An Analysis of Web Tracking Domains in Mobile Applications

Modern web browsers provide users an improved awareness of how websites track them and the potential use of data that is gathered. These features can be built into the browser or provided through an extension. Recently, DuckDuckGo, a privacy advocate and privacy focused search engine company, made publicly available the data they use to inform users of trackers in their browsers and extensions. While users can install extensions or use default browser features to inform themselves of how websites use trackers and potentially block trackers, this availability is limited in mobile applications that communicate with the same services as websites. In this paper, we utilize the data set from DuckDuckGo to analyze mobile applications on iOS. We investigate the top applications in categories designed to provide information to users or that are used in social networks. We also identify which of these applications utilize personal data on the device including location, contacts, and photos. From this investigation, 84% of the applications communicated with domains categorized as advertisement or analytics services that track users. 18% of the applications transmitted the user's location where of these, 95% communicated with domains classified as trackers. The most common tracker utilized is from Google where 55% of the applications utilize their tracking services and in general, 89% of the applications communicated with Google's services. While progress has been made in providing more transparency in web browsers, there is still work to be done in mobile operating systems. We advocate that the same features in web browsers become available through the native mobile operating system. As mobile operating system producers shift towards more privacy controls being generally available to users, this can be one more step in providing more transparency to the user in how applications use their data.