Research shows that users can be uniquely identified from just four apps

A 2016 study from the French Institute for Research in Computer Science and Automation found that in 95% of cases it takes as few as four of the apps users have installed on their smartphones to reidentify them within a dataset. Based on a study of 54,893 Android users  over seven months, the researchers found that just two apps were sufficient to reidentify users about 75% of the time. However, the list of apps an individual uses is more revealing than that: it can predict traits like religion, relationship status, the languages they speak, and whether they have children. The finding is of particular concern because social media apps have been to share app profiles with advertisers and because of the increased number of data breaches. Android apps do not require any special permission to access the full list of apps on any device; on Apple a platform can generate a list of installed apps by scanning frequently to make a list of what is running on the device.

Writer: Kari Paul
Publication: Motherboard

What is Privacy International calling for?

Industry is gaining insights into and intelligence on our lives that were previously possessed by powerful Intelligence Agencies, and tomorrow their potential may exceed them. In the future, industry giants will have more insight into the world than the most powerful intelligence agencies. What they know and represent about us will have significant effects on individuals, groups, and whole societies.

As a result of design choices in modern technologies, individual and collective behaviour is increasingly traceable. Metadata and logs, and other forms of observed data are generated of every interaction. The growing stores of data that companies and governments hold about individuals and groups is now automatically generated from human behaviour. This is at odds with how most users understand privacy as being about what they knowingly and overtly disclose to companies.

Powerful institutions with access to data now have unprecedented population-level knowledge about individuals, groups, communities, and whole nations and markets. With this knowledge they will have insight and intelligence on patterns of behaviour and other trends. They may identify customary behaviours and activities, as well as deviations. Even as these categories become divorced from the individual pieces of personal data, they provide powerful insights into how groups, societies and markets function. And they will likely be kept secret or understandable to the few. While monopolies are traditionally measured in terms of market power, this raises the question of how the data economy needs new ways to measure what qualifies as dominance in the marketplace.

Monitoring behaviour, generating profiles, creating dominance

Individuals must be able to selectively disclose their identity, generate new identities, pseudonyms, and/or remain anonymous. 

Principle 7. Identities under our control