Investigation reveals free Android apps pass personal data to 3rd parties

Android applications are sharing users' personal data without their knowledge.

According to investigate by Channel 4 News, some leading applications send personal data back from devices to advertising companies without user knowledge. It said that permissions are being granted to the apps once they are downloaded, and the highest 50 free applications are using those permissions to send data to advertisers at the application.

Asked by Channel 4's technology editor Ben Cohen if users can be surprised by the quantity of knowledge being sent out, MWR Security researcher ‘Nils' said: “We found that most of the free applications within the top 50 are using advertising contained in the applications, and that the permission which you grant to those applications is additionally granted to the advertiser.

“If users knew about this, i believe they'd be anxious about it. But right now i don't believe they're acutely aware of the placement and the way widely their information can be utilized.”

MWR Security revealed that a one-off app it built sent text messages from the user's phone, their call log and contacts' details to an advertising company called MobClix, which has not responded to comment requests.

Speaking to SC Magazine, Nils said the advertising space is sold by the appliance developer via MobClix; the permissions allow the third party to access data or add names to the user's contact list or events to their calendar.

He said: “With the Android permission model, the user can decide what the app can access and what it cannot, but plenty of people not make decisions according to that. They provide permission to the third party and hand their trust to the app developer.”

Asked why the advertising companies needed such personal data, Nils said that during many cases, this was freely available to them.

Viviane Reding, vice-president of the ecu Commission who recently announced sweeping changes to the ecu Data Protection Directive, told Channel 4 News that this was a criminal offense "because nobody has the correct to get your individual data without you agreeing to this".

“Maybe you'd like somebody to get this information and agree and it's fine. You're an adult and you may do whatever you would like. But normally you don't have any idea what others are doing together with your data,” she said.

“They are spotting you, they're following you, they're getting information regarding your pals, about your whereabouts, about your preferences. This is under no circumstances what you thought you purchased into after you downloaded a free-of-charge app. That's exactly what we need to change.”