DuckDuckGo’s Android anti-tracking tool could be “even more powerful” than iOS

Privacy-focused research site DuckDuckGo has added another way to prevent more of your data from being passed on to advertisers, by opening up its app tracking protection for Android to beta testers.

DuckDuckGo positions App Tracking Protection as something like Apple’s App Tracking Transparency for iOS devices, but “even more powerful”. Enabling the service in the DuckDuckGo app for Android (under the “More from DuckDuckGo” section) installs a local VPN service on your phone, which can then start automatically blocking trackers on DDG’s public blocklist. DuckDuckGo says this happens “without sending application data to DuckDuckGo or other remote servers.”

DuckDuckGo’s App Tracking Protection shows you details about what your Android apps are trying to send.[/ars_img]Google recently provided Android users with native tools to prevent gratuitous tracking, including app-by-app approval of location tracking and limited opt-out of native ad tracking. Apple’s App Tracking Transparency asks if users want to block apps from accessing the Identifier for Advertisers (IDFA), but apps can still use the larger tracking networks across many apps to better profile app users.

Allison Goodman, senior communications manager for DuckDuckGo, told Ars Technica that App Tracking Protection needs Android’s VPN permission to be able to monitor network traffic. When it recognizes a tracker in its blocklist, it “looks at the destination domain for any outgoing request and blocks them if they are in our blocklist and the requesting app is not from the same company that owns the domain”.

Goodman added that “much of the data collected by trackers is not controlled by [Android] permissions”, making App Tracking Protection a complementary offer.

App Tracking Protection launched a year ago in a limited beta. Since then, DuckDuckGo has updated the app to show you more information about the types of data trackers are trying to collect, “like your precise location, age, and a fingerprint of your phone.” Through its testing, DuckDuckGo has found that an Android phone with 35 apps can see 1,000 to 2,000 tracking attempts every day, sending data to over 70 companies.

WIRED’s Matt Burgess tested the app when it launched, installing 36 apps on a new Pixel 6 Pro and logging into about half of them:

These included the McDonald’s app, LinkedIn, Facebook, Amazon and BBC Sounds. …I left the phone alone for four days and didn’t use it at all. Within 96 hours, 23 of these apps had made more than 630 background tracking attempts.

When I opened the McDonald’s app, trackers from Adobe, cloud software company New Relic, Google, emotion tracking company Apptentive, and mobile analytics company Kochava tried to collect data about me. Opening the eBay and Uber apps, but not logging into them, was enough to trigger Google trackers.

DuckDuckGo notes that some apps are still excluded from tracking protection because they require tracking to function properly, especially browsers and apps that have built-in browsers. When DuckDuckGo’s protection was installed on an Android phone early last year, I had trouble renting scooters and e-bikes from Lime and accessing my building’s door unlock service. Again, that’s probably the kind of feedback DuckDuckGo is looking for in this beta.