Slashdot Mirror
Google Store Sends User Information To App Developers
Several readers have passed on news of a privacy hole in the Google app store. Reader Strudelkugel writes with the news.com.au version, excerpting: "Every time you purchase an app on Google Play, your name, address and email is passed on to the developer, it has been revealed today. The 'flaw' — which appears to be by design — was discovered this morning by Sydney app developer Dan Nolan who told news.com.au that he was uncomfortable being the custodian of this information and that there was no reason for any developer to have this information at their finger tips."
Today I learned that app developers don't deserve to be treated like real merchants
It did seem a little... more information than I really needed, yes.
I sort of assumed everyone knew, because when has Google ever cared about privacy?
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
literally every single person that's ever sold at least one app on the app store since the beginning of the app store has "discovered" this
No reason of course unless you want to be able to verify the app purchase before providing support.
But considering how many malicious or spoof apps have been on the Android store, I'd be worried too.
I'm out of my mind right now, but feel free to leave a message.....
From the article:
Google has not responded to news.com.au's request for comment.
UPDATE: This story has been amended at the request of Google.
So has Google responded or not?
Alright, so the Play Store should probably tell you that your personal information is about to be given to whomever you purchase an app from, but seriously, this is already true for every Paypal or credit card purchase you've ever made too.
- Michael T. Babcock (Yes, I blog)
called.. HotChicksOnly
Join the Slashcott! Feb 10 thru Feb 17!
It's even worse.
No reason of course unless you want to be able to verify the app purchase before providing support.
Many people sent up junk email accounts specifically for using with things like app stores - you cannot rely on the email the user bought under being the one they would use for support.
But really the concept of checking is outmoded - real customer service is helping whoever asks, however they came by the app. If you have an overload of customer support then it probably means you need better app design, not more ways to put gates up in front of people using your app that need help.
As an iOS developer I've never been bothered by not being given customer contact info from Apple, because if they like your app enough they will give that information freely. You just have to provide some means to collect it.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The article states several times that this applies to paid-for apps, but what about free ones?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Google logs the private search data of billions of people across the world, and voluntarily pipes all of it to various 3 letter agencies in the U.S. ---- Google has no understanding of what privacy is, had not had an understanding of what privacy is, and will likely never have an understanding of what privacy. ----- Google is a spying machine disguised as a useful search engine. Period. ----- None of what they are doing on their app store is thus terribly surprising. Google suxxors at protecting your privacy. Something we all have to live with (... and the reason I personally don't use Google's services anymore).
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
Real merchants don't "deserve" your personal details any more or less than appstore merchants. There may be a need to take your address for shipment, and in that case a phone number, email adress, or even additional shipment instructions may be useful. But they ought not be required without good reason.
Note that credit cards muddle the picture by virtue of being a credit facility: You haven't actually paid yet so you are in debt and those obligations add identification requirements. Though strictly speaking all the merchant is supposed to do is pass it on to the credit facility for turning into money, and passing it in the clear is rather outdated, and well-known to be dangerous. Without credit as in payment by cash there and then, much of the need to identify you personally goes away.
That this information is useful for profiling and all sorts of marketeering and so it's nice to gather, well, plenty furrin places you're not even allowed to do that. I'd say the practice to pass on information that really isn't needed is a dangerous habit that needs reconsideration.
N'mind that it may possibly be useful to send emails in case of updates or whatnot. Passing that information automatically without need is a flaw, yes. Even if done by design.
http://www.fakenamegenerator.com/ I just keep re-rolling until I get a zip code that's close.
Then use that information to fill out forms and accounts; keeping it on file for future reference.
My security doesn't stop at a HOSTS file and malware protection. But I use Gmail for
all of these accounts so it's not perfect.
And the culprit here is... cloud computing (or clown computing). It's absurd that you have to give up your identity to download software in the first place. Because Google is in charge of the data, they can do what they want.
I'm sure now that it's been pointed out they will fix it, to keep the users happy. But that's besides the point. None of those users gave their own data to the developers. Users deserve better!
What I think many commentators are missing is that Google, as the actual seller of the app, is like a retail outlet. The app developer is selling through Google, not directly.
