When people say that apps are stealing your data, what exactly does that mean?

Submitted ⁨⁨11⁩ ⁨months⁩ ago⁩ by ⁨JCreazy@midwest.social⁩ to ⁨[deleted]⁩

Apps like Temu or TokTok. Or those cheap electronic devices where you have to download a questionable app and register an account. What exactly is being stolen and what is being done with it? Who is doing it? Why?

source

Comments

Sort:hotnew top

ArtVandelay@lemmy.world ⁨11⁩ ⁨months⁩ ago
Data scientist here! In addition to the data points others have mentioned, there is actually a lot more data available than you would think in the form of metadata. How long you spend in the app, how long you stay on a screen before changing, how long you view a TikTok before swiping, which of the default settings you change, into what, all of this is used in machine learning models to help build a more accurate advertiser profile for you.

source
- Cheers@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
  And if this sounds dystopian to you.
  
  I anecdotally got into a CEO data conference, where leaders were discussing strategy and tactics. Biggest topic of the day was, why can’t I track how many times someone sees my physical store/billboard/sign and makes a decision. Geofencing + your cellphone GPS isn’t accurate enough for these guys, they want to know how long you stared at the store, what made you move in, what demographics you belong to, and how can they maximize your likelihood to purchase more stuff.
  
  Why does this matter? People are more likely to buy more stuff in a store wandering around than on a market place where they just swap tabs to get the same thing from somewhere else.
  
  If I can make my store front like temu to get you in and keep you there, then it’s likely you’ll be interested in buying more stuff you didn’t know you wanted.
  
  source
  - ArtVandelay@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Yep, I’ve been at conferences for data science where I hear talking about tracking position in a store using things like Apple air tags for the same reason.
    
    source
    -> View More Comments
- akwd169@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
  
  Art Vandelay
  
  I thought you were an importer
  
  source
  - ArtVandelay@lemmy.world ⁨11⁩ ⁨months⁩ ago
    from industries import vandelay
    
    :p
    
    source
- dependencyinjection@discuss.tchncs.de ⁨11⁩ ⁨months⁩ ago
  Do you have an example on the last sentence. How inference could be used to deduce your age based on behaviour?
  
  Or something to read up on the topic. Sounds intriguing.
  
  source
  - ArtVandelay@lemmy.world ⁨11⁩ ⁨months⁩ ago
    To add to the other great explanation here, if you want to research a machine learning model that could do this, I would start with a model called logistic regression.
    
    source
  - rufus@discuss.tchncs.de ⁨11⁩ ⁨months⁩ ago
    It’s a fancy way of doing statistics and connecting the information they have. Are you interested in Minecraft? That probably says something about you. Do you look up maths homework assignments? We now know exactly which grade you’re in. Do you buy gifts for a graduation ceremony? Diapers or baby shower utensils? Either you or your friends are in the age of having a family. If more data points are connected, you can probably make a very precise prediction.
    
    source
TootSweet@lemmy.world ⁨11⁩ ⁨months⁩ ago
Aside from what everyone else has said, also:

Location data (your phone might be telling companies where you drive/go to where they know your routine and such.)

What commercials you watch; even commercials you watch on devices other than your smartphone.

Search history.

Call history.

Audio/video recordings taken without your knowledge or consent.
source
lemmie689@lemmy.sdf.org ⁨11⁩ ⁨months⁩ ago
This app crossed the line

In a report released last month, privacy commissioners said people who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes — even when the app was not open on their phones.

source
- otp@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
  Don’t worry, they gave everyone a stale donut and an apology email as part of their class action lawsuit punishment.
  
  source
- Nighed@sffa.community ⁨11⁩ ⁨months⁩ ago
  Would they not have had to give access to location services for this to happen though? Google is very good at giving me a “only while using this app” option for this kind of stuff now.
  
  source
  - darganon@lemmy.world ⁨11⁩ ⁨months⁩ ago
    They surely agreed to it, the mixup is that people in general don’t realize how much data and how often Tim Horton’s wants to collect it.
    
