Skip to content
Naked Security Naked Security

Are your jilted apps stalking you?

“Uninstall?” HA! Uninstall trackers enable app developers to game iOS and Android and continue sending push notifications to fleeing users.

Have you recently tried to ditch a mobile app, only to have it keep following you around?
If so, you may be a victim of a new crop of uninstall trackers that go beyond letting app developers track bugs and poor user experience: they also let developers track app users “the instant” they give them the heave-ho, as one mobile app analytics/marketing company, Localytics, brags about on its site.
All the better to “remarket” at those fleeing users, Localytics says. In other words, send ads to people even after they’ve uninstalled apps:

Start sending remarketing campaigns to users the instant they remove your app.

The new phenomenon was first spotted by Bloomberg, which has noticed these new tracking tools coming from a slew of companies that create development tools for app makers: besides Localytics, they include Adjust, AppsFlyer, MoEngage, and CleverTap.
The uninstall trackers represent a run-around when it comes to iOS and Android policies that forbid silent push notifications. Hopefully, Apple and Google will crack down on the practice soon, though neither company has responded yet to inquiries from Bloomberg or myself.


Bloomberg talked to one of the companies in this space, Branch Metrics, which makes software for mobile app developers but whose CEO, Alex Austin, says the company eschews this “sketchy” technology:

It’s just generally sketchy to track people around the internet after they’ve opted out of using your product.

Austin said that he expects Google and Apple will put an end to this soon.
In the meantime, trackers are enabling app developers to exploit silent push notifications, which have been around forever. In their non-obnoxious use scenarios, they regularly ping installed apps without the user knowing about it in order to do things like refresh inboxes or social media feeds while the app runs in the background.
If the developer doesn’t get a ping back from the app, it’s logged as uninstalled. Uninstall trackers take note of that change in a file associated with a given device’s unique advertising ID. That makes it a snap for the developer to figure out who’s hit uninstall… and to then start following them around to re-advertise the app to them.
At least one of the developer tool companies shrugged this off. We only make the tools, and it’s up to developers whether they’re going to do this to people or not, said Ehren Maedge, vice president for marketing and sales at MoEngage:

The dialogue is between our customers and their end users. If they violate users’ trust, it’s not going to go well for them.

Hear that sound? It’s the crinkle of a buck being passed. Well, it can’t start to go “not well” for app developers if users don’t actually know what’s happening, can it? So now we know: if apps are pestering you to re-install them, yell at the app developers for using uninstall trackers, and rate them in the app stores accordingly.
Jeremy Gillula, tech policy director at the Electronic Frontier Foundation (EFF), said the problem points to the lack of nuanced privacy choices being offered to users, if they get any choices at all. To use an app, we have to agree to fork over our data, but we haven’t a clue how it will be used in the long run, he said. App developers who are using uninstall trackers are abusing that power, Gillula added:

As an app developer, I would expect to be able to know how many people have uninstalled an app. I would not say that, as an app developer, you have a right to know exactly who installed and uninstalled your app.


5 Comments

So if I have Sophos Mobile Security installed, will it detect any of these uninstall trackers should they make their way onto my phone?

Reply

You begin to think that if you uninstall an app you want to be able to install a zombie minimal app who’s sole purpose is to respond to the “are you installed pings” – but I guess they will find a way to detect the zombie apps!

Reply

Would be nice if there was some Explorer app for andoid that would show Original files in say, Green, modified original files in red, and non-original files in orange. If we could only look under the hood.

Reply

Pretty disheartening that the apps which seem to best perform their intended purpose
…are the ones we
a) don’t know are in there
b) don’t want in there
c) both

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!