From Newsgroup: alt.privacy

Google was found liable for collecting user data even after users had
disabled tracking features like Web & App Activity in their account
settings.

This article is a bit confusing, but the net is Google lost the case.
<https://www.bbc.com/news/articles/c3dr91z0g4zo>

"Google's collection practices extended to hundreds of thousands of
smartphone apps, including those for ride-hailing companies Uber and Lyft, e-commerce giants Alibaba and Amazon, and Meta's social networks Instagram
and Facebook.

Google says that when users turn off Web & App Activity in their account, businesses using Google Analytics may still collect data about their use of sites and apps"

More details:
<https://evrimagaci.org/tpg/google-ordered-to-pay-425-million-in-privacy-case-497081>
<https://en.somoynews.tv/news/2025-09-04/OCZMBXsA>

Google didn't clearly disclose that disabling tracking wouldn't stop third-party app data collection.

The court found this violated users' reasonable expectations of privacy.

The lawsuit revealed that Google's data collection extended to hundreds of thousands of apps across both Android and iOS platforms, including major
names like Uber, Lyft, Amazon, Instagram, and Facebook2. These apps often
use Google services like Firebase, Google Analytics, or embedded ad tech,
which allowed Google to gather user activity data-even when users had
disabled tracking features like "Web & App Activity" in their Google
account settings.

So even if someone was using an iPhone and thought they'd opted out of tracking, Google could still collect data through third-party apps that integrated its tools. The court found this practice deceptive because users weren't clearly informed that disabling tracking didn't stop data
collection via other apps.

This case is a wake-up call that the platform doesn't guarantee privacy as
what matters is which services are embedded in the apps you use.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On 09/04/2025 06:17, Marion wrote:

So even if someone was using an iPhone and thought they'd opted out of tracking, Google could still collect data through third-party apps that integrated its tools.

Is this an iPhone or Android or both violation of privacy?
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Thu, 4 Sep 2025 07:54:10 -0400, badgolferman wrote :

So even if someone was using an iPhone and thought they'd opted out of
tracking, Google could still collect data through third-party apps that
integrated its tools.

Is this an iPhone or Android or both violation of privacy?

Hi badgolferman,

Great question. The problem is Google gives the developers its code.
Those developers use Google's code in both iOS & Android applications.

Hence, unfortunately, it's both platforms as developers integrate Google
APIs such as Google Analytics into both operating systems; but the good
news for iOS is that it's a little less worse on iOS than it is on Android.

The court found that Google continued collecting user data even after
people disabled tracking features like Web & App Activity. This was
possible because many third-party apps (including Uber, Lyft, Amazon,
Instagram & Facebook) have integrated Google services like Firebase and
Google Analytics. These integrations allowed Google to gather user activity data regardless of the device's operating system.

So even if someone was using an iPhone & thought they'd opted out of
tracking, Google could still collect data through those apps. The key issue wasn't the phone OS itself. It was the embedded Google services inside the
apps users interacted with.

Google's argument, of course, is that they didn't do it. Facebook did it.
Or Uber did it. And Lyft did it. But the court didn't fall for the ruse.

Google plans on appealing because Google claims that the jury didn't
understand them. Personally, I think the jury understood all too well.

This case is a reminder that privacy controls on your mobile device or
account don't always extend to the services running behind the scenes.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Thu, 4 Sep 2025 09:17:30 -0700, AJL wrote :

This article is a bit confusing, but the net is Google lost the
case. <https://www.bbc.com/news/articles/c3dr91z0g4zo>

$425m ?? That would be like pennies to you and me. My guess is that
Google is more worried about the bad publicity...

Yes, but, it's a little like saying Apple can break the law by brazenly
lying about their batteries because Apple can afford to be above the law.

Just because you can afford to push little old ladies out of your way when
you want to cross a street doesn't mean that it's something you should do.

It irks me whenever someone says Apple and Google don't ever have to follow
the law just because they can easily afford to pay the legal penalties.

It used to be Apple only told the truth in court, and then it changed to
even in court, Apple never tells the truth - and now Google is doing it.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Thu, 4 Sep 2025 21:15:21 -0700, AJL wrote :

Yes, but, it's a little like saying Apple can break the law by
brazenly lying about their batteries because Apple can afford to be
above the law.

