Daily users of smartphones, of which there are billions, generate vast amounts of data about themselves. Much of the functionality afforded by these devices comes in the form of applications which derive revenue from monetising user data and displaying behaviourally targeted advertising. Firms with the ability to collect such data have become a significant part of the digital economy. This business model is primarily enabled through ‘third-party’ trackers, which track users via ‘first-party’ mobile applications, whose developers embed their technology into application source code.

Third-party tracking potentially raises greater privacy concerns than first-party data collection because it can often link records from multiple websites or apps to a single user. They can provide a more complete picture of an individual, from where they shop, to their social networks, their socio-economic status and likely political opinions. The more apps that choose to integrate a particular third party tracker, the greater that tracker’s power to collect personal information and build more comprehensive profiles. These profiles can then be used for a variety of purposes, from targeted advertising to credit scoring and targeted political campaign messages.

A team of researchers from the University of Oxford undertook an analysis of the distribution of tracking technology on close to 1 million smartphone apps to gain an insight into the breadth and scale of this phenomenon.

Across all of the apps that were analysed, 90.4% included at least one tracker, and 17.9% included more than twenty trackers. Whilst there were many companies behind the tracking technology found on applications, the paper revealed that many of them are owned by a common parent company. Indicated in brackets is the percentage of applications that contain at least one tracker from the parent company:

  • Alphabet (88.44%)
  • Facebook (42.55%)
  • Twitter (33.88%)
  • Verizon (26.27%)
  • Microsoft (22%)
  • LinkedIn (20.62%)
  • Amazon (17.91%)
Example of parent-subsidiary company ownership. Flurry is owned by Yahoo, which is owned by Oath, which is owned by Verizon.
  • When applications are separated genre by genre (Productivity & Tools, Games & Entertainment, Health & Lifestyle, Communication & Social, Art & Photography, Family, News, Education, Music) there appear to be differences in the behaviour and distribution of trackers depending on the functionality or purpose the app provides. News, Family and Games apps had the highest median number of tracker companies associated with them. 20% of apps in the News, Family, and Games & Entertainment apps were linked to more than ten tracker companies.
  • The lowest median number of trackers are found within Productivity & Tools, Education, Communication & Social, and Health & Lifestyle apps, and over 10% of Productivity & Tools, Education and Communication & Social apps have no trackers at all.
  • Tracking is also a substantially trans-national phenomenon; around 100,000 apps we analysed send data to trackers located in more than one jurisdiction.

Many of the tracking companies included in the authors knowledge base engage in data processing activity that would likely constitute ‘profiling’. For instance, the purpose of many of the most common trackers is behaviourally targeted advertising, whereby individuals are evaluated along demographic and behavioural dimensions to determine their propensity to respond to certain marketing messages. The Article 29 Working Party has advised that profiling for marketing purposes could potentially give rise to significant effects, if it is: intrusive; targets vulnerable persons, minority groups, or persons in financial difficulty; involves differential pricing; or deprives certain groups of opportunities.

The authors assert that many of the trackers which are embedded in apps from the Family and Games & Entertainment genre categories, are clearly targeted at children. Apps from these two genres were especially exposed to third party tracking, with the average app including hosts associated with 7 distinct tracker companies for Family apps, and 6 for Games & Entertainment apps.

Conclusions

The governance of these activities is complex, involving many stakeholders, including: users, smartphone operating system developers, equipment manufacturers, alternative app market operators, app developers, as well as the range of ad networks, consumer insight providers, direct marketing firms and others involved in third party tracking. Effective regulation and enforcement will require collaboration between regulators and these other actors.

This text is adapted from an original research article entitled Third Party Tracking in the Mobile Ecosystem.