Josh Hendrickson
It’s not bad enough that Ring blames its users for its security problems, now, according to the Electronic Frontier Foundation (EFF), it turns out the company is sharing vast amounts of data about its users with third-party trackers. And while you can always expect some loss of privacy with smart home tech, the amount of personally identifiable information (PII) the company shares is appalling, if true.
They Know Who You Are
Recently the EFF dug into the Android version of Ring to determine what trackers the app employs. In the course of that investigation, the EFF detected the app sending data in bits and pieces to four marketing companies, Facebook, Branch, AppsFlyer, and MixPanel. Each company receives a different level of information, though every company sees enough data to track any given user.
In the case of Facebook, the company sees when you open the Ring app, interact with it, and even when you let the app idle and deactivate. The company also receives information about user’s devices, including time zone, device model, language preferences, screen resolution, and a unique identifier. The company sees all that whether or not you have a Facebook account.
The unique identifier is especially disconcerting, as it’s separate from Android’s advertiser ID. Meaning if you reset a user resets their advertiser ID at the OS level, Facebook still knows who they are. That inability to escape individual tracking persists across all the marking companies.
Branch, for instance, receives unique identifiers about user’s devices, including a device fingerprint id, a hardware id, and an identity id. It also sees the user’s local IP address, device model, screen resolution, and DPI. That’s enough information to identify individual users (even if it may not know their name).
AppsFlyer sees even more data, right down to the sensors on a user’s phone or tablet (such as gyroscope and accelerometer). The company also sees interactions with the “Neighbors” portion of the Ring app, along with information about the user’s mobile carrier. It can also detect if its tracking software came preinstalled on the device (a common occurrence with low-end, inexpensive Android phones).
MixPanel receives the most information about users, including full names, email addresses, and device information. The company also sees OS information, the model of the device, if Bluetooth is activated, and more. MixPanel will even see the number of locations where a user installed Ring products.
That’s quite a lot of identifying information, and in some cases (such as MixPanel or Facebook, if you have an account), it’s enough to identify individual people and track them elsewhere. Frustratingly, you can’t opt-out, and Ring didn’t disclose all this tracking. And once the data is out of Ring’s hands, it can’t control what other companies do with it (good or bad).
Now more than ever, it’s hard to recommend Ring as a trustworthy smart home company. And that’s why we’ve already put together a list of alternatives to consider. If you’re interested in purchasing smart home tech, you can always expect a loss of privacy in the process.
Update: We received the following statement from a Ring Spokesperson:
Like many companies, Ring uses third-party service providers to evaluate the use of our mobile app, which helps us improve features, optimize the customer experience, and evaluate the effectiveness of our marketing. Ring ensures that service providers’ use of the data provided is contractually limited to appropriate purposes such as performing these services on our behalf and not for other purposes.
Source: Electronic Frontier Foundation via XDA-Developers