You misunderstand my meaning. I meant that if they really wanted to get Google's attention the fine should be substantially larger. $425m is
chump change to a company the size of Google.

Oh. I see. Yes. I agree. I apologize. I thought you were minimizing the
law, which is something I see a lot happening on Apple newsgroups.

It seems Google plans on fighting this verdict, where Google's point
appears to be that they got our data from Lyft, so it's not Google's fault.

It irks me whenever someone says Apple and Google don't ever have to
follow the law just because they can easily afford to pay the legal
penalties.

Exactly. Make the fine something that actually hurts the company's
bottom line and things just may change. But not so big that they start charging me for their services... 8-O

Thanks for explaining your point, where, given I don't have a Google
Account on my phone, I'm trying to figure out how this whole thing works.

I'm running through the scenario on the net what happens whey we use Lyft.

Apparently, even if we disabled tracking in our Google account (like
turning off Web & App Activity), our data could still flow to Google
through Lyft's use of embedded Google services, and apparently specifically
the Firebase SDK.

As far as I can piece it together, assuming I'm on my iPhone, the iOS Lyft
app uses the Firebase SDK that Lyft integrated using Google's Firebase SDK.

Apparently Firebase is an iOS/Android SDK toolkit that helps developers
with analytics, crash reporting, performance monitoring "and more".

It seems that Firebase collects what Google calls "automatically collected events" which apparently include "Page location" (which screen we're on),
"Page referrer" (how we got there), "Page title", "Device info", "app usage patterns" & possibly "ride-related metadata", whatever data that may be.

Note that this data collection is independent of our Google Account
Settings as this data collection happens outside of our Google account.

So even if we turned off tracking in our account settings, iOS/Android
Firebase still collected and sent our private data to Google's servers.

With respect to the case that Google just lost, apparently the court found
that Google didn't clearly inform users that disabling tracking wouldn't
stop data collection via third-party apps like Lyft. This was deemed
deceptive and a violation of users' reasonable expectations of privacy.

Keeping in mind badgolferman's question, when I look at the difference
between Android & iOS, it appears that iOS has stronger privacy controls,
but iOS doesn't block the Firebase SDK from operating inside the Lyft app unless the Lyft app itself restricts it. It seems that Apple's App Tracking Transparency (ATT) doesn't cover server-side SDKs like Firebase unless the
Lyft app explicitly opts out.

Does it?
I don't know.

Bottom line?

Even on iOS, if we took a Lyft ride, our app-usage data (such as which
screens we visited, how long we stayed and possibly contextual info about
our ride) could easily have been sent to Google via that Firebase API.

The issue the court determined was that this privacy loss happened
regardless of our Google account settings & without clear user consent.

On both platforms.

This is already too long, but I started researching the pros and cons of
this scenario between iOS and Android and it appears to be rather complex.

On both platforms, Firebase in the Lyft app can still send analytics and
usage data to Google even if Google account tracking is turned off. iOS may give more up-front warnings and require disclosure, but neither OS blocks
this by default.

Let me dig deeper into figuring out the differences for badgolferman.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Fri, 5 Sep 2025 04:51:28 -0000 (UTC), Marion wrote :

On both platforms, Firebase in the Lyft app can still send analytics and usage data to Google even if Google account tracking is turned off. iOS may give more up-front warnings and require disclosure, but neither OS blocks this by default.

Let me dig deeper into figuring out the differences for badgolferman.

Aurgh. It's complicated. Sometimes Android is better. Sometimes it's iOS.

iOS has some advantages in this Lyft and Firebase situation as iOS shows
more privacy prompts by default, has App Tracking Transparency to block
certain cross-app tracking, and requires developers to submit a privacy manifest that discloses what SDKs like Firebase collect before the app is approved in the App Store.

However, iOS does not block analytics that happen entirely inside a single
app and are sent to a server. That means Firebase can still collect usage
data from Lyft unless Lyft itself disables it. That mandatory iOS privacy manifest is only a disclosure requirement, not a technical block.

It turns out that Android has some advantages too. The Google Play store
has a Data Safety section where developers must declare what they collect,
and Android offers privacy indicators for microphone and camera use plus location precision controls. Power users can inspect or even modify apps by sideloading, which we know iOS does not allow without jailbreaking.

Note: See my thread on Android showing Google is copying Apple's tricks.
From: Marion <marion@facts.com>
Newsgroups: comp.mobile.android
Subject: Google getting more and more like iOS
Date: Tue, 26 Aug 2025 03:32:52 -0000 (UTC)
Message-ID: <108j9t3$2s44$1@nnrp.usenet.blueworldhosting.com>

The downside for Android is that its defaults are more permissive toward background data collection, Firebase is deeply integrated into the Google ecosystem, and there is no OS-level enforcement like Apple's privacy
manifest before store approval.

In short, the court apparently determined that on both platforms Firebase
in the Lyft app can still send analytics and usage data to Google even if Google account tracking is turned off. iOS may give more warnings and
require disclosure, but neither operating system blocks this by default.

Sigh. We're screwed. :)
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On 05/09/2025 03:02, Marion wrote:

This case is a reminder that privacy controls on your mobile device or account don't always extend to the services running behind the scenes.

Do you know if these basic Android controls are any different with the modified Android OSs such as GrapheneOS and LineageOS?
--
Jeff
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

badgolferman <REMOVETHISbadgolferman@gmail.com> wrote:

On 09/04/2025 06:17, Marion wrote:

So even if someone was using an iPhone and thought they'd opted out of
tracking, Google could still collect data through third-party apps that
integrated its tools.

Is this an iPhone or Android or both violation of privacy?

It's both plus a webapp issue. At the core seems to be the ubiquity of
google analytics. If you block cookies and related code plus never browse
while still logged into google yup should be OK.

For me this is clearly more evidence that google can't be trusted and by extension android is a risk.

This re4200m fine in France is another example: https://www.theregister.com/2025/09/04/france_google_shein_cookie_fines/

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

Marion <marion@facts.com> wrote:

On Thu, 4 Sep 2025 09:17:30 -0700, AJL wrote :

This article is a bit confusing, but the net is Google lost the
case. <https://www.bbc.com/news/articles/c3dr91z0g4zo>

$425m ?? That would be like pennies to you and me. My guess is that
Google is more worried about the bad publicity...

Yes, but, it's a little like saying Apple can break the law by brazenly
lying about their batteries because Apple can afford to be above the law.

Just because you can afford to push little old ladies out of your way when you want to cross a street doesn't mean that it's something you should do.

It irks me whenever someone says Apple and Google don't ever have to follow the law just because they can easily afford to pay the legal penalties.

This is the American way and has been for a very long time. The law only applies to the average shmoe. Trump is the embodiment of this.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Fri, 5 Sep 2025 08:01:13 +0100, Jeff Layman wrote :

This case is a reminder that privacy controls on your mobile device or
account don't always extend to the services running behind the scenes.

Do you know if these basic Android controls are any different with the modified Android OSs such as GrapheneOS and LineageOS?

I'm sure they are!

GrapheneOS is built from the ground up for privacy and security, which,
funnily enough, is what Apple says iOS is built for.

The biggest privacy boost in GrapheneOS, much like with iOS, is that it
does not include Google Play Services by default, so there is no automatic
data sharing with Google.

In addition, again, much like iOS has, GrapheneOS also has stronger app sandboxing than native Android has, plus advanced permission controls, and
like iOS, even global toggles for sensors like the microphone and camera.

Since Google services are not integrated into GrapheneOS, settings like Web
and App Activity do not apply unless you opt in - just like with iOS.

Much like iOS, GrapheneOS also delivers frequent security updates and
enforces protections like Verified Boot and rollback prevention.

On the other hand, LineageOS is more focused on customization and
flexibility. It can be installed with or without Google apps, depending on whether you use GApps or MicroG.

However, adding those services reintroduces some tracking.
Older versions of LineageOS included Privacy Guard, which allowed users to restrict app permissions, but it is less advanced than GrapheneOS's
controls.

