It would be really interesting to get a packet capture of what exactly they are sending in the payload.

Some of it may not be tracking, but rather eager loading info. Like each time a call comes in I bet they query the spam call database to see if the number is spam so they can show their warning. I really like that feature. It would be good to know what is really "tracking" and what is not.

I believe they encrypted it enough to hide from prying eyes like ours.

It would be interesting to know if this was a pinned certificate. I'm guessing it is. Probably have to run a debugger on the play store process.

Eager loading into is tracking

Not necessarily. If it isn't tracking the user (recording his behavior or request) then it isn't tracking.

Let's be reasonable here. The requests are definitely logged, hence it is tracking.

Google maps also tries to get your location when the phone starts! You can avoid all of this by running LineageOs and not installing Gapps. Or install them, and use XPrivacyLua to lie every time play services asks.

I can't do this for my daily driver (stupid work apps don't allow root without much fiddling), so I compulsively turn off location permission.

Google won't add a feature to spoof location or even block play services because of obvious reasons. The best course of action if you don't want to be tracked constantly is LineageOs or iPhone

Question from someone who does not know about LineageOS: is it secure? Where do you get the apps from? What about the bank apps? Do you trust it?

F-Droid is an open source app app store and it works really well. For other apps you can sideload, the most secure way is by grabbing the APK from a device that has play store.

Increasingly more apps won't work because Google tries to link everything to their services. So that stock Android without Google's bs is useless. Thankfully we have these things called websites I can use whenever the app doesn't work.

I trust it more than I trust Google.

> For other apps you can sideload, the most secure way is by grabbing the APK from a device that has play store.

You can install Play Store apps with Yalp Store without any G account. It is available on F-Droid.

I use it on kids' tablets to avoid logging into my account there.

> Thankfully we have these things called websites I can use whenever the app doesn't work

Lol :)

Indeed it does. I forgot that one.

iPhone doesn't track? Or less extensively?

iPhone let's you turn off location permissions per app and doesn't allow "background" location requests in most cases.

With many Android apps, giving them location permission means they will ping it in background endlessly even when app isn't running

It vastly disappoints me that Google is allowed to get away with this sort of thing without huge public outcry.

Vast majority of people are not concerned about their data until they see possible repercussions of someone using it.

Judging from what I see, public awareness about privacy (and hence avoidance of Google/Facebook and other services) is rising. Not as much as I would like it to see, but it's slowly rising. Hope it's not only my experience.

The most offensive of all this to me, is the loading of your Google account contacts into your phone.

My phone is for a small subset of friends and family, not every person I ever emailed.

Try when G+ added all your social media contacts to Gmail. And gave them Calendar access.

That went down poorly.

This is incorrect. Play Services is just a set of proprietary APIs that Google enables for Android: https://developers.google.com/android/guides/overview If you really want to see when data is being sent to Google, use Fiddler or something similar to look at the actual packets.

It's not really that far off the mark. Their "enhanced device positioning" bs, if you have it turned on(almost everyone does, it's default), will report your location to Google any time any app needs device location.

If you turn off "enhanced device positioning" you run into a ton of dark patterns like Google maps asking you to turn it back on any time you use it.

That's true. Not only that, but google maps generally purges whatever query you're searching for one you close the app, likely so they can put at the top "tired of typing that? Sign in to let maps search from your history and..."

Terribly annoying

well from a privacy focus wouldn't you want your app to not save state in ANY way

There's nothing wrong with the app saving state. It's strictly superior to the alternative they're pushing, which is saving state on Google servers.

The solution is as obvious as it is unlikely to happen: on-demand one-time high resolution location pings, which switches off as soon as it has a fix.

The choice should also not be "high accuracy" vs "low accuracy" but active vs passive.

They'll never do it tho. Android was a mistake.

I've tried many alternatives to Google Maps, and ultimately came back to it.

But for it to be so relevant, I think that a reasonable level of 'tracking', even in real time, is necessary.

I am a privacy advocate, always trying new and open source alternatives (had to learn command line in the process), but sometimes the overhead for having a decent and sometimes quick service is not worth it.

My 2 cents...

I'm so conflicted about using Android and I haven't taken the time to fiddle with LineageOS. I've switch a lot of services away from Google at this point and I just don't see how I would be happier using a closed ecosystem like iOS and I don't think Puri.sm will cut it as a daily driver.

> In an attempt to de-Google my life, I recently disabled Play Services. Now, my Pixel 2 XL complains every time it can't "phone home."

Wouldn't it be easier to get a new phone that isn't created by the (ad) company you're trying to avoid?

OP here... I almost forgot. Play Services also tracks every single outgoing phone call you make. You'll see the notification/complaint as soon as you hang up.