The smartphone is the primary computer most people use on a daily basis, an essential doorway to the internet that most of us couldn’t imagine going without. But not everything we do on phones is perfectly private. There’s always some data collection going on, whether by the operating system or apps. The user is more in control than ever, especially on iPhone, where Apple has been developing new features to protect one’s privacy. But new research shows that users don’t have perfect control over what the phones share with Google and Apple. The study shows that Android sends 20 times more data to Google than iOS sends to Apple. Google has contested the findings, saying its based on flawed methodology. Apple has also said that the study gets things wrong.
Researcher Douglas Leith from Trinity College in Ireland looked at what sort of data Android and iPhone send back to Google and Android, respectively. He used a Pixel 2 running Android 10 and an iPhone 8 running iOS 13.6.1 for his tests. The iPhone was jailbroken, and the Pixel had Google Play services enabled.
Leith found that both operating systems send telemetry data even when the user hasn’t logged in or has configured privacy settings to opt out of data collection. The OSes also send data to Google and Apple when a user inserts a SIM card or browses the Settings screen. In idle mode, the device connects to back-end servers on average every 4.5 minutes.
The researchers found that preinstalled apps also send data to Google and Apple. Apps like Chrome, YouTube, Google Docs, Safetyhub, Google Messenger, and others ping Google even when they’re not open or used. Apple collects data from Siri, Safari, and iCloud.
Leith measured the amount of data that’s actually sent to the two companies. Android sends 1MB of data at startup compared to 42KB for iOS. Android then sends Google 1MB of data every 12 hours, compared to 52KB for iOS. The researcher also said that Google gathers 1.3TB of Android data in the US alone every 12 hours. Apple collects 5.8GB from iSO devices.
Leith explained that the data that Google and Apple collect is linked to a user’s name, email address, payment card data, and other devices. The constant connections also reveal the device’s IP address, and that would reveal the user’s location.
Both Google and Android told Ars Technica that the study is flawed — here’s Google’s official statement on the matter:
We identified flaws in the researcher’s methodology for measuring data volume and disagree with the paper’s claims that an Android device shares 20 times more data than an iPhone. According to our research, these findings are off by an order of magnitude, and we shared our methodology concerns with the researcher before publication.
This research largely outlines how smartphones work. Modern cars regularly send basic data about vehicle components, their safety status and service schedules to car manufacturers, and mobile phones work in very similar ways. This report details those communications, which help ensure that iOS or Android software is up to date, services are working as intended, and that the phone is secure and running efficiently.
The Google spokesperson also added that it’s not accurate to say that a user can opt-out of telemetry data. Telemetry from the Device Configuration service is required for updating and patching the OS. The spokesperson also challenged the iOS data collection measurements, saying it didn’t capture specific types of data that are routinely collected by smartphones.
An Apple spokesperson also said that the report gets several things wrong. Apple provides transparency and control for the personal data it collects, as well as privacy protections against tracking user location.
The study is available in full at this link.
