Google is best known for its online search engine and the Android operating system used in smartphones. The foundation of its operating system is open-source, known as the Android Open Source Project, which makes it easy for phone manufacturers to customize. Thanks to this flexibility, Android captured a whopping 76% of the mobile operating system market in 2018. To access popular Android apps such as the Play Store and Youtube, devices must be Google-certified and come with Google Mobile Services (GMS). GMS includes essential apps like Google Play Services and Google Maps. Google Play Services, which is an API package, provides features like authentication, maps, location services, push notifications, and more.

However, an increasing number of privacy issues have arisen, and numerous studies (among this one https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pdf) have demonstrated that a substantial amount of users’ data is being sent to Google and the operating system developers (such as Samsung, Xiaomi, and their other partners) through these preinstalled system applications. Respecting users’ privacy is at the core of Murena’s concerns but 3rd party developers in the Android ecosystem also have a high responsibility. The various points described in this blog post are intended for developers who prioritize the privacy of end users.

Using Google alternatives

When developing an app with a focus on privacy, it is recommended to explore alternatives to the closed-source Google Play Services. Indeed, the study linked above has showed that the opaque Google Play Services upload large volume of data. Many open-source libraries are at your disposal to replace various components, such as MapLibre for mapping functionality and UnifiedPush for handling notifications. Reducing the dependencies on Google Play Services and looking for open sources alternatives strongly enhance the app’s privacy stance. However, it remains relevant to exercise caution with the chosen open-source software.

Open source and privacy

Open-source allows anyone to view, modify and distribute the code, providing a certain level of privacy and security, but does not automatically guarantee privacy. The privacy-friendliness of an Android application depends on various factors, including its backend solutions, data handling practices, and integrations with other services. Indeed, certain open source solutions may have backends or third-party Software Development Kits (SDKs) that collect user data. For instance, some application backends provide Android SDK that pulls dependencies to Google and Facebook analytics, which can track user behavior. So choosing the proper tools remains important. Obviously, searching for resources or libraries in the open source world must be prioritized but with some warnings.

Android permissions

While the following point may seem obvious, it remains essential to review thoroughly the permissions requested by an application under development. Developers should only request permissions that are necessary for the application’s core functionalities and eliminate unnecessary permissions that could access sensitive user data. Offering clear and concise description to users, explaining why your application requires certain permissions, is also a must. Lastly, requesting runtime permissions only when needed, handling permission denials gracefully and offering explanations on alternative ways to use the application can improve users trust.

AOSP based OS compatibility

With the growing reports of privacy issues, alternative ROMs have gained increasing popularity, and operating systems based on AOSP, such as /e/OS or CalyxOS, have emerged to prioritize user privacy. These operating systems do not come with the typical preinstalled system apps like Facebook or others, nor do they include Google Play Services. This lack of integration affects some third-party applications as they cannot leverage the practical features provided by Google Play Services. Other open source projects, such as microG, have also surfaced to enable third-party applications to still benefit from notifications and location services. Ensuring your application is compatible with all variants of the Android operating system is crucial for maintaining privacy standards in the ecosystem. It has also the benefit of reaching a broader user base (:

Conclusion

Overall, focusing on users’ privacy when developing an app is something that has been neglected up until now but since privacy has become a major issue in our current societies, developers have to adapt. Using in a cautious way the right open-source library, using permissions with the proper granularity and taking care of AOSP based OS compatibility are key points to guaranty a viable amount of privacy for the end user. Developers today no longer have excuses not to feel concerned about user privacy. The only valid excuse would be to be working for the devil (: