Without consent, 20+ popular apps are sending your data to FB

A research published by Privacy International has found that over 61% of the 34 popular Android apps are sending user data to Facebook without permission, even if you don’t have a Facebook account.

In an ever growing scandal surrounding Facebook and its practices, the explosive study by Privacy Internation suggests that these apps send out extremely minute level of detail including advertisement IDs that can be correlated to build the profile of a user even if they have never installed Facebook or don’t have an account.

Facebook routinely tracks users regardless of whether they are logged-in, logged-out, of don’t even have a Facebook account using its Facebook Business Tools. App developers using Facebook Software Development Kit (SDK), share user data with Facebook to aid this.

The full list is available here, however, some of the popular apps that were found to be sending data without their user’s permission are

1. My Talking Tom / My Talking Hank, etc. (over 1 billion downloads)
2. Duolingo (over 100 million downloads)
3. Shazam by Apple (over 100 million downloads)
4. Spotify (over 100 million downloads)
5. TripAdvisor (over 100 million downloads)
6. VK (vkontakte) (over 100 million downloads)
7. Calorie Counter by MyFitnessPal (over 50 million downloads)
9. Indeed Job Search (over 50 million downloads)
10. Muslim Pro (over 10 million downloads)
11. Qibla Connect® Find Direction- Prayer, Azan, Quran (over 10 million downloads)

What is being transmitted to Facebook?

The analysis by Privacy Internation suggests that these apps transmit the status of the app first by sending “App Installed” or “SDK Initialized”, revealing the fact if a particular user is using a particular app.

E.g. if a person has “Indeed Job Search” installed, and also has “Muslim Pro” installed, it can be inferred that the person is a Muslim and is looking for a job, even though the person might not consent to revealing his religion.

The apps automatically share this data along with the Google advertising ID (AAID) which lets Facebook build a profile for a users.

Similarly, if a person has “Period Tracker Clue” installed and has “Talking Tom” installed it can be inferred that the person is either an adolescent girl or a woman with a kid. Both potentially violating right to privacy.

What makes it worse is that these details are sent to Facebook at the launch of an app, i.e. even before the user can provide or revoke consent.

All of these findings indicate that Facebook could have violated GDPR and other Privacy laws in Europe and other places.

Source: Privacy International