They are clearly informed that the app will track information regarding their online activities, device usage behavior and applications they use.
I think the main issue is that users without a tech background are just not aware of the full implications of allowing a third party to collect this kind of data, even decrypting their HTTPS traffic and tracking everything they do online.
The statement by Strafach in the original article sums it up quite nicely:
“The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”
Which makes this fraud, right?
In the same way automotive manufacturers are held accountable even if their was no intention to cause harm, the software industry needs to be held accountable.
We need to have professional organisations, and government regulators, working to ensure some kind of general industry best practice, where software developers can initially start getting tapped on the shoulder, then given a series of rapidly increasing penalties until the industry gets the point that it can’t keep making out it’s the wild wild west.
And this is why I don’t believe software development is a proper serious profession. The proper professions, here in Australia at least, are granted the authority to witness statutory declarations. I can go to a qualified vet, doctor, engineer, chiropractor(!), police officer, school teacher, postal worker, the list goes on[1], because these professions have a chain of trust.
And yet we trust(?) software developers and their employees with our most sensitive data!
1. https://www.ag.gov.au/Publications/Statutory-declarations/Pa...
Do we really think computer illiterate people know that Google can infer a huge about of sensitive information about their end-users without them ever ticking "i accept" or signing up for an account?
At least with this they have to take explicit actions like accepting the terms and installing the tracker before they're tracked. They even get compensated for it.
In Google's case you don't get anything.