All posts in “Android”

Facebook, Google face first GDPR complaints over “forced consent”

After two years coming down the pipe at tech giants, Europe’s new privacy framework, the General Data Protection Regulation (GDPR), is now being applied — and long time Facebook privacy critic, Max Schrems, has wasted no time in filing four complaints relating to (certain) companies’ ‘take it or leave it’ stance when it comes to consent.

The complaints have been filed on behalf of (unnamed) individual users — with one filed against Facebook; one against Facebook-owned Instagram; one against Facebook-owned WhatsApp; and one against Google’s Android.

Schrems argues that the companies are using a strategy of “forced consent” to continue processing the individuals’ personal data — when in fact the law requires that users be given a free choice unless a consent is strictly necessary for provision of the service. (And, well, Facebook claims its core product is social networking — rather than farming people’s personal data for ad targeting.)

“It’s simple: Anything strictly necessary for a service does not need consent boxes anymore. For everything else users must have a real choice to say ‘yes’ or ‘no’,” Schrems writes in a statement.

“Facebook has even blocked accounts of users who have not given consent,” he adds. “In the end users only had the choice to delete the account or hit the “agree”-button — that’s not a free choice, it more reminds of a North Korean election process.”

We’ve reached out to all the companies involved for comment and will update this story with any response. Update: Facebook has now sent the following statement, attributed to its chief privacy officer, Erin Egan: “We have prepared for the past 18 months to ensure we meet the requirements of the GDPR. We have made our policies clearer, our privacy settings easier to find and introduced better tools for people to access, download, and delete their information. Our work to improve people’s privacy doesn’t stop on May 25th. For example, we’re building Clear History: a way for everyone to see the websites and apps that send us information when you use them, clear this information from your account, and turn off our ability to store it associated with your account going forward.”

Schrems most recently founded a not-for-profit digital rights organization to focus on strategic litigation around the bloc’s updated privacy framework, and the complaints have been filed via this crowdfunded NGO — which is called noyb (aka ‘none of your business’).

As we pointed out in our GDPR explainer, the provision in the regulation allowing for collective enforcement of individuals’ data rights in an important one, with the potential to strengthen the implementation of the law by enabling non-profit organizations such as noyb to file complaints on behalf of individuals — thereby helping to redress the imbalance between corporate giants and consumer rights.

That said, the GDPR’s collective redress provision is a component that Member States can choose to derogate from, which helps explain why the first four complaints have been filed with data protection agencies in Austria, Belgium, France and Hamburg in Germany — regions that also have data protection agencies with a strong record defending privacy rights.

Given that the Facebook companies involved in these complaints have their European headquarters in Ireland it’s likely the Irish data protection agency will get involved too. And it’s fair to say that, within Europe, Ireland does not have a strong reputation for defending data protection rights.

But the GDPR allows for DPAs in different jurisdictions to work together in instances where they have joint concerns and where a service crosses borders — so noyb’s action looks intended to test this element of the new framework too.

Under the penalty structure of GDPR, major violations of the law can attract fines as large as 4% of a company’s global revenue which, in the case of Facebook or Google, implies they could be on the hook for more than a billion euros apiece — if they are deemed to have violated the law, as the complaints argue.

That said, given how freshly fixed in place the rules are, some EU regulators may well tread softly on the enforcement front — at least in the first instances, to give companies some benefit of the doubt and/or a chance to make amends to come into compliance if they are deemed to be falling short of the new standards.

However, in instances where companies themselves appear to be attempting to deform the law with a willfully self-serving interpretation of the rules, regulators may feel they need to act swiftly to nip any disingenuousness in the bud.

“We probably will not immediately have billions of penalty payments, but the corporations have intentionally violated the GDPR, so we expect a corresponding penalty under GDPR,” writes Schrems.

Only yesterday, for example, Facebook founder Mark Zuckerberg — speaking in an on stage interview at the VivaTech conference in Paris — claimed his company hasn’t had to make any radical changes to comply with GDPR, and further claimed that a “vast majority” of Facebook users are willingly opting in to targeted advertising via its new consent flow.

“We’ve been rolling out the GDPR flows for a number of weeks now in order to make sure that we were doing this in a good way and that we could take into account everyone’s feedback before the May 25 deadline. And one of the things that I’ve found interesting is that the vast majority of people choose to opt in to make it so that we can use the data from other apps and websites that they’re using to make ads better. Because the reality is if you’re willing to see ads in a service you want them to be relevant and good ads,” said Zuckerberg.

He did not mention that the dominant social network does not offer people a free choice on accepting or declining targeted advertising. The new consent flow Facebook revealed ahead of GDPR only offers the ‘choice’ of quitting Facebook entirely if a person does not want to accept targeting advertising. Which, well, isn’t much of a choice given how powerful the network is. (Additionally, it’s worth pointing out that Facebook continues tracking non-users — so even deleting a Facebook account does not guarantee that Facebook will stop processing your personal data.)

