What data do the Google Dialer and Messages apps on Android send to Google? [pdf]
This is a serious report from a serious research institute (Trinity College Dublin). There was previously not much insight into data harvesting by Google Play Services.<p>The terrifying result is that google can easily see (1) which sender sends (2) what (3) to who at (4) what time, and (5) when the user uses the app (6) for how long. It does so by even sending phone numbers and Android ID.<p>Reportedly, Google will clarify something in some legal text after this report came out. I would expect this would be totally illegal in at least the EU. It is about time top executives will receive jail time for these kind of breaches.<p>From the abstract:<p>We report on measurements of the data sent to Google by the
Google Messages and Google Dialer apps on an Android hand-
set. We find that these apps tell Google when message/phone
calls are made/received. The data sent by Google Messages
includes a hash of the message text, allowing linking of sender
and receiver in a message exchange, and by Google Dialer
the call time and duration, again allowing linking of the two
handsets engaged in a phone call. Phone numbers are also
sent to Google. In addition, the timing and duration of user
interactions with the apps are sent to Google. There is no
opt out from this data collection. The data is sent via two
channels, the Google Play Services (i) Clearcut logger and (ii)
Google/Firebase Analytics. This study is therefore one of the
first to cast light on the actual telemetry data sent by Google
Play Services, which to date has largely been opaque.