iPhone/iPod Touch/iPad applications using AdMob

[PepiMK]

Why applications using AdMob might be called Tracking Software or Spyware

As an introduction, please read our article on how we classify products for detection in Spybot.

Do AdMob enabled apps really collect PII (personally identifiable information)?

AdMob gives an overview over the data they collect:

AdMob also collects certain information about visitors to publishers' sites that connect to the AdMob Mobile Services. AdMob will automatically collect and receive information about those visitors such as, but not limited to, browser identifiers, session information, browser cookies, device type, carrier provider, IP addresses, unique device ID, carrier user ID, geo-location information, sites visited and clicks on advertisements we display. AdMob may track that information over time and over multiple publishers' sites and use non-personally identifiable information collected from such visitors to provide reports to advertisers and others and to help us display advertisements that may be of interest to your visitors. In some cases, the mobile phone service providers for mobile devices may send visitors' phone numbers to AdMob. AdMob uses such information to perform analysis aimed at improving our services and technologies and may also use this data to display advertising customized to visitors' interests and preferences.

Now lets take a look at Wikipedia on PII:

Personally Identifiable Information (PII), as used in information security, refers to information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual.

With some examples in detail:

The following are often used for the express purpose of distinguishing individual identity, and thus are clearly PII under the definition used by the U.S. Office of Management and Budget (described in detail below):

• Full name (if not common)
• National identification number
• IP address (in some cases)
• Vehicle registration plate number
• Driver's license number
• Face, fingerprints, or handwriting
• Credit card numbers
• Digital identity
• Birthday
• Birthplace
• Genetic information

The following are less often used to distinguish individual identity, because they are traits shared by many people. However, they are potentially PII, because they may be combined with other personal information to identify an individual.

• First or last name, if common
• Country, state, or city of residence
• Age, especially if non-specific
• Gender or race
• Name of the school they attend or workplace
• Grades, salary, or job position
• Criminal record

This shows that we have multiple pieces of PII collected here: IP address, the UDID (unique device ID), geo-location, and in some cases, even the users phone number.

Finally, if you take a look at the definition above, you'll notice that it does not even have to be PII to be called Tracking Software or Spyware - information about the user would might be - depending on each case - sufficient for such classification.