Asked about how Facebook’s business model will be affected by the new rules, Zuckerberg essentially claimed nothing significant will change — “because giving people control of how their data is used has been a core principle of Facebook since the beginning”.

“The GDPR adds some new controls and then there’s some areas that we need to comply with but overall it isn’t such a massive departure from how we’ve approached this in the past,” he claimed. “I mean I don’t want to downplay it — there are strong new rules that we’ve needed to put a bunch of work into into making sure that we complied with — but as a whole the philosophy behind this is not completely different from how we’ve approached things.

“In order to be able to give people the tools to connect in all the ways they want and build committee a lot of philosophy that is encoded in a regulation like GDPR is really how we’ve thought about all this stuff for a long time. So I don’t want to understate the areas where there are new rules that we’ve had to go and implement but I also don’t want to make it seem like this is a massive departure in how we’ve thought about this stuff.”

Zuckerberg faced a range of tough questions on these points from the EU parliament earlier this week. But he avoided answering them in any meaningful detail.

So EU regulators are essentially facing a first test of their mettle — i.e. whether they are willing to step up and defend the line of the law against big tech’s attempts to reshape it in their business model’s image.

Privacy laws are nothing new in Europe but robust enforcement of them would certainly be a breath of fresh air. And now at least, thanks to GDPR, there’s a penalties structure in place to provide incentives as well as teeth, and spin up a market around strategic litigation — with Schrems and noyb in the vanguard.

Schrems also makes the point that small startups and local companies are less likely to be able to use the kind of strong-arm ‘take it or leave it’ tactics on users that big tech is able to use to extract consent on account of the reach and power of their platforms — arguing there’s a competition concern that GDPR should also help to redress.

“The fight against forced consent ensures that the corporations cannot force users to consent,” he writes. “This is especially important so that monopolies have no advantage over small businesses.”

Image credit: noyb.eu

Some low-cost Android phones shipped with malware built in

Avast has found that many low-cost, non-Google-certifed Android phones shipped with a strain of malware built in that could send users to download apps they didn’t intend to access. The malware, called called Cosiloon, overlays advertisements over the operating system in order to promote apps or even trick users into downloading apps. Devices effected shipped from ZTE, Archos and myPhone.

The app consists of a dropper and a payload. “The dropper is a small application with no obfuscation, located on the /system partition of affected devices. The app is completely passive, only visible to the user in the list of system applications under ‘settings.’ We have seen the dropper with two different names, ‘CrashService’ and ‘ImeMess,’” wrote Avast. The dropper then connects with a website to grab the payloads that the hackers wish to install on the phone. “The XML manifest contains information about what to download, which services to start and contains a whitelist programmed to potentially exclude specific countries and devices from infection. However, we’ve never seen the country whitelist used, and just a few devices were whitelisted in early versions. Currently, no countries or devices are whitelisted. The entire Cosiloon URL is hardcoded in the APK.”

The dropper is part of the system’s firmware and is not easily removed.

To summarize:

The dropper can install application packages defined by the manifest downloaded via an unencrypted HTTP connection without the user’s consent or knowledge.
The dropper is preinstalled somewhere in the supply chain, by the manufacturer, OEM or carrier.
The user cannot remove the dropper, because it is a system application, part of the device’s firmware.

Avast can detect and remove the payloads and they recommend following these instructions to disable the dropper. If the dropper spots antivirus software on your phone it will actually stop notifications but it will still recommend downloads as you browse in your default browser, a gateway to grabbing more (and worse) malware. Engadget notes that this vector is similar to the Lenovo “Superfish” exploit that shipped thousands of computers with malware built in.

Fortnite is finally coming to Android this summer

Fornite is finally coming to Android…in a matter of months. After dominating the iOS gaming charts since March, the wildly popular sandbox survival game will be hitting the world’s top mobile operating system at some point this summer.

Creator Epic Games buried the news in the middle of a larger blog post titled, “The State of Mobile,” noting, vaguely, “We know many of you are excited for this release, and we promise that when we have more information to share, you’ll hear it from us first.”

That news comes amid a flurry of other Fornite related announcements this week. Earlier this morning, Epic unveiled a Battle Royale competition with a large in-game cash prize. This morning, the company also laid out plans to bring voice chat and improved gameplay and controls to the mobile side of things. Stats are coming to mobile, as well, along with a reduced install size.

Not that any of those issues have hampered the games success, of course. Earlier this year, the game was reportedly bringing in $126 million in monthly revenue — even before it arrived on iOS. With its imminent release on Android, that number’s likely to get a whole lot larger. 

