Google tracks Android users before they open apps, report says

It’s pretty much assumed that using a smartphone means that some company somewhere is tracking you. However, people usually expect to have to actually use the thing before it starts to track their usage. Apparently, for Android users at least, that may not be the case. 

A recent study from D.J. Leith at Trinity College Dublin took a deep dive into the messy world of device IDs, trackers, and analytics cookies on Android devices and found that Google tracks users before they even have a chance to open an app. Leith was able to identify at least 14 cookies, trackers, and device identifiers that are created and stored on Android devices almost immediately upon setup. 

Worse yet, there doesn’t appear to be a way to permanently opt out of any of them. 

“No consent is sought or given for storing any of these cookies and other data, the purposes are not stated, and there is no opt out from this data storage,” Leith wrote in the study. “Most of this data is stored even when the device is idle following a factory reset and no Google apps have ever been opened by the user i.e. they were not set in response to services explicitly requested by the user.”

Leith posits that the reason for this is due to the sign-in process on Android devices. Once you sign in with your Google account, you’re automatically signed into every Google app that comes preinstalled on the device from the Google Play Store to Gmail, and thus, the apps.

Some of the trackers and cookies are easy enough to find information for. One example is the DSID cookie, which Google says is “used to identify a signed-in user on non-Google sites so that the user’s ads personalization setting is respected accordingly.” Leith noted that Google’s explanation is vague and doesn’t gainfully explain where the cookie originates from since it exists on Android devices even if no apps are opened.

Another one of the trackers is the Google Android ID. Leith says this device identifier is made during setup, can survive a factory reset, and transmits data about the user even if they’re not logged into a Google account. 

The report goes on to list everything Leith could find about the 14 trackers that he was able to identify, including where they may have come from, where they’re stored, and how they work. However, the underlying message is clear. Users have to mow through a ton of settings, permissions, and other hoops to put a stop to some of these. There is nothing a user can do to opt-out or delete all of them. 

Google has recently come under fire for its security and privacy practices. Last month, Google drew ire from Android users by forcibly installing SafetyCore on Android devices. It’s a feature that was meant to increase safety by filtering sensitive content. But Google flubbed the launch by installing it on Android devices without consent while also not telling anybody exactly what it does or how it works. Its rollout of the redesigned Results About You tool was much better as it gives people easier access to remove their data from Google Search.