Skip to content
Naked Security Naked Security

Football app tracks illegal broadcasts using your microphone and GPS

La Liga is asking users for their consent to turn on the new, eavesdroppy-feeling function, but many users aren't exactly thrilled.

Are you watching an illegal broadcast of a Spanish football game? Are you sure?
Spanish football league La Liga is asking, because, it says, it’s losing about 150 million euros a year (USD $173.5m) when venues illegally broadcast matches, which…

…translates into direct damage for clubs, operators and fans, among others.

… and which is why it started turning on the microphones and GPSes of Android users of its mobile app, La Liga said in an updated privacy policy posted on Monday.
It’s asking users for their explicit consent to turn on the new, eavesdroppy-feeling function, which captures the binary code of audio fragments. The “sole purpose” of the new function is to figure out if Android users are watching football matches of competitions “disputed” by La Liga teams, it said. In other words, nobody’s ever going to access the content of the recordings, La Liga promised.


The new function was enabled on Friday, 8 June.
These are the steps La Liga said it’s taking to protect user privacy:

  • The mobile device microphone and geolocation will only be activated during the time slots of matches in which La Liga teams compete.
  • The captured audio fragments will be automatically converted into a binary code on the device itself. La Liga says it only has access to this binary code, which it says is irreversible and doesn’t allow it to extract the audio recording (think “password hashing”).
  • If the code matches a previous control code, La Liga will know that a user is watching a particular match. If it doesn’t match, the code is deleted.
  • The codes won’t include names of the device users, but will capture IP addresses and the specific ID assigned by the app when the user registers.
  • La Liga will periodically remind users that it can activate their microphones and GPS and will ask them to reconfirm consent.
  • Users can revoke consent at any time in the settings of their devices.

As you might imagine, many users aren’t exactly thrilled at the idea. One-star reviews have been popping up in Google Play Store, accusing the app of spying on users’ locations with the intention of ratting out establishments that La Liga believes are broadcasting without a license.

You and your phone become their own personal spying device. Please rate this app 1 star before uninstalling.

Even if La Liga isn’t going after users’ personal data, many app reviewers don’t much like the notion that their devices – data plans, electricity and all – are being used to “chase after others.”

Don’t we have enough controversies and dubious problems with big data?

Do we? Maybe we don’t have enough, given that controversies shed light on what app developers are doing with user privacy.
At least La Liga is being upfront about using your microphone and GPS to police illegal broadcasts. If that isn’t a consolation, and if you have more sympathy for your local pub than La Liga and its “responsibility to protect clubs and their fans from fraud”, the answer is straightforward: Uninstall that app!


3 Comments

It would make more sense to make an app that can listen in to Spanish politicians conversations and when the words “tax heaven”, “stuffed envelope” and “cash for favours” are detected, it sends in a full transcript to the police.

Reply

I heard about this last week! It’s surprising what app/companies put in their privacy policies that users have no clue about. There has to be a better way to find people who are broadcasting sports games illegally.

Reply

I agree that the idea of this is uncomfortable, and I don’t support the “spying” aspect or the idea that my microphone could be turned on at any time during team games regardless of where I might be.
However, as far as being up front about what they’re collecting and how they’re collecting it, I’ll give them some credit. We all know if they’re collecting anything at all, it has the potential to be shared at some point, but hashing it, not storing if it doesn’t match, stripping MOST PII and ultimately re-prompting for permission occasionally are all positives.
The only better thing in my mind (if you agree to the premise and support this) would be to ask each and every time prior to recording, or let it be user-initiated.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!