However, like iOS, LineageOS works on a wider range of devices but may lag behind in applying security patches and does not enforce the same level of hardware-based protections (funnily enough, just like iOS!). :)

If we wish to minimize background data collection and avoid the kind of tracking in that recent court case, I would think GrapheneOS is the
stronger choice.

LineageOS has better device support and customization, but it is not as hardened for privacy out of the box.

Too bad we can't put iOS on Android. :)
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Fri, 5 Sep 2025 09:10:19 -0000 (UTC), Chris wrote :

So even if someone was using an iPhone and thought they'd opted out of
tracking, Google could still collect data through third-party apps that
integrated its tools.

Is this an iPhone or Android or both violation of privacy?

It's both plus a webapp issue. At the core seems to be the ubiquity of
google analytics. If you block cookies and related code plus never browse while still logged into google yup should be OK.

For me this is clearly more evidence that google can't be trusted and by extension android is a risk.

This n200m fine in France is another example: https://www.theregister.com/2025/09/04/france_google_shein_cookie_fines/

I'll agree with anyone, no matter what their prior record, if they make a sensibly logically defensible statement - such as those Chris just made.

Given both Apple & Google lie about privacy, I think neither can be
trusted, where, in this case, the problem extends across the platforms.

If, after the appeal Google has still "lost" this case, then it would seem
to me that the thousands of apps which incorporated Google's spyware code
(on both iOS & on Android), would have to disassociate from that effort.

Only good can come of this if that is what ends up happening in the end.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Fri, 5 Sep 2025 17:10:48 -0000 (UTC), Marion wrote :

The biggest privacy boost in GrapheneOS, much like with iOS, is that it
does not include Google Play Services by default, so there is no automatic data sharing with Google.

After having answered earlier today, I belatedly realized that might not
matter if the data goes from Lyft to Google servers, even with GrapheneOS.

So let me rephrase the answer to Jeff's question as "hell if I know".
Maybe others with experience on GrapheneOS & LineageOS can add value?

It's pretty bad though that hundreds of thousands of iOS/Android apps are uploading our data to Google servers without us knowing that's happening.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

Marion <marion@facts.com> wrote:

On Fri, 5 Sep 2025 17:10:48 -0000 (UTC), Marion wrote :

The biggest privacy boost in GrapheneOS, much like with iOS, is that it
does not include Google Play Services by default, so there is no automatic >> data sharing with Google.

After having answered earlier today, I belatedly realized that might not matter if the data goes from Lyft to Google servers, even with GrapheneOS.

So let me rephrase the answer to Jeff's question as "hell if I know".
Maybe others with experience on GrapheneOS & LineageOS can add value?

It's pretty bad though that hundreds of thousands of iOS/Android apps are uploading our data to Google servers without us knowing that's happening.

So considering privacy has always been your topmost issue, how does this revelation affect your championing of Android over iOS? Does a greater lack
of privacy still trump less functionality?

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Sat, 6 Sep 2025 11:15:45 -0000 (UTC), badgolferman wrote :

The biggest privacy boost in GrapheneOS, much like with iOS, is that it
does not include Google Play Services by default, so there is no automatic >>> data sharing with Google.

After having answered earlier today, I belatedly realized that might not
matter if the data goes from Lyft to Google servers, even with GrapheneOS. >>
So let me rephrase the answer to Jeff's question as "hell if I know".
Maybe others with experience on GrapheneOS & LineageOS can add value?

It's pretty bad though that hundreds of thousands of iOS/Android apps are
uploading our data to Google servers without us knowing that's happening.

So considering privacy has always been your topmost issue, how does this revelation affect your championing of Android over iOS? Does a greater lack of privacy still trump less functionality?

Hi badgolferman,

Heh heh heh.... I love you. But even you don't fully understand me. :)

My motives are pure. Fact based. Logical. Reasonable. Sensible. Rational.

This isn't an "us versus them" datapoint unless you could find something absolutely toxic in Android that iOS didn't have (which hasn't happened).

The sad fact is iOS is a brain-dead operating system that can't do half of
what Android does, so it's a no brainer what my daily drive (DD) device is.

Using iOS devices (which you know I do) is like living inside a prison.
You have to check in with the warden ten times a day when you're on iOS.