    Tim Horton’s should probably just know which Tim Horton’s you’re closest to when you go to place an order, and that’s about it. There’s no reason they should even be allowed to ask to track you all day every day, even if you agree.
    
    That’s sort of the gist of it.
    
    source
    -> View More Comments
db2@lemmy.world ⁨11⁩ ⁨months⁩ ago
Phone number, email, anything else you put in, plus device and connection data. Also, depending on the app, it could steal passwords, cookies, banking info, etc.

source
- sxan@midwest.social ⁨11⁩ ⁨months⁩ ago
  TikTok in particular grabs a list of other installed apps and your entire contacts list as well, IIRC.
  
  source
  - Cinner@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Many social media/messenger apps take your contact list and if deny the request it will disable features.
    
    source
- RightHandOfIkaros@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Apps are also interested in how long you stay on a particular page, whether you tap on any ads, and how often you visit particular parts of the application.
  
  The theft is not generally that they’re collecting the data, the theft comes from them not paying you for it, and also usually not telling you they are collecting it. Taking something of value from someone without compensation and permission.
  
  source
Potfarmer@lemmy.world ⁨11⁩ ⁨months⁩ ago
I find the motion sensing and gps tracking to be the creepiest. Using motion sensing they can know when you put your phone down and pick it up, if it was screen down or face up, and knows when you are walking, running, driving, etc. Combined with GPS it can be used to pretty accurately judge when you wake up, where you go, and how you get there. Lots of apps also don’t “close” when you swipe it away, they continue running in the background, so if you have the setting “only collect data when using the app” it will still collect data until you close it in the background or force stop it.

source
- Adalast@lemmy.world ⁨11⁩ ⁨months⁩ ago
  It is even worse than that. Given the list of data you have provided it is actually possible to discern general activity. You can determine if you are playing video games, working out, watching TV, out on a date, hanging with friends. As long as your phone is in your possession, the patterns for every behavior have a distinct fingerprint for each person. With enough collection, they can be filtered and categorized.
  
  Source: I am an analytical statistician.
  
  source
  - ilinamorato@lemmy.world ⁨11⁩ ⁨months⁩ ago
    I also read about how they can correlate data between users and devices, too; maybe you don’t have location on, but your app can correlate accelerometer data from your device with matching data from the same time from another device on the bus that does have location on. Boom, now they know you ride that bus. Or: everyone connecting from a particular IP address visits a particular restaurant’s menu site from a QR code. Pretty good chance, then, that that IP address is the restaurant’s wifi. Now they can correlate all that data and find out who your friend group is. Even something as simple as knowing that you were near your friends for an extended period of time while they were in an Uber to a venue before a show can help them build a profile about you and your cohort’s interests and behaviors.
    
    source
    -> View More Comments
- tweeks@feddit.nl ⁨11⁩ ⁨months⁩ ago
  That’s true, although I believe you still have to give permission to an app to use this (at least on Android). Not to say that people won’t accept things way too fast.
  
  source
  - ADTJ@feddit.uk ⁨11⁩ ⁨months⁩ ago
    The enhanced permission api was a huge step forward but plenty of apps still just demand permissions up front and lock you out until you grant them
    
    source
  - Railing5132@lemmy.world ⁨11⁩ ⁨months⁩ ago
    To your last point, yes. The average user doesn’t even glance at the permissions before blindly accepting them. It is also true that an alarmingly high number of users/consumers /don’t care/ about basic privacy concerns that affect things like targeted ads, PII, and information that could be used to affect things like credit score.
    
    source
Aceticon@lemmy.world ⁨11⁩ ⁨months⁩ ago
Depending on permissions, just about everything.

