Ring App Shares Personal Data With Facebook, Other Unlisted Trackers, EFF Says

The Electronic Frontier Foundation (EFF) on Monday announced that its research into the Ring app’s Android version identified several embedded third-party trackers sucking up “a plethora” of personal information.

Three of the trackers aren’t included in Ring’s privacy notice—a list last updated a year and eight months ago.

The civil liberties group, whose work focuses on privacy and other digital rights, said it had observed Ring for Android’s activity using tools for inspecting web traffic. EFF researchers found it was delivering users’ personal information to four marketing and analytics firms, including Facebook.

In Facebook’s case, Ring hands over data whether its customers have Facebook accounts or not, the EFF said.

Ring’s privacy policy makes clear that it uses web analytics services. “The service providers that administer these services use automated technologies to collect data (such as email and IP addresses) to evaluate use of our websites and mobile apps,” it says. However, the policy also claims to identify which third-party services specifically are used by the company.

The list, last updated in May 2018, does not include Facebook and other trackers currently in use.

“Like many companies, Ring uses third-party service providers to evaluate the use of our mobile app, which helps us improve features, optimize the customer experience, and evaluate the effectiveness of our marketing,” a Ring spokesperson told Gizmodo.

According to EFF’s research, Ring for Android version 3.21.1 delivers a range of personal information to the following sites: branch.io, mixpanel.com, appsflyer.com and facebook.com.

Gizmodo also inspected Ring’s web traffic can confirm the EFF’s findings.

“The danger in sending even small bits of information is that analytics and tracking companies are able to combine these bits together to form a unique picture of the user’s device,” EFF said. Privacy researchers refer to this as a digital “fingerprint,” which marketing companies use to paint a complete portrait of a person’s likes and activities.

A Ring spokesperson said that Ring takes steps to ensure its service providers’ use of customer data is “contractually limited to appropriate purposes such as performing these services on our behalf and not for other purposes.”

In the case of business analytics service MixPanel—the only tracker identified by EFF listed among Ring’s third-party services—Ring provides access to users’ names, email addresses, and device information, such OS version and model, EFF said.

Ring told Gizmodo that MixPanel is used to target messaging within the app when new features become available, including security-related settings. Other trackers help the company identify which in-app features are performing the best, it said.

Ring was purchased by Amazon in the summer of 2018. The company markets a line of home security products, including the popular Ring Doorbell, which uses Amazon Web Services (AWS) servers to store footage.

Privacy advocates have scrutinized Ring heavily over the past year, largely due to its quickly expanding local law enforcement partnerships, the terms of which appear often to restrain public officials from speaking freely about the services Ring provides.

Gizmodo reported last year, for example, that Ring had edited the written statements of police officials. In some cases, Ring’s intervened to omit the word “surveillance” from quotes attributed to senior police officials, warning them that use of the term could elicit “privacy concerns” among consumers.

“Ring claims to prioritize the security and privacy of its customers,” EFF Senior Staff Technologist William Budington said in a statement, “yet time and again we’ve seen these claims not only fall short, but harm the customers and community members who engage with Ring’s surveillance system.”

Updated, 11pm: Article was updated to reflect Ring data collected by Gizmodo confirmed EFF’s findings.

Source: Gizmodo.com

Powered by NewsAPI.org

Keywords:

Mobile app • Personally identifiable information • Facebook • Electronic Frontier Foundation • Electronic Frontier Foundation • Electronic Frontier Foundation • Protection ring • Mobile app • Android (operating system) • Embedded system • Third-party software component • Privacy • Civil liberties • Privacy • Digital rights • Android (operating system) • Web traffic • Electronic Frontier Foundation • User (computing) • Personally identifiable information • Marketing • Analytics • Business • Facebook • Facebook • Data • Customer • Facebook • User (computing) • Electronic Frontier Foundation • Privacy policy • Web analytics • Service (economics) • Internet service provider • Management • Service (economics) • Automation • Technology • Data • Email • IP address • Website • Mobile app • Facebook • Internet service provider • Mobile app • Outlook.com • Customer experience • Marketing • Protection ring • Gizmodo • Electronic Frontier Foundation • Android (operating system) • Input/output • Mixpanel • AppsFlyer • Facebook • Gizmodo • Web traffic • Electronic Frontier Foundation • Information • Analytics • Image • User (computing) • Computer hardware • Electronic Frontier Foundation • Privacy • Device fingerprint • Marketing • Internet service provider • Data • Business analytics • Mixpanel • BitTorrent tracker • Electronic Frontier Foundation • Protection ring • Third-party software component • Protection ring • Access control • User (computing) • Email • Peripheral • Information • Operating system • Software versioning • Electronic Frontier Foundation • Protection ring • Gizmodo • Mixpanel • Instant messaging • Application software • Computer security • Application software • Amazon.com • Product (business) • Amazon Web Services • Amazon Web Services • Privacy • Law enforcement • Gizmodo • Surveillance • Police • Privacy • Privacy • Surveillance • Gizmodo • Electronic Frontier Foundation •