Some of the most popular Android phones in the world are made in China, but you might want to think twice before buying one. According to a study by researchers at the University of Edinburgh and Trinity College Dublin, these phones frequently collect a wide range of personally identifiable information without the user’s consent. Most frighteningly, this spyware is running out of the box when consumers in China buy new Android phones.
The researchers conducted an in-depth analysis of the Android OS variants running on flagships from OnePlus, Xiaomi, and Oppo Realme — three of the top vendors in China. In addition to the preinstalled apps, the team also analyzed the servers to which the phones connect. What they found was that privacy was not a top priority for these vendors.
According to the study, a treasure trove of personally identifiable information (PII) is being sent to the device vendor as well as various Chinese mobile network operators like China Mobile, even if the operators aren’t providing service to the phone. That PII includes persistent device identifiers, location identifiers, user profiles, and social connections.
As the researchers note, all of this information, combined with the fact that every phone number in China is registered with a citizen ID, makes it virtually impossible to remain anonymous and opens the door to extensive tracking, even when the user leaves China.
When comparing preinstalled system apps on the Chinese Android OS distribution and the global distribution, the researchers discovered that China’s version features 3 to 4 times more third-party apps, which are given 8 to 10 times as many permissions as the third-party apps on the global version. Many of those permissions are classed as dangerous as well.
“Overall, our findings paint a troubling picture of the state of user data privacy in the world’s largest Android market, and highlight the urgent need for tighter privacy controls to increase the ordinary people’s trust in technology companies, many of which are partially state-owned,” the researchers conclude in the introduction to the study.