The more worrisome of these would be all your contacts, your location (even with Location permissions denied it can still be extrapolated up to a point if allowed to access to information on “WiFi networks nearby”) - which can be used to derive workplace, living place, hobbies and, when crossed with other people’s data, even who you regularly meet with - call history, files in your phone (such as personal photos and stuff you downloaded), sites visited and, even more seriously, actually record what’s being said around your phone and even image as well as track something as intimate as how your phone (and hence you, if its in a pocket) move and when.

All of this is beyond the whole app usage information (what do you do, see and for how long in it) which at least makes some sense to track.

That said, what makes it a problem is not that the app can get that infomation from the phone’s systems but that it can, without your authorization, send it all to a central server - if it couldn’t do the latter all that data capture for processing inside your phone would be absolutelly fine.

source
gorysubparbagel@lemmy.world ⁨11⁩ ⁨months⁩ ago
Along with what others said, things you are interested in, demographic data, etc. The content you choose to watch on tiktok or products you click on on temu reveals a lot of valuable information about what ads might be most effective on you so they can target ads to you.

source
originalucifer@moist.catsweat.com ⁨11⁩ ⁨months⁩ ago
simple, valid personal information can be valuable in aggregate. it is accumulated and sold to ad companies.

these apps are often given permission to look through your phone and report back other data.. more than 'simple'. browsing/shopping history at best, account creds at worst.. its mostly for the same reason; advertising.

source
MystikIncarnate@lemmy.ca ⁨11⁩ ⁨months⁩ ago
Everything. Basically, if it’s not nailed down, they want to take it.

The short list of most common data taken would be app usage stats, not necessarily just for the app in question (eg, tiktok may pull data on how many hours of screen time other apps get, like YouTube or Instagram or literally anything else), GPS info, data about how often you handle your phone (from accelerometer readings), wifi networks including the bssid (mac address) of your router, which cannot be easily changed or masked, sometimes even data from your mic when you’re not using the phone at all.

They know when you’re sleeping, they know when you’re awake, they know when you’ve been bad or good… Oh wait, that last bit is Santa… Isn’t it?

Anyways, I wouldn’t be surprised if a few are bold enough to upload your pictures regardless of if you are posting the images, your browser history, security, device make/model, storage of your device, the list of files in storage, text messages…

Basically, anything that might help them identify you, what you do, where you work, when you work, how you travel, whether you’re in a relationship, how happy you are in that relationship and how long it has been going on… Anything that might lead them to provide more targeted ads. Been in a relationship for a while and you seem happy? Check out these engagement rings. Already married? Here’s some ads about parent stuff. Even something as simple as, hey, you’re single and it’s February, why not try Tinder or Grindr, or (insert app for your preference here).

They want to know everything there is to know so they can get you to buy more crap you probably don’t need, for more than it’s worth, and keep that economic gravy train rolling.

source
- cation@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Also to add to bssid, it is possible (in the majority of cases) to get the exact (and i do mean exact) geolocation of the router whose bssid you have. See geomac by drygdryg on Github.
  
  source
  - MystikIncarnate@lemmy.ca ⁨11⁩ ⁨months⁩ ago
    Fun story: I purchased several wireless access points from an eBay seller, years back, and when I brought them online, our geolocation services on all our phones thought we were several hundred miles away from where we lived for many months. I assume the bssid data was feeding the incongruency.
    
    After a few months, however, whatever database was feeding our devices with bad geolocation data, was updated, and we were once again “located” in the correct spot.
    
    The accuracy of these systems is incredible, it will actually use, not only your own bssid, but also that of complete strangers to try to figure out where you are without turning on GPS. If your personal bssid is weak but your neighbors bssid is stronger, it will adjust your position based on the relative signal strength of each bssid that is detected. In the same way triangulation works with most radio signals.
    
    I’ve seen such systems estimate, with a fair amount of accuracy, client location data on a floorplan where there are a few dozen access points in the space… So it works both ways. In that case I was part of a team at a job where the client had a couple thousand square feet of floor space, and about 12-15 access points to blanket the space in coverage. We could, with some degree of accuracy, follow the location of someone as they moved through the space; knowing where they spent most of their time, and what services in the space were utilized by the guest.
    
