Is Android a threat to privacy?
The EC investigation of Android has implications for privacy as well as antitrust
This week the European Commission took not one but two momentous actions against Google. The first — which has received the lion’s share of media attention — was the filing of formal antitrust charges accusing Google of abuse of dominance in online search. The second, less noticed but arguably of greater import, was the launch of an investigation into Google’s practice of forcing mobile device manufacturers to use its purportedly open source Android operating system in only the way that Google prefers.
Android of course is the world’s most widely used operating system, with a rapidly growing user base that now numbers more than one billion. While we usually think of it as something for consumers, Android devices are also used in countless enterprises, schools and government agencies. It’s worth taking a look at what the EU’s Android investigation means for those users.
The EC’s questions about Android turn on the issue of what apps hardware manufacturers are allowed to install on their devices. The EC notes that Android is in principle open source. So manufacturers ought to be able to do whatever they like with it. But in practice this is not so.
Most firms selling smartphones and tablets in the U.S. and Europe believe that consumers want easy access to Google’s most popular services — especially Search, Maps and YouTube. So the manufacturers must seek Google’s permission to pre-install these services on their devices. But Google enforces a draconian bargain in exchange. If you want to install one of our services, it tells device makers, you must install them all (the total required number is now over twenty). Furthermore, you can’t set as default on your devices any search engine other than Google. Finally, if you want to sell Android devices fully loaded with Google services in this manner, you must give up the right to sell any devices using an alternative version (or “fork”) of Android loaded with non-Google services that compete with ours.
Whether such practices are legal under EU antitrust law is the question that the EC’s investigators will now look into. But we should ask why Google insists on dictating its terms to device makers in this way. The natural assumption is that Google’s Android bundling strategy aims above all to maximize profits. Surprisingly, however, this does not appear to be true. According to Goldman Sachs, the chief way Google makes money with Android is from mobile search ads, but these ads produce remarkably little revenue for Google — only about $3 billion per year, or less than 5% of Google’s annual sales.
What then is the value of Android for Google, if not profits? The answer is data — specifically, data that can be used to profile Android’s billion plus users so that Google can target them more accurately with ads, even when they are not using an Android device. Few users suspect the extraordinary amount of detail that Google amasses about each of us. It knows what we search for, what web pages we browse, what ads we click on, what videos we watch. It even reads our email. In fact, Google’s user profiling algorithms are so powerful they can classify us into literally millions of distinct “buckets”. But as Internet usage shifts from desktop to mobile, it becomes crucial for Google to preserve its ability to track us even when we no longer sit in front of traditional PCs. This is one fundamental reason for Google to promote Android even without direct profits.
But with Android Google also learns far more about us than it ever could on the desktop alone. It learns where we go every day, when we drive and when we walk and even when we run, where we shop, where we are at this very moment.
Android is as much a data gathering tool as an advertising machine. As such it has deeply worrying consequences for user privacy. The EC’s present investigation of Android looks only at Google’s business practices with regard to device makers. But Europe’s data protection authorities (who depend on EU member states rather than the Commission in Brussels) are conducting parallel investigations of Google’s controversial privacy policy. It is likely that the EC too will sooner or later begin probing the privacy implications of Android’s broad grip on user data. Until then, Android users — consumers and organizations alike — should think carefully about how much they give up when they turn on a device powered by Google’s own carefully packaged version of this operating system.
