Source-linked AI summary
Third Party Tracking in the Mobile Ecosystem
Reuben Binns, Ulrik Lyngs, Max Van Kleek, Jun Zhao, Timothy Libert, Nigel Shadbolt
TL;DR
Third-party tracking is widespread across mobile apps, but large-scale evidence about its prevalence, distribution, and legal implications has been limited. This paper statically analyzes 959,426 Google Play apps by extracting bytecode hosts and mapping them to known tracker companies. It finds that tracking is common, varies substantially by app genre, and frequently crosses jurisdictions, creating compliance challenges.
Problem
The paper addresses the need for large-scale evidence about the extent, distribution, ownership, and jurisdictional scope of third-party tracking in mobile apps.
Method
The study analyzes Google Play APKs, extracts hosts from app bytecode, and maps them to known tracker companies using prior tracker lists and ownership data.
Results
90.4% of 959,426 analyzed apps included at least one tracker host, while News and Family apps had the highest median numbers of associated tracker companies.
Takeaways & Limitations
Tracking varies by app genre and is substantially trans-national, with around 100,000 analyzed apps sending data to trackers in more than one jurisdiction.
Takeaways & Limitations
The detection method is incomplete because its tracker-domain knowledge base covers only trackers discovered in prior research, and bytecode references may not be executed.
Abstract
from arXiv · showhide
Third party tracking allows companies to identify users and track their behaviour across multiple digital services. This paper presents an empirical study of the prevalence of third-party trackers on 959,000 apps from the US and UK Google Play stores. We find that most apps contain third party tracking, and the distribution of trackers is long-tailed with several highly dominant trackers accounting for a large portion of the coverage. The extent of tracking also differs between categories of apps; in particular, news apps and apps targeted at children appear to be amongst the worst in terms of the number of third party trackers associated with them. Third party tracking is also revealed to be a highly trans-national phenomenon, with many trackers operating in jurisdictions outside the EU. Based on these findings, we draw out some significant legal compliance challenges facing the tracking industry.
1 INTRODUCTION
The paper examines how third-party trackers support a data-driven mobile-app economy and asks how tracking is distributed, owned, geographically located, and differentiated across app genres.
- Third-party trackers embedded in first-party apps link user activity across apps, devices, and media to construct detailed individual profiles.These profiles may include shopping habits, socio-economic class, and likely political opinions.
- The paper provides a high-level empirical overview of third-party tracking across the mobile ecosystem.
- The study asks how trackers are distributed across apps, which companies own them, and which jurisdictions host them.
- The authors also investigate whether different trackers prevail among different app genres.
- The analysis aims to inform future efforts to address and mitigate third-party tracking.
2 BACKGROUND
Prior research studies tracking across web and mobile using dynamic and static methods, while existing responses rely on user controls, platform self-regulation, and legal regulation. Cross-border tracking creates additional compliance complexity because data-transfer requirements depend on the jurisdictions involved.
- Tracking detection: Web and mobile studies use network inspection, automated crawling, OS instrumentation, and app-traffic analysis to detect third-party trackers.
- Tracking research: Research also examines tracking techniques, transmitted data, and privacy-relevant app permissions.
- Web–mobile comparison: Web and mobile tracking ecosystems differ in their operating companies and the personal information shared, with only partial overlap among top trackers.
- Responses: The main responses to tracking are end-user privacy controls, industry self-regulation, and legal regulation.
- Responses: Mobile operating systems generally lack app-level controls that let users block or otherwise control third-party tracking.
- Legal regulation: Cross-border data-transfer conditions depend on the jurisdictions of tracking companies, app developers, app stores, and users.
3 DATA COLLECTION & METHODOLOGY
The study indexes Google Play apps, unpacks their APKs, extracts bytecode hosts, and maps matched domains to known tracker companies using prior tracker lists. The approach combines large-scale app discovery with static analysis and company-ownership mapping.
- Play Store indexing and app discovery: Apps were discovered by generating Play Store search terms, retrieving popularity-ranked results, and downloading identified apps with gplaycli.
- Play Store indexing and app discovery: Each APK was unpacked with APKTool to obtain assets, DEX bytecode, and XML metadata, while permissions and bytecode hosts were extracted.
- Static analysis method: Known tracker domains were matched to hosts found in app bytecode using a regular expression after shortening domains to two-level domains.
