Android's Messages, Dialer apps quietly sent text, call info to Google

Arti­cle based in the study: What Data Do The Google Dialer and Messa­ges Apps On Android Send to Google?

Douglas J. Leith Chair of Compu­ter Systems – School of Compu­ter Science and Statis­tics

Trinity College Dublin, Ireland

28th Feb 2022

Hashed text, phone call logs collec­ted without opt-out nor speci­fic notice

Upda­ted Google’s Messa­ges and Dialer apps for Android devi­ces have been collec­ting and sending data to Google without speci­fic notice and consent, and without offe­ring the oppor­tu­nity to opt-out, poten­ti­ally in viola­tion of Euro­pe’s data protec­tion law.

Accor­ding to a rese­arch paper, «What Data Do The Google Dialer and Messa­ges Apps On Android Send to Google?» [PDF], by Trinity College Dublin compu­ter science profes­sor Douglas Leith, Google Messa­ges (for text messa­ging) and Google Dialer (for phone calls) have been sending data about user commu­ni­ca­ti­ons to the Google Play Servi­ces Clear­cut logger service and to Google’s Fire­base Analy­tics service.

«The data sent by Google Messa­ges inclu­des a hash of the message text, allo­wing linking of sender and recei­ver in a message exchange, » the paper says. «The data sent by Google Dialer inclu­des the call time and dura­tion, again allo­wing linking of the two hand­sets enga­ged in a phone call. Phone numbers are also sent to Google.»

The timing and dura­tion of other user inter­ac­ti­ons with these apps has also been trans­mit­ted to Google. And Google offers no way to opt-out of this data collec­tion.

• Zoom agrees privacy condi­ti­ons, gets low-risk rating from Nether­lands
• Meta sued for 'aiding and abet­ting’ crypto scam­mers
•  
• Ireland: Meta fined $18.6m for brea­king EU’s GDPR
• EU, US close to repla­cing defunct Privacy Shield II

Google Messa­ges (com.google.android.apps.messa­ging) is insta­lled on over a billion Android hand­sets. It’s offe­red by AT&T and T-Mobile on Android phones in the US and comes prelo­a­ded on recent hand­sets from Huawei, Samsung, and Xiaomi. Simi­larly, Google Dialer (also known as Phone by Google, com.google.android.dialer) has the same reach.

Both pre-insta­lled versi­ons of these apps, the paper obser­ves, lack app-speci­fic privacy poli­cies that explain what data gets collec­ted – somet­hing Google requi­res from third-party deve­lo­pers. And when a request was made through Google Take­out for the Google Account data asso­ci­a­ted with the apps used for testing, the data Google provi­ded did not include the tele­metry data obser­ved.

Both apps presently have links on Google Play to Google’s consu­mer privacy policy, which is not app-speci­fic and not neces­sa­rily evident to those who receive the apps preins­ta­lled.

From the Messa­ges app, Google takes the message content and a times­tamp, gene­ra­tes a SHA256 hash, which is the output of an algo­rithm that maps the human reada­ble content to an alpha­nu­me­ric digest, and then trans­mits a portion of the hash, speci­fi­cally a trun­ca­ted 128-bit value, to Google’s Clear­cut logger and Fire­base Analy­tics.

Hashes are desig­ned to be diffi­cult to reverse, but in the case of short messa­ges, Leith said he beli­e­ves some of these could be undone to reco­ver some of the message content.

«I’m told by colle­a­gues that yes, in prin­ci­ple this is likely to be possi­ble, » Leith said in an email to The Regis­ter today. »The hash inclu­des a hourly times­tamp, so it would involve gene­ra­ting hashes for all combi­na­ti­ons of times­tamps and target messa­ges and compa­ring these against the obser­ved hash for a match – feasi­ble I think for short messa­ges given modern compute power."

The Dialer app like­wise logs inco­ming and outgoing calls, along with the time and the call dura­tion.

As the paper states, Google Play Servi­ces disclo­ses that some data gets collec­ted for secu­rity and fraud preven­tion, to main­tain Google Play Servi­ces APIs and core servi­ces, and to provide Google servi­ces like book­mark and contact syncing. It does not, howe­ver, detail or explain its collec­tion of message content or of callers and call reci­pi­ents. As the paper put it, «few details are given as to the actual data collec­ted.»

«I was surpri­sed to see this data being collec­ted by these Google apps, » said Leith.

Leith disclo­sed his findings to Google last Novem­ber and said he has had seve­ral conver­sa­ti­ons with Google’s engi­ne­e­ring direc­tor for Google Messa­ges about sugges­ted chan­ges.

The paper descri­bes nine recom­men­da­ti­ons made by Leith and six chan­ges Google has alre­ady made or plans to make to address the concerns raised in the paper. The chan­ges Google has agreed to include:

• Revi­sing the app onbo­ar­ding flow so that users are noti­fied they’re using a Google app and are presen­ted with a link to Google’s consu­mer privacy policy.
• Halting the collec­tion of the sender phone number by the CARRIER_SERVI­CES log source, of the 5 SIM ICCID, and of a hash of sent/recei­ved message text by Google Messa­ges.
• Halting the logging of call-rela­ted events in Fire­base Analy­tics from both Google Dialer and Messa­ges.
• Shif­ting more tele­metry data collec­tion to use the least long-lived iden­ti­fier avai­la­ble where possi­ble, rather than linking it to a user’s persis­tent Android ID.
• Making it clear when caller ID and spam protec­tion is turned on and how it can be disa­bled, while also looking at way to use less infor­ma­tion or fuzzed infor­ma­tion for safety func­ti­ons.

Google confir­med to The Regis­ter on Monday that the paper’s repre­sen­ta­ti­ons about its inter­ac­ti­ons with Leith are accu­rate. «We welcome part­ners­hips – and feed­back – from acade­mics and rese­ar­chers, inclu­ding those at Trinity College, » a Google spokes­per­son said. «We’ve worked cons­truc­ti­vely with that team to address their comments, and will conti­nue to do so.»

The paper raises ques­ti­ons about whet­her Google’s apps comply with GDPR but cauti­ons that legal conclu­si­ons are out of scope for what is a tech­ni­cal analy­sis. We asked Google whet­her it beli­e­ves its apps meet GDPR obli­ga­ti­ons but we recei­ved no reply.

Leith said it’s not clear whet­her Google’s commit­ments fully address the concerns he has raised.

«In parti­cu­lar, they say they will intro­duce a toggle within the Messa­ges app to allow users to opt out of data collec­tion but that this opt out will not cover data that Google consi­ders to be 'essen­ti­al’ i.e. they will conti­nue to collect some data even when users opt out, » he said. «In my tests I had alre­ady opted out of Google data collec­tion by disa­bling the Google 'Usage and diag­nos­tics’ option in the hand­set Settings, and so the data I repor­ted on was alre­ady judged to be some­how essen­tial by Google. I think we’ll have to wait and see.»

Leith said there are two larger matters rela­ted to Google Play Service, which is insta­lled on almost all Android phones outside of China.

«The first is that the logging data sent by Google Play Servi­ces is tagged with the Google Android ID which can often be linked to a person’s real iden­tity – so the data is not anony­mous, » he said. «The second is that we know very little about what data is being sent by Google Play Servi­ces, and for what purpose(s). This study is the first to cast some light on that, but it’s very much just the tip of the iceberg.» ®

Upda­ted to add

In a follow-up comment two days after this story was publis­hed, a Google spokes­per­son said the data was collec­ted for diag­nos­tic purpo­ses: