Teardowns of Android builds as shipped on Google Play.
Google Play's Age Signals API gives an Android app the user's age range and how it was established, never the birthdate. It returns signals in Brazil and Texas; Google announced a global expansion on July 29, 2026. The call, the four tiers, spoofing, SDK access, and what a scan and a capture show.
On September 30, 2026, Android developer verification began in Brazil, Indonesia, Singapore and Thailand. Apps installed from seven participating stores on certified devices must be registered to a developer whose identity Google has verified. Google plans a global rollout in 2027.
On September 21, 2026 Ireland's Data Protection Commission fined Google Ireland €403 million under GDPR Articles 5, 6, 12 and 13 over location data in Web & App Activity, Location History and Location Accuracy from May 25, 2018 to February 4, 2020, and ordered compliance within six months.
On August 4, 2026, EFF named four Android ad SDKs that share location by default once an app has location permission. EFF's published capture shows precise coordinates sent to api.bidmachine.io from QR Scanner and GPS Speedometer; on Oct. 2, neither app's Play Data safety section listed location.
I monitored device setup flow, scanning the room, the map, AI features, voice commands on both the vacuum cleaner and on the iOS app. The product respects user privacy better than most but it could have been better. Default dangerous features are off with a consent screen for each.
I decompiled the Google Play “Trump Accounts” app, listed under U.S. Department of the Treasury. It's a Robinhood wrapper compiled as an internal “Golden Eagle” flavor.
I decompiled the Temu app on both platforms. On Android it erases all ten of its own native libraries from the file security scanners read, rewrites its own Java methods under a server flag, and seals its telemetry with a home-grown cipher that has no extractable key.
On July 22, 2026, Korea's PIPC fined Tiktok Pte. Ltd. KRW 10,306,000,000 with corrective and publication orders, finding that TikTok collected third-party behavioral data through TikTok Pixel, the Events SDK and the Events API from 9.45 million Korean users without a lawful basis.
On July 15, 2026, Meta moved to dismiss the amended complaint in In re Meta Android Privacy Litigation, No. 3:25-cv-04674-RFL, the class action over the Pixel sending the _fbp cookie to localhost ports opened by the Facebook and Instagram Android apps. Google answered the same day.
On June 25, 2026, a federal court entered the Kochava FTC settlement. Kochava and its subsidiary CDS may sell or disclose sensitive location data only with a direct relationship with the consumer, affirmative express consent, and a service the consumer requested. The order contains no money payment.
On April 9, 2026, Microsoft detailed an intent redirection flaw in the EngageLab Android SDK: the exported MTCommonActivity let another app on the same phone obtain read and write access to the host app's private files. Wallet apps with the SDK had over 30 million installs. Version 5.2.1 fixes it.