Almost every time I touch an iOS device, I'm appalled at how crappy it is. Apple designed it for people who don't actually do anything useful on it.

Given that extreme lack of privacy on iOS and the fact you have to ask the warden for permission to go to the bathroom, iOS will never be my DD.

However, that doesn't mean that I'm "happy" with Android, as just last
night, for example, I wrote a failed tutorial trying to add privacy.
From: Marion <marion@facts.com>
Newsgroups: comp.mobile.android,alt.privacy,alt.comp.os.windows-10
Subject: Privacy: I tried to switch Android WebView to Bromite WebView
Date: Sat, 6 Sep 2025 05:35:04 -0000 (UTC)
Message-ID: <109gh68$234a$1@nnrp.usenet.blueworldhosting.com>

There is no privacy on Android just as there is no privacy on iOS.
But there's a *chance* for privacy on Android - which doesn't exist on iOS.

Having said that, there are two things about privacy I can say are good
about iOS but they alone do not mean that iOS is "more private".

1. iOS does not create a Google Account when you use Google Voice
(so, as a results, I never use GV on Android; I use it on iOS)
2. iOS, apparently, is "slightly better" than Android in protecting
you from Google Analytics (which is the topic of this thread).

However, I can already tell you that iOS is vastly less private than
Android in many other ways, not the least of which is you must log into
your AppleID periodically - and if you do not - ask me how I know this - if
you do not - after a period of time - Apple will brick your iOS device.

Then - and again - ask me how I know this - then you MUST walk into an
Apple Store and produce your government ID (no other ID is accepted!) to
prove who you are just so that Apple will let you log into your device.

You know I speak fact, badgolferman.

I'm a bit disappointed that you think a single minor issue such as this one would suddenly make iOS palatable to someone who knows iOS all too well.

But it's good that you bring it up so that we can discuss it as adults.

In summary, I own iOS and Android devices, and in terms of privacy, there
are a couple of places where iOS is more private than Android is.

I use the iOS devices daily for those things (e.g., Google Voice).

As for the topic of this thread, I hope Google eventually loses their
appeals so that those hundreds of thousands of apps which directly upload
our data to the Google Servers without us knowing about it, disappear.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

badgolferman <REMOVETHISbadgolferman@gmail.com> wrote:

Marion <marion@facts.com> wrote:

On Fri, 5 Sep 2025 17:10:48 -0000 (UTC), Marion wrote :

The biggest privacy boost in GrapheneOS, much like with iOS, is that it
does not include Google Play Services by default, so there is no automatic >>> data sharing with Google.

After having answered earlier today, I belatedly realized that might not
matter if the data goes from Lyft to Google servers, even with GrapheneOS. >>
So let me rephrase the answer to Jeff's question as "hell if I know".
Maybe others with experience on GrapheneOS & LineageOS can add value?

It's pretty bad though that hundreds of thousands of iOS/Android apps are
uploading our data to Google servers without us knowing that's happening.

So considering privacy has always been your topmost issue, how does this revelation affect your championing of Android over iOS? Does a greater lack of privacy still trump less functionality?

He will never admit that Android has a "greater lack of privacy" even if
true.

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.privacy

On Sat, 6 Sep 2025 18:30:23 -0000 (UTC), Chris wrote :

So considering privacy has always been your topmost issue, how does this
revelation affect your championing of Android over iOS? Does a greater lack >> of privacy still trump less functionality?

He will never admit that Android has a "greater lack of privacy" even if true.

Chris,


Never make the mistake of thinking I'm anything like you Apple nutcases.
Think about that belief system that you own. Think. Think hard.

Why would I give a shit about Android privacy being better or worse?
Think about that.

DO you think I care about Google?
Seriously.

Do you?

Your mistake is you think I'm a religious zealot nutcase like you are.
Stop thinking that way.

I'm normal.
I'm absolutely nothing like you are, Chris.

I don't give a shit about Google any more than I care about Apple.
I only care for the truth.

Never make the mistake of thinking I'm anything like you Apple nutcases.
--- Synchronet 3.21a-Linux NewsLink 1.2