Tech devices that make for great last-minute gifts for anyone

Editor’s note: This post was done in partnership with Wirecutter. When readers choose to buy Wirecutter’s independently chosen editorial picks, it may earn affiliate commissions that support its work.

It should be easy to give a gift. But it can be hard trying to choose what gift to give. That’s especially true with technology, where products tend to be more functional than emotional. Here’s what matters most: finding a present that connects to the recipient, creates a sense of enjoyment, and that they’re actually going to use. Here are five tech gifts that will appeal to almost anyone.

Jaybird X3 Wireless Sport Earbuds

The Jaybird X3 earbuds are designed for working out, but their design and great audio makes them perfect for anyone on the go. The X3’s interchangeable tips and fins offer a highly customizable, comfortable fit. Overall sound is high quality out of the box, but we like that the companion Jaybird app allows a tailored listening experience. Eight hours of playback time means you’ll be set throughout multiple workouts or a full work day.

Amazon Echo (2nd generation) Voice-Controlled Speaker

While there’s more than enough buzz surrounding voice-controlled speakers, they’re not yet considered a standard home item. But we think they’re helpful, and we know that a lot of folks find them incredibly useful for ordering food, listening to audiobooks, streaming music, or controlling their appliances and lighting. Our favorite is the Amazon Echo (2nd generation), which does more (and does it better) than any other current model. It supports a huge list of smart-home devices—including thermostats, light bulbs, and vacuums, and it has a set of skills, including offering custom weather, news and calendar alerts. (Note: If you’re giving one of these devices as a gift, make sure the recipient’s preferred music service is supported; Amazon’s devices, for example, work with its own Prime Music service, as well as Spotify, but not with Apple Music.)

Jackery Bolt USB Battery

A convenient device (which at times doubles as a lifesaver) is a gift that anyone would consider a necessity. We researched more than 300 USB power banks and battery packs and tested 40, naming the Jackery Bolt as our top pick. The Jackery Bolt is made out of aluminum and is the perfect size for carrying around in your bag or pocket every day. It has two connector cables (one Lightning and one MicroUSB), and its 6000 mAh battery has enough power to charge a medium-sized smartphone twice.

Nixplay Seed Digital Photo Frame

The Nixplay Seed digital photo frame is perfect way to keep faraway friends and family members in sight. Since it’s Wi-Fi-enabled, you can be anywhere and use social media platforms, cloud storage, or your smartphone to upload pictures. It’s a great gift because new and old moments can be shared anytime, giving viewers more reasons to touch base with you. It has a high-resolution IPS display that can show images in landscape or portrait orientation. The photo frame’s remote and sensor—which turns the device off when no one’s in the room — lets you choose what you want to see at your convenience. Multiple people can create photo playlists through the Nixplay website, or add pictures to be shown by sending them through email. With 8GB of storage it has the capacity to hold roughly 25,000 smartphone photos.

GoPro Hero5 Black Action Camera

The GoPro Hero5 Black is our top pick for action cameras because it can be used for everyday filming, capturing memories during travel adventures, and is great in environments that aren’t suitable for larger, pricier camera equipment. It doesn’t have a clunky case, but it’s still waterproof. For those who usually place tech integration at the top of their gear list, the GoPro Hero5 Black also has a touchscreen interface and voice-control capabilities. During testing we found its footage to be crisp and clear with accurate color in addition to sound quality that’s worth keeping in professional edits.

Garmin Vivosport Fitness Tracker

If you’re looking for a way to jumpstart your exercise routine and you haven’t picked up a fitness tracker, now’s the time.  We’ve tested 23 fitness trackers over the past three years and think the Garmin Vivosport is the best option. Its built-in GPS, long-lasting battery life and color display set it apart from others. In addition to monitoring your workouts (including strength-training reps), it helps keep tabs on your sleep and stress levels, and is Bluetooth-enabled for IOS and Android integration with streaming music and notifications.

This guide may have been updated by Wirecutter.

Note from Wirecutter: When readers choose to buy our independently chosen editorial picks, we may earn affiliate commissions that support our work.

Watch Google I/O developer keynote live right here

Google I/O is nowhere near done. While the mainstream keynote just ended, the company is about to unveil the next big things when it comes to APIs, SDKs, frameworks and more.

The developer keynote starts at 12:45 PM Pacific Time (3:45 PM on the East Cost, 8:45 PM in London, 9:45 PM in Paris) and you can watch the live stream right here on this page.

If you’re an Android developer, this is where you’ll get the juicy details about the next version of Android. You can expect new possibilities and developer tools for you and your company. We’ll have a team on the ground to cover the best bits right here on TechCrunch.

[embedded content]