Sundar Pichai, Google’sCEO, claims he doesn’t think privacy should be a luxury good, and yet many people buying low-cost android phones are paying with their privacy and security. Civil society organisations around the world are sounding the alarm.
UPDATE: In August 2020, Google responded to Privacy International’s campaign. There was some good news, some bad news, and some mediocre news.
This letter was originally published on Privacy International on 8 January 2020
Dear Mr. Pichai,
We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.
And yet, Android Partners – who use the Android trademark and branding – are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as “bloatware”), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.
These phones carry the “Google Play Protect” branding, but research shows that 91% of pre-installed apps do not appear in the Google’s Play Store. These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app – including access to the microphone, camera and location – without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.
We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.
The changes we believe are needed most urgently are as follows:
- Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
- Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
- Pre-installed apps should have some update mechanism, preferably through the Play Store and without a user account.
- Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.
We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.
We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.
Yours sincerely,
