Well that's terrifying

Edit - this is in DuckDuckGo, which has an option to enable App Tracking Protection (Android only feature). In the past hour it's blocked hundreds of attempts from Google to track my data from non-Google apps. I won't tell you what the data is because it's genuinely horrifying, but you can find it in the thread below.

@TheBreadmonkey

Install the duckduckgo app and enable app tracking protection.

Then watch in horror as it tells you exactly what apps are trying to collect your info, what info and how often.

For example, looking at it right now, 1842 tracking attempts from just 3 apps in the last 7 days.

453 attempts just from my banking app in the last 24hrs... sending info to google and adobe. When you look at what kind of info... here's a list sent to google that was requested 240 times in the last 24hrs.

Device boot time
Gender
Device orientation
Postal Code
Device Model
Unique identifier
App name
Network connection type
Last Name
First Name
Address
Device Name
OS build number
State
Local IP address
Device memory
app version
City
Device brand
Advertising ID
Available storage
GPS co-ords
Headphone status
App install date
System volume
Screen resolution
Timezone
Country
Charging status
Battery level
Cookies
Network Carrier

That's 32 pieces of information sent to google constantly.

Adobe only want about 20 pieces of that information, but asked for it 213 times in the last 24hrs. Most of it the same as above but also requesting your email address, language settings and not so interested in device charging or battery level.

That's 1 app... in 24hrs.

It's worth noting that, this is the number of attempts that were blocked... not the actual times that info was sent. The DDG app blocks it, and my VPN app also has app tracking blocking.

@Anomnomnomaly @TheBreadmonkey What does the app do that a Pi-hole doesn't? I've also got ublock origin and privacy badger for FF, but that doesn't help for apps. I guess the duckduckgo app can break it down by app, which is more interesting for rooting out the culprits.
@Anomnomnomaly @TheBreadmonkey Ok, I've installed the Duckduckgo browser and enabled App Tracking Protection. I guess it's a sort of proxy. I hope it doesn't take over DNS from my Pi-hole though.
@Anomnomnomaly @TheBreadmonkey
Interestingly, Alibaba and AliExpress didn't trigger anything, but my EV charging app did. I like this functionality 👍
@Anomnomnomaly @TheBreadmonkey As does my trading app, grr (not that I have any shares).

@Anomnomnomaly @TheBreadmonkey There's about 10 apps that are transferring data in the background. I highly recommend disabling this unless you really need notifications.

This is a great health check tool, thanks.

@Anomnomnomaly @TheBreadmonkey I've just enabled it for Firefox (which is an exception by default). The ones in the screenshot got past ublock origin and privacy badger.

I also enabled it for the Play Store, WhatsApp and Signal and haven't seen any issues so far.

@davep @Anomnomnomaly @TheBreadmonkey
I saw this exchange yesterday and immediately turned out on.
Loads and loads of info blocked from going out, but I believe (hope) it's not as bad as it looks.
Among the apps being blocked is my banking app. Info is going to Google.
But what it says is that Google is *known for* collecting the following data: ...
I'd be pretty pissed if my banking app sends me email to Google on a regular basis. I would hope there's a less nefarious explanation.
@MennoWolff @davep @Anomnomnomaly @TheBreadmonkey what makes you believe that?
@StOnSoftware @davep @Anomnomnomaly @TheBreadmonkey
Because it's says "known to collect:" and then the same 34 items.
The number of attempts per app is different, but it's the same number of data items for Google all the time. Same for Adobe and other places.
Note that DDG says they're known to collect.... Not "they tried to collect the following items from you".
@MennoWolff @StOnSoftware @Anomnomnomaly @TheBreadmonkey Yeah, I noticed that too. The numbers are always the same for Google or whatever, from different apps (and even the browser if you enable it, which can't send all this info, IIRC).

@MennoWolff @StOnSoftware @davep @TheBreadmonkey

I guess the only question that then prompts me to ask is.... Does it matter how often they ask for it?

The only reason it's asked for is to build a larger/better/more accurate profile of you for advertising... and as some one who actively seeks out and blocks ALL ads and will actually be put off products that are forced in front of my eyeballs... Their attempts are utterly worthless to them because they have zero effect on me.

@Anomnomnomaly @StOnSoftware @davep @TheBreadmonkey
Agreed. But all I'm saying is it might not be the case that all these apps send each of those information morsels to those companies. But you can bet that Google wants to know the unique advertising identifier for every app, so they know that the user of this phone uses this particular set of apps. So all they need is to get my email from one of them and they know everything about me.

@MennoWolff @Anomnomnomaly @StOnSoftware @TheBreadmonkey Yup.

I posted this yesterday by the way, which may be of some use https://infosec.exchange/@davep/114456034554470939

David Penfold :verified: (@davep@infosec.exchange)

Ooh, I just noticed you can now delete your Android Advertising ID. No idea when this appeared or if it's geofenced to the EU. Edit: Settings->Security & Privacy->Privacy Control->Ads 👍

Infosec Exchange

@davep @MennoWolff @StOnSoftware @TheBreadmonkey

UK here, if I go to that setting, I can turn of everything under ads privacy (which I did years ago) and I can 'get a new advertising ID'

But there's no option to delete... maybe I no longer have one because everything is turned off... or it's just not an option outside of the EU because xenophobic fuckwits here listened to billionaire fuckwits who wanted to protect their hidden tax haven assets.

@Anomnomnomaly @MennoWolff @StOnSoftware @TheBreadmonkey I asked for one again and then got the option to delete again. I guess it *is* an EU thing.

@davep @MennoWolff @StOnSoftware @TheBreadmonkey

I just tried it, got a new ad id and then immediately deleted it... so it's not just the EU... I must have deleted mine the same time I turned of all add privacy options... along with all location options and as much as I could for everything else.