Trinity College Dublin: Android phones collect 20 times more user data than similar iPhones

A study by a computer science professor at Trinity College Dublin in Ireland found that Android phones collect 20 times more user data than comparable iPhones.

According to Doug Leith, a researcher and the college's chair of computer systems, both iOS and Android phones are constantly collecting data and sending it back to Apple and Google, respectively. The information begins when a SIM card is inserted into a smartphone and includes everything from the interaction of hardware and apps.

When the user is not logged in, opts out of data collection in privacy settings, and the phone is idle, the data collection process may still run. Leith found that iOS shares information about IMEI, hardware serial number, SIM serial number, phone number, device ID (including UDID and advertising ID), location, telemetry, cookies, local IP address, and nearby Wi-Fi Mac addresses. Android sends similar data, adding the device's Wi-Fi MAC address, but does not include the phone's location information, local IP address, and nearby Wi-Fi Mac addresses.

Laith's testing conditions include testing after the phone has been restored to factory settings, booting up for the first time, inserting or removing a SIM card while the phone is idle, viewing settings, enabling or disabling location, and collecting data for the first time when a user logs into their own app store.

The test products are a Google Pixel 2 phone running Android 10 and an iPhone of unknown model running iOS 13.6.1, but the iPhone has been jailbroken in order to monitor network connections.

The most striking difference, Leith says, is the amount of information collected. According to his research, Android sends about 1MB of data to Google when it boots up, while iOS sends about 42KB to Apple. When the phone is idle, Android sends another 1MB every 12 hours, compared to 52KB for iOS. In the U.S., Google estimates it takes in 1.3TB of data from its (all) users every 12 hours, while Apple receives 5.8GB in the same period.

Leith believes that "currently, there are almost no options to prevent this data sharing," which means that users must accept the collection of data as long as they use their mobile phones.

In response to this result, Google said that Leith's method was flawed, and they believed that data collection was a core function of any connected device. Its spokesperson questioned the validity of the experiment, pointing out that the experiment could not capture data such as UDP/QUIC traffic. (QUIC is a set of UDP-based transmission protocols launched by Google, the purpose of which is to ensure reliability while reducing network latency):

We found flaws in the researchers’ methodology for measuring data volume and disagree with the paper’s claim that Android devices share 20 times more data than iPhones. Based on our research, these results are off by an order of magnitude, and we shared our concerns about the testing methodology with the researchers before the paper was published.

The study gives a pretty good overview of how smartphones work. Modern cars regularly send basic data to automakers about the car's components, its safety status, and service schedules, and phones work in a very similar way. The report details how these communications help ensure that the iOS or Android software is up to date, services are working as expected, and phone/safety features are working effectively.