMath
OpenX
Neustar
TripleLift
Centro
Beeswax
RhythmOne
Inmar
Media.net Advertising
Teads
Sovrn Holdings
LiveIntent
Sharethrough
Intent IQ
ID5
33Across
Collective Roll
Bidtellect
Telaria
Synacor
ADman Media
Cognitiv
Exponential Interactive
Sonobi
Kargo
YieldMo
RTB House

That’s huge!

Not Sure if These Trackers are Google’s or the News Site’s Trackers

One explanation I can imagine for why Google News has so many trackers is that it’s not them tracking you but the websites you visit on the app. Kind of how it’s not the browser that tracks you, but the sites you visit. I always assumed that Google had strict requirements for websites that they included in the app, but they dropped the requirement for AMP in June 2021.

So I may be being unfair to Google by attributing all these trackers to them. On the other hand, isn’t Google responsible for protecting users from tracking while using Google News? After all, the app isn’t like a browser where you’re on your own. Google chooses which articles surface on Google News, which implicitly makes them responsible for protecting your privacy.

So even if the sites implement these 3rd party trackers you visit in Google News, I’m not willing to give them a pass.

Android Apps Track you EVEN When they’re Not in Use!

My biggest surprise was realizing that Android apps track you even after you close them. Every app does this – even the brokerage app WealthSimple tracks you after it’s closed. I haven’t tested shutting down an app by “Force Closing” it, but if you switch to another app or even remove it by swiping up the carousel of recent apps, it doesn’t prevent the app from tracking you.

To me, this is utterly unacceptable. Closing or switching to another app should end all tracking from others. And if you’re on your home screen, then you shouldn’t be tracked at all. If some apps require that kind of background data, they should ask for specific permission first.

What Data do Android Apps Collect About You?

For the curious, here are the pieces of information that Android App Tracking Protection blocks:

Email Address
Gender
OS Built Number
CPU Data
Network Connection Type
Last Name
App Version
Local IP Address
Device Brand
Android Advertising ID
Battery Level
Device Boot Time
State
Country
Timezone
Device Model
Device Total Memory
Screen Density
App Name
First Name
City
Device Language
GPS Coordinates
Headphone Status
Postal Code
System Volume
Unique Identifier
Cookies
Device Name
Available Internal Storage
Device Orientation
Charging Status
Screen Resolution
OS Version

That’s pretty much everything! So if you’re expecting apps only to collect data that they “need”, think again.

App Tracking Protection is Better than Apple’s App Tracking Transparency

DuckDuckGo’s app tracking protection feature is far superior to Apple’s App Tracking Transparency feature. While Apple’s iOS prevents companies from selling your personalized data, it doesn’t stop them from collecting your data in the first place. And honestly, what does Apple know about how companies use your data once it’s outside their control? Moreover, apps can still sell anonymized data, separate their users into “cohorts” or “topics,” and target ads based on those metrics.

DuckDuckGo’s App Tracking Protection on Android, on the other hand, prevents companies from collecting any data on you in the first place. This is much more secure, doesn’t rely on the “honor” system, and prevents even anonymized data collection.

App Tracking Protection Mimics a VPN – But Locally

DuckDuckGo’s App Tracking Protection feature simulates a VPN connection without sending any of your data out of your phone to monitor all your traffic. The VPN idea is clever since it lets DuckDuckGo analyze everything and can run in the background without shutting down.

The disadvantage of this approach is that Android doesn’t allow you to run two VPNs simultaneously, so if you want to use an actual VPN, you have to shut down App Tracking Protection for that duration. I don’t know if DuckDuckGo will find another solution to this problem, but it’s a trade-off that I’m more than willing to make.

You Don’t Need to Use the DuckDuckGo Browser

Before installing the app, I was worried that I might be forced to use the DuckDuckGo browser for app tracking protection to work. But there’s no need to worry because it’s an entirely different feature. DuckDuckGo hopes that increased brand awareness and usefulness will encourage you to use their browser, but you’re not compelled to do so.

This is convenient because I love using Firefox Mobile with uBlock Origin and a bunch of other extensions, and I don’t plan to switch any time soon.

I’m Willing to Pay for App Tracking Protection

I know that coding and maintaining software is expensive. But App Tracking Protection is so good that I’m willing to pay. DuckDuckGo should consider spinning it off as a separate application. Not that I’m complaining, of course – free is great! But if they find it unsustainable, I wouldn’t be opposed to paying a few bucks to keep the project afloat.

I Trust DuckDuckGo – For Now!

DuckDuckGo’s unique selling point is its commitment to privacy, and they’ve maintained a consistent posture on this since 2008. So I trust them not to abuse the data they monitor, if only because it would cause their brand irreparable damage were it ever to get out that they sent that data back to their servers.

This is one of the reasons I wouldn’t mind paying for Android app tracking protection because if a product generates revenue, there’s that much less temptation to use the data for other purposes. It’s one of the reasons why I trust Microsoft and Amazon more than Google and Facebook.

3rd Party App Tracking Should be Blocked by Default on Android

I don’t see why I need to install a dedicated application that mimics a VPN to block third parties from tracking me on Android apps. Shouldn’t this functionality be enabled by default? Granted, that might be a tall ask given that Google runs Android, and is itself one of the worst trackers. But in an ideal world, revenue generation would happen through selling services and hardware, not through the backdoor of selling personalized data.

Hopefully, DuckDuckGo’s App Tracking Protection for Android can help make that a reality.