Cover Image for Google tracks Android users' activity before they open apps, according to a report.
Tue Mar 11 2025

Google tracks Android users' activity before they open apps, according to a report.

It seems that using a phone involves being tracked.

It is commonly assumed that using a smartphone implies that some company is tracking the user. What most people expect is to have to use the device before tracking begins, but for Android users, the reality is different. A recent study conducted by D.J. Leith at Trinity College Dublin investigated the complicated world of device identifiers, trackers, and analytics cookies on Android devices, and found that Google tracks users before they have a chance to open any apps.

Leith identified at least 14 cookies, trackers, and device identifiers that are created and stored almost immediately after an Android device is set up. What is most alarming is that there seems to be no way to permanently opt out of any of them. According to the study, "There is no request for or granting of consent to store any of these cookies and other types of data; the purposes are unspecified, and there is no option to prevent the storage of this data." Furthermore, it was observed that most of this information is retained even when the device is idle after a factory reset, without any Google app being opened by the user.

Leith suggests that this situation is due to the login process on Android devices. Once a user logs in with a Google account, they are automatically connected to all the pre-installed Google apps on the device, from Google Play Store to Gmail. Some of the identified trackers and cookies are easy to investigate. For example, the DSID cookie, which Google describes as "used to identify a logged-in user on non-Google sites, thereby respecting the user's ad personalization settings." However, Leith notes that the explanation given by Google is ambiguous and does not clarify the origin of the cookie, as it existed on Android devices even without apps being opened.

Another tracker is the Google Android ID, which is generated during setup, can survive a factory reset, and sends user data even if the user is not authenticated to a Google account. The report details all aspects that Leith was able to find about the 14 identified trackers, including their origin, storage, and functioning. However, the underlying message is clear: users face a multitude of settings, permissions, and other obstacles in trying to stop some of these trackers. There is no way for a user to opt out or delete all of them.

Recently, Google has been criticized for its security and privacy practices. Last month, it upset Android users by forcibly installing SafetyCore on devices. This feature aimed to enhance security by filtering sensitive content, but its rollout was flawed as it was installed without consent and without explaining its functionality. However, the launch of the redesigned "Results About You" was considered better, as it provides users with easier access to delete their data from Google Search.