From Ad Identifiers to Global Privacy Control: The Status Quo and Future of Opting Out of Ad Tracking on Android

Abstract: Many mobile apps derive significant revenue from personalized advertising and share detailed data about their users with ad networks, data brokers, and other companies. This third-party tracking has widely been shown to lack transparency and user choice, even though it has been around for more than two decades. Since 2013, Android users can enable the AdID setting on their devices to opt out of interest-based ads. In addition, if applicable, the California Consumer Privacy Act of 2018 (CCPA) gives users an opt-out right from the selling and sharing of personal information, including ad tracking. Users can exercise this right via Global Privacy Control (GPC). Interestingly, prior literature has not studied whether either of these two privacy choice mechanisms - the Android AdID setting or GPC - actually limit tracking. Analyzing the network traffic of 1,811 top-free apps from the US Google Play Store, we find that neither the Android AdID setting nor GPC has substantial impact on apps' data selling and sharing practices. This is despite the fact that at least 70% of the apps we examine must respect the CCPA opt-out right via GPC. Additionally, the European General Data Protection Regulation (GDPR) has worldwide scope for certain apps. In this regard, we show that at least 15% of the examined apps must grant EU protections to people outside the EU, including the GDPR's consent and opt-out requirements relating to ads. We find a lack thereof and conclude that more action is needed to protect users' legally mandated opt-out rights, in both the EU and US.

• The paper finds that neither deleting the AdID nor sending Global Privacy Control signals significantly reduces ad tracking on Android apps.
• It employs legal analysis and both static and dynamic testing of nearly 1,900 top-ranked apps to examine data sharing practices and privacy flag usage.
• The paper recommends integrating unified privacy controls into Android’s settings and Privacy Sandbox to enforce more effective user opt-out.

An Analysis of Opting Out of Ad Tracking on Android: The Case for Global Privacy Control

The paper, "From Ad Identifiers to Global Privacy Control: The Status Quo and Future of Opting Out of Ad Tracking on Android," authored by Sebastian Zimmeck, Nishant Aggarwal, Zachary Liu, and Konrad Kollnig, offers a comprehensive examination of the effectiveness of the current opt-out mechanisms for ad tracking on Android. The research explores both the system-level settings provided by Google and the Global Privacy Control (GPC) signal mandated by the California Consumer Privacy Act (CCPA). The study combines legal, technical, and empirical analysis to evaluate the efficacy of these mechanisms and presents recommendations for future improvements.

Background and Motivation

The mobile app ecosystem heavily relies on advertising revenue, a practice that necessitates the collection of user data. Such data collection poses significant privacy concerns. Google introduced system-level settings in 2013 allowing users to limit ad tracking by opting out of interest-based ads. Additionally, the CCPA, enacted in 2018, requires apps to honor the GPC signal. However, prior research had not empirically validated the effectiveness of these opt-out mechanisms on Android, which this study aims to address.

Methodology

The paper employs a multi-faceted approach combining legal analysis, static and dynamic privacy analysis, and empirical evidence:

1. Legal Analysis: The study first establishes how the CCPA and GPC apply to mobile apps.
2. Static and Dynamic Analysis: A dataset of 1,896 top-ranked Android apps is statically and dynamically analyzed. The dynamic analysis involves running the apps under different conditions (with and without AdID, with and without GPC) to observe data sharing practices.
3. Third-party Analysis: The dataset is scrutinized for connections to third-party ad networks, and the usage of privacy flags like the IAB's US Privacy String and Google's Restricted Data Processing (RDP) is evaluated.

Key Findings

Legal and Technical Insights

• CCPA Applicability: The study finds that a significant portion of apps sells or shares personal information as defined by the CCPA, making them subject to opt-out requirements.
• Effectiveness of Opt-Out Mechanisms: The analysis reveals minimal differences in ad tracking when GPC signals are sent or the AdID is deleted. Approximately 4.48% of the app analyses failed, necessitating further validation of the findings.
• Third-Party Practices: Despite the GPC signal and the deletion of the AdID, third-party trackers continued to access certain identifiers, suggesting the potential for these settings to be bypassed.

Empirical Analysis

• Device Identifier Sharing: Many apps continued to disclose device identifiers like the IP address, albeit the AdID was often inaccessible once deleted.
• Connections to Ad Networks: The number of connections to ad tracking domains showed no significant reduction across the different conditions, indicating that tracking practices persist regardless of opt-out settings.
• Privacy Flags: The values of privacy-specific flags (such as the US Privacy String and company-specific flags) were predominantly set to indicate a lack of opt-out, further reinforcing the ineffectiveness of current mechanisms.

Implications and Recommendations

The findings of this paper carry both practical and theoretical implications:

1. Unified Privacy Setting: The paper argues for a unified system-level privacy setting integrated into Android's operating system to honor GPC signals, thereby consolidating current disparate mechanisms.
2. Evolving the AdID: The authors suggest that Google's AdID-related APIs and settings should evolve towards supporting GPC.
3. Privacy Sandbox Integration: The Android Privacy Sandbox, primarily aimed at providing privacy-preserving alternatives for ad tracking, should incorporate GPC and prevent any circumvention of opt-out choices.

Future Developments

Given the current shortcomings of opt-out mechanisms on Android, future work could focus on:

• Enhanced Enforcement: Strengthening regulatory frameworks to ensure stringent compliance with opt-out mechanisms.
• Cross-Platform Consistency: Extending similar analyses to other platforms like iOS to evaluate their compliance with privacy laws.
• Improved Transparency: Requiring app stores to clearly display information about an app's data practices and compliance with privacy laws.

Conclusion

The study concludes that the current methods for opting out of ad tracking on Android, including the AdID setting and GPC implementation, are largely ineffective. The alignment of deleting the AdID with CCPA opt-out intentions and evolving the system-wide settings towards a unified GPC-based mechanism is crucial. The integration of robust privacy measures into the Android Privacy Sandbox can further enhance user control over personal data in a privacy-conscious mobile app ecosystem.