No opt-out

Even when minimally configured and the handset is idle, with the notable exception of e/OS, these vendor-customised Android variants transmit substantial amounts of information to the OS developer and to third parties such as Google, Microsoft, LinkedIn, and Facebook that have pre-installed system apps. There is no opt-out from this data collection.

While occasional communication with OS servers is to be expected, the authors of the study say the observed data transmission goes well beyond this and raises a number of privacy concerns.

Prof Leith, chair of computer systems at the School of Computer Science and Statistics in Trinity College Dublin, said: "I think we have completely missed the massive and ongoing data collection by our phones, for which there is no opt-out. We’ve been too focused on web cookies and on badly behaved apps.  

“I hope our work will act as a wake-up call to the public, politicians and regulators. Meaningful action is urgently needed to give people real control over the data that leaves their phones.

Dr Paul Patras, associate professor in the School of Informatics at the University of Edinburgh, said: "Although we’ve seen protection laws for personal information adopted in several countries in recent years, including by EU member states, Canada and South Korea, user-data collection practices remain widespread.

"More worryingly, such practices take place 'under the hood' on smartphones without users’ knowledge and without an accessible means to disable such functionality. Privacy-conscious Android variants are gaining traction though and our findings should incentivise market-leading vendors to follow suit.

Key findings

• With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, eg, a mental health app, a Muslim prayer app, a gay dating app, a Republican news app. There is no opt-out from this data collection.
• The Xiaomi handset sends details of all the app screens viewed by a user to Xiaomi, including when and how long each app is used. This reveals, for example, the timing and duration of phone calls. The effect is akin to the use of cookies to track people’s activity as they move between web pages. This data appears to be sent outside Europe to Singapore.
• On the Huawei handset the Swiftkey keyboard sends details of app usage over time to Microsoft. This reveals, for example, when a user is writing a text, using the search bar, searching for contacts.
• Samsung, Xiaomi, Realme and Google collect long-lived device identifiers, eg, the hardware serial number, alongside user-resettable advertising identifiers. This means that when a user resets an advertising identifier the new identifier value can be trivially relinked back to the same device, potentially undermining the use of user-resettable advertising identifiers.
• Third-party system apps, eg, from Google, Microsoft, LinkedIn and Facebook, are pre-installed on most of the handsets and silently collect data, with no opt-out.
• There may exist a data ecosystem where data collected from a handset by different companies is shared/linked. Notably, the privacy focused e/OS variant of Android was observed to transmit essentially no data.