What Google is doing here is like Best Buy sending my information to Sony if I purchase a Sony camera at Best Buy.
I hope they stop this leaky, unpredictable practice. It's counter-intuitive to what the buyer rightfully expects, which is that their information is exposed to the primary seller only (Google) and not secondary providers like the app developers.
I'm not sure I see a problem here. The seller is told who the buyer is. That's reasonable enough. It also keeps Google honest with respect to sellers - you can have some people make test buys and make sure that Google pays you for them.
I'm generally critical of Google's non-approach to non-privacy, but here, there's a real transaction, with money.
Wait, this is new? I released my first paid app in November, and the only information you get is email, zipcode/city and name. I've been using the zipcode information to put pins in a map to see everywhere in the world I've sold to, heh.
review
i don't tolerate any bad reviews on my apps. i either kill them myself or take a hit out
This is not news, this is simply stupid. Of course [Your Local Sleazy Porn Store] get[s] details of THEIR PAYING CUSTOMERS, what's wrong with that?
Do you really need me to explain it?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
And the culprit here is... cloud computing (or clown computing)
Holy shit! That is the most relevant, creative pun I've ever heard! It makes sense because we're all clowns! Using computers! You deserve the king of puns award!
Why do they need my name and address? They're not shipping me anything.
...is how many people here on slashdot are posting that this isn't a big deal or it is to be expected.
I understand that it might not be immediately obvious, but I don't think this was a secret by any means. It uses Google Wallet for payments, which is essentially Google's answer to PayPal, and this gives your contact details to the person you are buying from. The first time I bought anything from Google Marketplace, I received a confirmation email from the developers themselves, it never occurred to me that people might not realise this.
I can see both sides of the argument. I've seen what happens when developers don't have this information, such as with Apple's App Store - it's very frustrating as you want to reach out to customers that have had problems and posted negative reviews to try to solve their problem and prevent it from happening to anybody else, but you've got no way of contacting them.
On the other hand, I've been spammed by people I've bought goods from through Amazon's Marketplace, so I'm not keen on that happening again. The ideal solution would be for Google to provide a forwarding, anonymised email address to the developers, like Facebook do with Facebook app developers.
Bogtha Bogtha Bogtha
Precisely. This is akin to buying a coffee maker at Walmart and then Walmart sends your contact information to Black+Decker.
But, wait, there's more! Black+Decker now knows every time you make a cup of coffee, thanks to the ad system tied into the coffee maker. They also know what type and brand of coffee you're getting each time.
Now many will argue that they don't care who knows what about their coffee. But, I care and neither Walmart nor Black+Decker disclosed this leakage.
The simple matter is that Black+Decker does not need to know, so I take offense to them superstitiously extracting that information. Additionally, my coffee preferences are just one more detail of my life that is being assembled into a cohesive profile of details from all sorts of sources who acquired minor details without me knowing or accepting that they would be combined with all the other details for other sources. Said profile will then be used against me to market, possibly coerce, targeted usury pricing, exclusion from service, or who-knows-what other unanticipated consequence.
Google(Walmart) should not me giving my information to Rovio(Black+Decker)!
Gotta love the Google hate....
http://www.larrysworld.com/2011/02/21/publishers-worry-about-apples-subscription-service/
This has been this way a long time. And even "larry's world" gets the 3rd party amazon stuff not quite right - your details do get passed along if Amazon does not handle the fulfilment.
http://marketingland.com/why-im-glad-google-play-gives-developers-customer-data-33431
As this developer states, he'd much rather have that kind of information than the fumbling around in the dark through Apple's filters.
"I want to be able to service my customers, and yes, they are my customers, not Google’s and not Apple’s customers. They download our products. They call the developer with questions. We provide them the tools and the content. They are our customers.
Apple doesn’t tell us who our customers are, and when we need that information to verify ownership or to give refunds, we are left with blindfolds on."
They share information regardless of the app's cost.
Your question should be: is the account you are using an anonymous throw away account, for free apps? If so, it doesn't matter if they share.
Or, are you using a personally identifiable account with real information and a credit card number? If so, you may take issue with the sharing, as I do.
