Thursday, February 25, 2016

PSA - Google knows my phone number (and probably know yours as well)

TLDR: If you log into any Google service, but don't want Google to know 
your phone number, you're so out of luck.

I recently logged into my Google account and was presented with a web 
page showing my mobile phone number. I was being asked if I wanted to 
enable login verification using that number. The problem is, I don't 
ever remember giving Google my phone number. Initially I was puzzled and 
shocked: did I voluntarily give Google my phone number? I doubt it, 
given my general mistrust of Google. Then I got angry. How was it 
possible for Google get my phone number?

Turns out, there's a clause in Google's so-called "privacy" policy which 
boasts about the right to collect user information, without explicit 
consent. See:
  <https://www.google.com/policies/privacy/#infocollect>

Specifically, under "Device information":
"We collect device-specific information (such as your hardware model, 
operating system version, unique device identifiers, and mobile network 
information including phone number). Google may associate your device 
identifiers or phone number with your Google Account."

So, if you use a mobile phone to log into any Google service (including 
YouTube), Google has the ability to get your phone number and other 
identifying data from the mobile network. Maybe I should also thank 
Telstra for this breach of privacy? Then Google obviously did link this 
data with my Google Account, again without my permission.

Google makes its money from advertising, so its goals are aligned more 
closely with the advertising industry than with the users of its 
services. Free comes at a price. One of the reasons I've never 
considered using an Android phone is specifically to limit my exposure 
to the advertising industry. Here's a very recent article which confirms 
my concerns about Google, Android and advertisers:

"Georgia Tech Discovers How Mobile Ads Leak Personal Data"
  <http://www.news.gatech.edu/2016/02/22/georgia-tech-discovers-how-mobile-ads-leak-personal-data>
"The personal information of millions of smartphone users is at risk due 
to in-app advertising that can leak potentially sensitive user 
information between ad networks and mobile app developers, according to 
a new study by the School of Computer Science at the Georgia Institute 
of Technology."

That's Android, but, given Google's vast reach, even using an iPhone 
cannot stop it from gathering private data from users. My trust in 
Google has reached a new all-time low.