Report: Subway Surfers and other mobile games use sneaky ways to collect personal data in post-IDFA world

It looks like mobile game developers found a way to bypass Apple’s privacy rules and identify users even if they said no to tracking their data. They still collect information that might be used for digital fingerprinting.

Subway Surfers

Analyst Eric Seufert shared a link to an investigation by The Washington Post and privacy software maker Lockdown.

According to the report, at least three games — Subway Surfers, Streamer Life!, and Run Rich 3D — send ad network Chartboost specific information about a mobile device. The list includes a battery level, Internet address, free storage, display settings, time zone, currency, country, and last restart time.

It helps advertisers identify users that asked to not collect their data and show them targeted ads. The investigation revealed that saying no to tracking makes no difference, making Apple’s App Tracking Transparency framework almost useless.

“Worse, giving users the option to tap an ‘Ask App Not To Track’ button may even give users a false sense of privacy,” former iCloud engineer and Lockdown co-founder Johnny Lin said.

This data might also be used for digital fingerprinting, which uses technical information from a mobile device to create a profile of its user. However, Seufert pointed out that fingerprinting might be “very effective at finding some click to attribute — but not necessarily the correct click to attribute.”

Subway Surfers developer Sybo said that it only collects data that needs for the game to function properly. The company, on the other hand, didn’t specify why it sends so much personal information.

Apple’s new privacy policy came into force in April with the release of iOS 14.5. Users can now ask any app to not collect their personal data. It made a lot of devs and publishers worry about the future of mobile advertising and look for new ways to keep players engaged.