[tor-talk] trackers in OONI Probe Mobile App / was: NEW RiseupVPN test in OONI Probe Mobile App

[Christian Pietsch]

Dear Maria,

On Mon, Feb 08, 2021 at 11:15:43AM +0100, Maria Xynou wrote:
> Importantly: You can opt-out of Countly and Firebase data collection by
> disabling this in the Settings of your OONI Probe app.

I'm afraid by the time users have found this opt-out, the app has
already transmitted data to Google and Countly. This violates the
GDPR. The GDPR also demands opt-ins for this kind of surveillance.

> We recently enabled Firebase because we were investigating several app
> crashes that were not being displayed properly by Countly.

This is not correct. According to the Ex0dus database, the OONI Probe
app has included Google Firebase Analytics for many versions:
https://reports.exodus-privacy.eu.org/en/reports/search/org.openobservatory.ooniprobe/
The tracker you recently added is called Google CrashLytics:
https://reports.exodus-privacy.eu.org/en/reports/163803/
 
> We are not sure if we are going to keep Firebase in the long-run, but
> it's difficult to investigate app crashes without proper reports.
>
> Do you have any suggestions for better tools to collect app crashes on
> Android?

Are you looking for a replacement for Google CrashLytics or Google
Firebase Analytics or both? I can ask around on Twitter and in the
Fediverse if you need advice.

> You can learn more about OONI data practices through our Data Policy:
> https://ooni.org/about/data-policy

This document does not mention Google or Countly. This is another
reason why your app violates the GDPR. In case do did not know, the
GDPR is applicable law for anyone targeting EU users.

Cheers,
C:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20210210/9a2d604a/attachment.sig>