Yeah they get nothing.
slashdot excerpt states it sends the developer the user's address, when the article states it only sends the "suburb" (or ZIP code for us in the US and such). I see no problem with this, it's no more than basic demographics information and email/name for customers of all digital goods. Digital purchases have always had information like this sent to the party who manages Support/Problems. This is not like going into a grocery store and buying ketchup. If that ketchup bottle was already opened/expired, you complain to the store and get a new one without involving the manufacturer. If an Android app doesn't work, you don't complain to Google, you complain to the developer. If they gave the developer an actual address to your front door, that would be different. But ZIP codes and suburbs have been standard information in demographics for years (as a merchant using both in-person credit card transactions, and online transactions via other services, this is nothing new). Even my phone credit card processor gives basic information, and even can link it to their contact information in my phone if I ever shared correspondence.
The man who cannot imagine a horse galloping on a tomato is an idiot - Andre Breton
You do get name, city name, and zip... you do not get an address. That's simply false.
Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
Every app developer purchases traffic via banners / text links to promote their app. Without this campaign data being passed along there is no way to tell the conversion ratios! Very very serious
I am a Google Play developer. I have noticed that I get the names, email, and location of the purchases. This does not include the address though. Only the town, zip, and country. I have looked back at old records and see the email address listed in the purchase records, but I seem to recall this being obscured previously. Unless I am mistaken in some way, it used to give a long apparently randomly created email address for each purchase. I had assumed that this would forward or link to their real email address through Google's records of the purchase, but it looks like they did away with that and now just have your email address listed in the purchase record.
Personally, I find no reason to have the email address. There is nothing I would want to contact them about. But the sales are in a more general form. It's actually Google Checkout that does the sales for the Google Play store. You could sell knitted sweaters through your Google Checkout account and the shipping and delivering and returns are all a part of the processing procedures. When someone cancels a Play purchase, the entry has a notice to me that I should not ship the product to them. This is even though it is an Android App that Google itself handles all the delivery of. So I can see why some contact with the buyer might be necessary in some cases, but not with a typical Play store purchase.
<Rant Begin> The people I would really like to be able to contact would be the ones who leave stupid reviews. "One Star - It really needs so and so feature!" Hey dumbass - it has that feature! Of course I am much more polite with my real communications to bug reports and such, but it amazes me how many people don't even pay attention to the hints, instructions, and preferences that I have given to make sure they see what they can change. <Rant End>
-- ssoorrrryy,, dduupplleexx sswwiittcchh oonn.. -Quote found on actual fortune cookie.
All arguments about this particular situation aside, it's stupid to point your finger at a particular technology company and say "bad privacy!!1!".
Your credit card company knows what you buy and where you live. The checkout chick at Woolies/Kmart/Whatever can know your name when you hand over the card. eBay has a record of everything you've purchased (and when, and from whom...). Anyone at all you've dealt with could be storing your previous address. Need I go on?
...and don't even get me started on store loyalty cards!
It's OK Bender, there's no such thing as 2.
Why do they need my name and address? They're not shipping me anything.
I wish they did!
No, Google is simply the distributor and card processor. The developer is the seller of record. I suspect that there are some serious tax liabilities if Google were to sell the apps directly.
This isn't even true in my experience. I get an address, a google checkout anonymous email, and some username that often isn't even their real name. Rarely I'll get a real email address, but I assume those people aren't using the Google Wallet feature to not give merchants your email address.
The app is just a vehicle to generate marketing leads, that is where the gold is.
Rick B.
"Google Store Sends User Information *That They Think They Have* To App Developers"
"...*the fake name, fake address and throwaway email that you registered with Google Wallet* is passed on to the developer..."
There. FTFY.
Why would anyone give the big G their real name? Learn how to use Visa or MC gift cards, man!
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
Section 4 of the Google Play Legal Information says the following, which means you're buying the app from the provider of the app (the developer) and not Google, which seems to mean that the developer is in fact the merchant whether he realizes it or not. It doesn't really surprise me that the merchant gets this information but it does surprise me that the developer doesn't realize they are the merchant! Maybe it needs to be spelled out more clearly to all parties.
( via https://play.google.com/intl/en_us/about/play-terms.html )
Direct, Agency and App Sales.