- Mapping hostnames to tracker companies: Tracker-company mapping combined the Web X-Ray list with an author-created list containing mobile-app-centric trackers and ownership relationships.
- Limitations: The method cannot confirm whether bytecode referencing identified hosts is ever executed.
4 RESULTS
Third-party tracking is widespread across apps, but its prevalence and the companies involved vary substantially by app genre. Tracker ownership is concentrated through parent companies, while tracker companies span multiple jurisdictions, especially the United States.
- Numbers of tracker hosts in apps: 90.4% of 959,426 apps included at least one tracker host, with a median of 10 hosts and 17.9% containing more than twenty.The distribution was highly right-skewed, with a Gini inequality coefficient of 0.44.
- Numbers of distinct tracker companies behind hosts: 90.4% of apps included hosts associated with at least one tracker company, while the median app contained five companies and 17.4% contained more than ten.The distribution of tracker companies per app was similarly right-skewed.
- Numbers of distinct tracker companies behind hosts: 13 apps referred to 30 or more tracking companies, sometimes because they integrated multiple services and, especially in games, without an obvious function beyond behavioural advertising.The analysis identified these companies through tracker hosts in app bytecode.
- Tracking by super genre: News and Family apps had the highest median numbers of tracker companies, and more than 20% of apps in News, Family, and Games & Entertainment exceeded ten companies.Productivity & Tools, Education, Communication & Social, and Health & Lifestyle had the lowest medians; over 10% of apps in the first three had no trackers.
- Tracking by super genre: Productivity & Tools and Games & Entertainment differed most from the overall tracker ranking, whereas Music was closest; Productivity & Tools and Health & Lifestyle were the largest outliers across genres.Productivity & Tools included trackers such as Mapbox, Alibaba, and Baidu that were absent from the overall top 20.
- Tracker company jurisdictions: Just over 90% of apps contained a tracker owned by a United States-based company, while the median app was associated with companies in one country.The United States remained most prevalent in every genre, at 86–96%, but other country rankings varied by genre.
5 DISCUSSION
The discussion examines regulatory implications of mobile tracking, emphasizing methodological limits, cross-jurisdictional data transfers, profiling, and protections for children.
- 5.1 Limitations of data collection methods: The tracker knowledge base is incomplete, and expanding it to include less prevalent domains could change the reported results.The study also cannot confirm precisely what data apps send without dynamic traffic analysis and payload interpretation.
- 5.2 Mobile tracking context: Large-scale mobile tracking studies are harder to scale than web studies because smartphone app distribution lacks the web’s standardized, automatable delivery model.
- 5.3 Regulatory implications: Transfers to trackers in non-adequate jurisdictions such as China, Russia, and Singapore require additional safeguards under the GDPR.The study cannot determine whether the identified companies have implemented those safeguards, although the affected apps number in the tens of thousands.
- 5.3 Regulatory implications: Behaviourally targeted advertising may constitute GDPR profiling, which can raise Article 22 concerns when it has legal or significant effects.The paper notes that intrusiveness, targeting vulnerable groups, differential pricing, or depriving opportunities may contribute to significant effects.
- 5.3 Regulatory implications: Children’s data receive additional protections, including parental consent requirements under 13 and special safeguards for marketing and profiling.The paper states that these protections likely cover many trackers embedded in Family and Games apps.
6 CONCLUSION
The conclusion presents a systematic analysis of tracking across nearly one million smartphone apps and reports substantial variation by app genre and tracker jurisdiction. It argues that the findings create compliance and enforcement challenges requiring attention beyond individual apps.
- 6 CONCLUSION: Analysis of close to 1 million smartphone apps provides systematic evidence about the breadth and scale of mobile tracking.The study contrasts this coverage with earlier studies involving tens of thousands of apps that could be skewed toward participating users’ app choices.
- 6 CONCLUSION: News and Games apps appear among the worst categories by number of associated tracker companies, while around 100,000 apps send data to trackers in multiple jurisdictions.
- 6 CONCLUSION: The findings indicate compliance and enforcement challenges for regulators and companies, with prevalent trackers potentially serving as more efficient investigation targets than apps.The paper also identifies possible unlawful profiling of children without parental consent and unresolved questions about behavioural targeting with significant effects.
- 6 CONCLUSION: Effective regulation requires collaboration among regulators, users, operating-system developers, manufacturers, app-market operators, app developers, and tracking companies.