You Can’t Run or Hide from App Location Tracking, New Study Suggests

location-data-agreementWhen you opt to disable location services on mobile apps, you’re hoping for some semblance of anonymity; a recent study, however, has revealed that no matter what you do, unique variations in your phone’s hardware makes it trackable regardless of what your privacy settings are.

An accelerometer, also known as the thing inside your phone that helps determine orientation switching from vertical to horizontal, contains a unique fingerprint, the product of imperfections in the hardware manufacturing process. This fingerprint creates a signal which varies from device to device, which means it can be tracked by unwanted apps.

The research study, conducted by Associate Professor Romit Roy Choudhury and graduate students Sanorita Dey and Nirupam Roy at the University of Illinois, looked at the accelerometers from 100 cell phones, and were able to discriminate one sensor’s signal from another with 96 percent accuracy.

“When you manufacture the hardware, the factory cannot produce the identical thing in millions,” Choudhury said. “So these imperfections create fingerprints.”

While the accelerometer is the most identifiable vulnerable phone component, the study claims that other pieces, including the device’s camera, microphones, gyroscope and more could also produce unique signals.

Thankfully, current apps don’t tap into a phone’s hardware signals (at least not to anyone’s knowledge), because the unique fingerprint is only visible when the signal is analyzed in detail; a level of analysis currently unavailable for most apps. Still, these findings are disturbing to privacy advocates because apps could skirt location-based consent agreements and begin tracking a user whether they agree to it or not.

“[Location information] could be obtained with an innocuous-seeming game or chatting service, simply by recording and sending accelerometer data. There are no regulations mandating consent,” Jonathan Damery wrote for the University of Illinois website.

There are currently no fixes to the issue, but Choudhury thinks there could be something in scrambling signals, or providing “noise” to drown the signals out from parties interested in location tracking.

About the author  ⁄ Erik Helin

Erik is BrickHouse Security's copy chief. Hailing from the Midwest (Wisconsin), Erik moved to NYC in 2010, securing a job at BrickHouse shortly thereafter. Outside of work he writes about music, does freelance advertising work, and wastes his life on the internet. Aside from no-brainers like cheese and beer, Erik enjoys music, travel, TV, his cat, and Brooklyn.