When you buy Products from Google Play you will buy them either:
(a) directly from Google (which is referred to as “Google”, “we”, “our”, or “us” in these Terms) (a “Direct Sale”);
(b) from the provider of the Product (the “Provider”), where Google is acting as agent for the Provider (an “Agency Sale”); or
(c) in the case of Android apps, from the Provider of the app (an “App Sale”).
In order for Google to fit that deffinition they would have to trade in apps. They don't ever buy apps from developers so no trade is occuring. They would likely argue that they don't sell apps either. However they label the the marketplace as labeled "Google Play Store" on peoples phones. The "Google Play Store" also has "Accept and buy" buttons and it. Developers are labled as "Developers" not as "Sellers".
So, does Google allow a middleman to sell apps on their market?
Sounds like an enterprising person could have a good business just taking care of the taxes, etc. for small developers using the android marketplace; if Google doesn't want to fill that roll like Apple does.
also, what does Microsoft and RIM/BlackBerry do in this regard?
What Google is doing here is like Best Buy sending my information to Sony if I purchase a Sony camera at Best Buy.
I'm not convinced that Best Buy doesn't sell it's customer lists to Sony. The only reason it would not give this information to Sony would be cash/business case related and have nothing to do with you or your opinions of what Best Buy should do with your name and address.
.
A better example is perhaps that if you buy something on eBay, the seller gets all your details - even if the product is electronic. (please tell me that this isn't news to you)
It's a transaction between you and the app seller, if you don't trust the app seller (or the eBay seller, or the shady website offering good deals) don't execute the transaction.
surreptitiously
s/superstitiously/surreptitiously
Stupid reliance on spell check.
Are you a radio jockey in the Tampa Bay area by chance?
Is it weird that I think this is a good thing for app developers? Along with some apps on the various app stores, I have an online store (PayPal, barf) that I use for selling video plug-ins. Since it's "my" store, I get all customer information every time there's a purchase. As a result, whenever I have updates or new products I like to be able to send out an email to all my customers with a promo code and a quick "Thanks for buying from me in the past, as a reward here's a discount code for some new stuff!"
I get a lot of new sales that way.
With these app stores, I don't have a lot of info about my customer other than the poorly managed review process, and in the case of Apple, the remarkably shitty "sales manager" window.
I like knowing who my customers are, it helps me be a better vendor. Of course, I'm not an evil email harvester or spambot.
Does Google automatically figure out any and all relevant tax information and present it to the developer? If not, that's a very good reason for having at least some of this information.
No, what I think many people (including parent) are missing is that, per the terms of the agreements with both buyers and sellers, Google is -- unlike the operators of some online marketplaces with superficially similar user experience -- not the actual seller of the app, but simply provides a marketplace where buyers can find sellers and digitial delivery and payment processing services to enable transactions between the actual buyer and seller to be completed.
You know /. has reached a new low when they're posting about articles from news.com.au... not only is this not news; but news.com.au is basically Fox News Australia (which I read because its hilarious).
They changed their name recently, but it still operates as a market: it serves as a place for sellers and buyers to meet and make a transaction and it takes a fee for the service. You can't compare it with a grocery shop selling a box of cereal, the grocery shop has to buy in advance to have stock therefore there are two transactions, manufacturer shop and shop consumer. The manufacturer does not know who the consumer is, but he knows very well who the shop is, and the shop knows who comes to make purchases. in the case of the Play Store purchases are made directly from buyer to app developer.
But it's open.
Google's probably not going to be allowed to do this in the UK and continental Europe, because of Data Protection Authority rules. Google will be registered with the DPA in each country in which it does business, but this places a burden of responsibility on the company to not divulge the personal details it receives to others, as it seems to be doing.
Whether Google is the merchant or a middleman in this case is irrelevant. The same duty of protection applies to all DPA registrants.
It's not like Android users pay for software anyway.
