Hacker News Reader

Comment by sfkdjf9j3j | Hacker News Reader

It's wild how common this is, especially on Android, and how little people know about it. Those free apps you enjoy? Many of them make money by shipping with a 3rd party SDK that records your location (among other identifying information), collates it with other identifying information, and feeds it into the massive real time ad-tech system that powers large swaths of the internet.

View on HN

Too bad your location is still sold by your cellular provider even if you delete all those apps.

> AT&T, T-Mobile and Verizon have pledged to stop selling location data to brokers who may sell the information on the black market.

Most of them stopped according to the article.

We should of course still outlaw the practice to prevent future data privacy violations.

It's good they're keeping it off the black market, but I suspect many on here are opposed to above the board sales, too.

Those pledges to stop haven't been worth much in the past.

https://www.wired.com/story/carriers-sell-location-data-thir...

> Amid the ensuing customer outrage and mounting congressional scrutiny, the major US carriers promised to stop selling user location data to outside brokers. Which is part of what makes the Motherboard story so troubling: Seven months later, it remains easy and cheap for anyone to buy data about a phone's location without a warrant or any justification at all. All you need is a phone number to target. In Motherboard's case it was a T-Mobile customer, but data brokers claim to be able to provide location information from all the major carriers.

Pledging to stop and stopping are two very different things.

Pledging to stop is pretty standard operating procedure whenever bad privacy practices cause a PR stink, but it's quite common to see the same company with the same PR stink a year or two later. Pledges to stop often have more to do with the media cycle than any actual intention to stop.

Yeah, a good example of this is Pepsi pledging to remove Brominated Vegetable Oil from their drinks in response to a campaign by a young student that caught media attention. Years later, they never did any such thing.

Which really makes no sense when you think about it because it's already illegal in Europe and Japan so might as well just remove it altogether.

It all depends on the monetary difference doing so makes. If it's significantly cheaper, then they will continue to include it for legal markets.

Right. Last year (2018) they pledged to stop. Then didn't. Then this year they pledged again.

We'll see...

[0] https://arstechnica.com/tech-policy/2019/01/after-broken-pro...

Only to the brokers they don't like. How they know which brokers sell to black markets?

Ok so they're still selling location data to brokers who may do something other than sell the information on the black market.

I don't think my provider has GPS level location data, only cell tower level?

You’d be surprised. Look up “SUPL”.

I did. https://en.wikipedia.org/wiki/Assisted_GPS

SUPL seems to be for getting AGPS data. No location data is actually sent to the cell towers.

GPS is a one-way system. If they have your GPS data, it's because they are causing your device to transmit that data back.

Your phone will send GPS level location data if the provider requests it: https://www.spirent.com/~/media/white%20papers/mobile/lte_lb...

"SUPL 2.0 features the use of geographical ‘triggers’, which enable the UE to report its position if it enters, leaves, or is within a particular area. Triggering may be enabled either by the network or by the SET, with the two entities agreeing on trigger criteria. Area Event triggers enable key mobile applications such as Check-in services, shopping deals and offers, location based advertising, and child location."

Yes, but does AT&T only have the tower data, or all the data from the phone? This is a huge difference.

Towers can triangulate you with latency and signal strength. I don't know how accurate that can be made, although as successive generations switch to higher frequencies it can only be getting better.

I understand that, but AT&T (presumably) wouldn't get things like:

- accelerometer data

- Local and historical WiFi networks

- Application logs

- Cookies

- etc

Is this correct?

Are there any providers that don't engage in shenanigans?

Are there any businesses at all that don't engage in shenanigans? It's getting very hard to find them.

Also, your phone manufacturer.

Please understand I'm not excusing anything, it's horrendous it took this long to have user controls. That having been said, in the Android Q preview, Android occasionally lets me know that an app has access to my location at all times and makes it easy for me to immediately revoke that access, or limit it to ONLY when the application is open.

For example, this is what I can see by searching "Location" in settings and choosing one of the first results: https://i.imgur.com/jDF9vq6.png. It was shocking what this list looked like when I first upgraded to Q.

Yeah, that's Android Q, which is in Beta and not widely adopted. The vast majority of Android devices are running on OS's that have way less granular permissions.

I appreciate the move in the right direction, but I suspect that Google is reading the tea leaves to see that they've likely got antitrust on the horizon and they need to start laying the groundwork to fight that.

It's almost like my own comment said I wasn't making excuses and pointed out it was a preview release. I don't know why I bother.

Also, I don't understand what Google being in trouble for anti-trust has to do with a bunch of third-party apps and third-party SDKs accessing and selling my information.

Reply on news.ycombinator.com