This article was published in the bi-yearly publication of the Computer Science Department Oxford.
Many apps collect detailed data about your life. Some apps share this data with hundreds of companies from around the world. Should you be worried? To help you find answers, we at Human Centred Computing in the Department of Computer Science are developing TrackerControl, a new privacy app.
‘I don’t share much data with apps’, you may object. The problem is that apps often collect data about you, without any notice or choice. This data can include your IP address, location, and sometimes even your phone number and those of your contacts. Most apps even finely record your app usage in an opaque practice known as tracking.
This data can make it surprisingly easy to monitor your life in great detail, by triangulating different information. Your last romantic date? Apps might know everything. Worse still, many apps share data with dozens – and sometimes hundreds – of companies. Whilst such data collection practices may not cause immediate harm, its future consequences are difficult to anticipate. This makes society vulnerable to a wide range of risks, some of which are yet to come into existence.
TrackerControl emerged as part of my MSc project in the department, together with Professor Max Van Kleek. While many privacy-enhancing apps already existed, none of them both (1) showed detailed insights into tracking and (2) enabled users to limit unwanted data transmissions. Only if users are given the necessary information and a choice, they can make more meaningful decisions about their data.
In developing the app, a fundamental technical challenge was the balance between limiting data flows and preventing apps from breaking. If TrackerControl blocks too many data transmissions, it may impede app functionality. Often, data transmissions serve legitimate purposes, which can be difficult to untangle from unwanted tracking transmissions. Many existing privacy apps solve this challenge by blocking visible ads only. This is not enough, because invisible data transmissions can pose a similar privacy threat. TrackerControl instead blocks as much tracking as possible, whilst making it convenient for users to create exceptions from this rule.
The first version of the app was developed and released after a round of user interviews in November 2019. Since then, TrackerControl has attracted thousands of users, and appeared in various tech news outlets. TrackerControl users have formed a supportive and positive online community. They answer questions of new users, inform further app development, and have translated the app into nine languages. Working with the community has been a fruitful way to develop software alongside conducting research.
TrackerControl is part of wider efforts in our research group to scrutinise apps and support human flourishing in the digital world. One related project, called X-Ray, found that 90% of Android apps may share data with Google and 40% with Facebook, and that the power of companies over data might have tipped out of balance.
Tools such as TrackerControl can only be a partial solution. With data collection at scale, the privacy of individuals depends increasingly
on the choices of other people. Many companies already have so much data that they need little to make accurate predictions about the individual. If we want to protect fundamental democratic rights in the digital age, such as the right to data protection and to a private, self-determined life, we need structural changes to the digital ecosystem, collective efforts, and possibly more effective regulation.
With TrackerControl, we showcase an exciting way to pursue and share research, as well as practical ways to improve privacy. You can help make a change, by downloading the app via trackercontrol.org, finding out how your apps transmit data, and sharing your experiences.
References:
- Binns, Lyngs, Van Kleek, Zhao, Libert, and Shadbolt (2018): ‘Third Party Tracking in the Mobile Ecosystem’ https://bit.ly/3eUf0f6
- Binns, Zhao, Van Kleek, and Shadbolt (2018): ‘Measuring Third-party Tracker Power across Web and Mobile’ https://bit.ly/3pjBElI