Just avoid the Google Play store. ./adb shell /dev/block/mtdblk3 /system ./adb pull fileonphone localfile and delete some files: /system/app/Gmail.apk /system/app/GoogleBackupTransport.apk /system/app/GoogleCalendarSyncAdapter.apk /system/app/GoogleContactsSyncAdapter.apk /system/app/GoogleFeedback.apk /system/app/GooglePartnerSetup.apk /system/app/GoogleQuickSearchBox.apk /system/app/MarketUpdater.apk /system/app/GoogleServicesFramework.apk /system/app/Talk.apk
1. Install the free software only app-store http://f-droid.org/
2. Root your phone
3. Install Android SDK, cd adt-bundle-linux-x86_64/sdk/platform-tools
4.
5. mount -o remount,rw -t yaffs2
6. Perhaps backup with
rm
rm
rm
rm
rm
rm
rm
rm
rm
rm
You may want to keep GoogleServicesFramework.apk if you plan to ever use some kind of Google services again. You do not _need_ to use the Google Play appstore or any Google services at all just because you happened to buy a $95 Android phone at the local grocery store (that's what my Samsung GIO set be back a week ago).
9/11: Never forget it was a false-flag operation
I guess now I understand where all of the spam on my private account came from... This needs to be made more obvious to people buying apps.
I have a new Android phone. I have my doubts about opening a gmail account just to download free apps. This revelation has decided me, for sure.
"Ordinary Market?" If I walk into Tesco and buy a pumpkin, does Tesco demand my name and address? No. If I use a credit card, does Tesco send my name and address to the farmer? No way.
A developer is a producer, not a vendor. I can buy Windows in a brick-and-mortar store and they don't tell Microsoft my name and address.
And since 1 March 2012, your free Android app downloads are in your Google database along with your Google searches and your gmails and the YouTube videos you watch.
Can I install apps from other sources? Sure. Just get the APKinstall app (from Google). Oops; recursion!
Yes, I'm getting to be an Anonymous Coward.
Some details are needed for those that choose to ask for a return outside Google's purchase window, buy your app and then complain to the credit card company that they did not purchase anything from you, etc. There's all kinds of situations Google Play does not handle and the app dev needs basic buyer information in order to protect themselves. If Google Play would step up and intercede on a developer's behalf and handle any such situation, then I would be glad to never receive buyer info. As things stand, however, any dev will need such info.
If I want support from an app developer, they'll be more likely to listen to me if they know I'm a paid customer. (For those who don't want support, it would be nice for Google to offer anonymous purchases, though.)
And what if you pay by check? Then the merchant gets your name, address, and bank account number from the front of the check, and probably asks for your drivers license number, and possibly a phone number. That's a lot of personal info.
dammit. I downloaded an app from the 'play' store and soon I got 'auto added' to some stupid mailing list. of course, i never asked to join the list and it was not easy to get off of it, either.
when I yelled (using some colorful language) at the so-called owner of the app, he acted all surprised that I was pissed off at his behavior.
had to add a mail filter to stop his absurd 'blog' comments that he insisted we all receive.
google, you have fucked me again. I knew you were no trustworthy but this really takes the cake.
this spamming behavior really need to hit the major news so that everyone knows who and what they are dealing with when they 'download an app' and think that some discretion is preserved.
I hope, someday, google crosses someone with some serious legal power. its just a matter of time before they fuck with the wrong powerful person. and I will cheer the day that google gets punished for their irresponsible behavior.
--
"It is now safe to switch off your computer."
The developer sells you a license i.e. the right to use his software. He has every right to know who is licensed to use the software and who's not.
"our details do get passed along if Amazon does not handle the fulfilment."
Google handles fulfilment of Google play downloads, so in that case handing the info to the merchant would not be necessary and would not be done.
So your comments are misleading.
Really, this is highly creepy. It's not ancient news to me, I've only just heard of it.
Wow, creepy.
Hey guys he is telling the truth, we need to stop him from ruining this flamewar!
I've been skating by with non-"smart" phones so far, but, going forward, it seems like even cheap phones are going to be Android phones.
So: to what extent is it possible to run an Android phone without a Google account tying everything you do, every email you send, your name/cc/home address, and where you go and who you call into one big database?
It's disturbing the way you used to be able to download apps anonymously off of getjar.com for Java phones but you can't do that on Google Play. It'd be nice to download an app, and then transfer it to your phone separately (meaning you wouldn't have to have Internet on your phone or use up your quota).
I'm not a lawyer, but I play one on the Internet. Blog