    … It was a mid-sized airport.
    
    source
linearchaos@lemmy.world ⁨11⁩ ⁨months⁩ ago
The basic idea is that you build a dossier on everyone. You discover what kind of food they eat, where they live, The size and makeup of their family, their sexual preferences, pregnancies, what kind of porn they watch, where they shop for groceries, where they shop for electronics. You tie together purchases with their credit card to purchases in other apps or even brick and mortar stores. You figure out where they owe money with their education looks like. You look at these things even altogether at some point in your life and go why the hell do I care.

Then 20 years down the road when Chinese companies start pushing out American banks all of a sudden you can’t get a loan for a house or a car . Or maybe you’re going for a job at some point in this data is leaked back out now it’s part of your indelible history.

Perhaps somebody takes it all and throws it into a large language model, All of a sudden they’ve got clarity into your post history on all social media even stuff you thought was private because they know your phone serial number or your home IP address.

Corporations and governments don’t have any business knowing about your private life. They shouldn’t get to make decisions based on your private choices and preferences.

source
ohwhatfollyisman@lemmy.world ⁨11⁩ ⁨months⁩ ago
apart from all the stuff already mentioned, some apps arise from a really insidious industry: blackmail through personal loan apps.

these apps fetch your contact details and the scumbags behind them exploit this info at your cost.

here’s a bbc expose on this with more info: www.bbc.co.uk/news/world-asia-india-66964510

and then there’s sms. especially when bank balance alerts are sent, that’s gold for marketers.

source
KpntAutismus@lemmy.world ⁨11⁩ ⁨months⁩ ago
they mostly do it either because they can sell the data, or can display “more relevant” ads to you, so they can charge advertisers more.

source
- FuglyDuck@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Both, really. They do both.
  
  source
Rediphile@lemmy.ca ⁨11⁩ ⁨months⁩ ago
When most people talk about companies ‘stealing’ their data, it’s just companies doing what they explicitly stated in the terms and conditions and these people agreed to.

The whole Google incognito mode drama right now is a great example of this. It literally always said ‘incognito will not prevent employers, websites you visit, or your ISP from collecting data’ when opening a incognito tab. So yeah, obviously Google also knows what you are looking up and they never implied otherwise at all.

source
- otter@lemmy.ca ⁨11⁩ ⁨months⁩ ago
  
  they explicitly stated in the terms and conditions and these people agreed to
  
  Unwieldy TOS’ have already been found to not be enough because no reasonable person reads all of it. It also doesn’t answer OPs questions
  
  The whole Google incognito mode drama right now is a great example of this. It literally always said ‘incognito will not prevent employers, websites you visit, or your ISP from collecting data’ when opening a incognito tab. So yeah, obviously Google also knows what you are looking up and they never implied otherwise at all.
  
  That’s not what the lawsuit is about, and even if that was the point, which one of “employers, websites you visit, or your ISP” is Google/the browser?
  
  source
  - Rediphile@lemmy.ca ⁨11⁩ ⁨months⁩ ago
    And yet I somehow knew Google was collecting my personal info because it was obvious. That’s the entire point of the company lol.
    
    When someone searches ‘big donkey dicks’ in the url bar … where exactly did they think the browser was pulling those results from? Could it be a website… called Google?
    
    It did exactly what it was described as doing it, which is basically no cookies and no user history (for the user or other users of their computer to see). The TV commercials about buying presents for loved ones never implied anything more.
    
    source
    -> View More Comments
- db2@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Suck that corporate teat harder.
  
  source
  - Rediphile@lemmy.ca ⁨11⁩ ⁨months⁩ ago
    -Sent from my iPhone
    
    source
    -> View More Comments
- Burninator05@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Except Google isn’t my employer or my ISP and (increasingly) isn’t the website I visited.
  
  source