A BuzzFeed News investigation has revealed that at least 20 VPN and ad-blocking apps from Sensor Tower’s platform have been secretly tracking user data. With more than 35 million downloads, these 20 Android and iOS have been feeding Sensor Tower with personal user data since 2015. These include the free and unlimited VPNs, VPN Luna, Mobile Data, and Adblock Focus.
Following this revelation, Apple removed Adblock Focus and Google Mobile from app stores . Both tech giants are continuing to investigate other apps for leaking user data. Interestingly, however, all of the apps were registered under different company names. However, Buzzfeed was able to link the apps to Sensor Tower after spotting code written by developers working for the company.
How, however, did Sensor Tower collect data of millions of users?
According to research, Sensor Tower's apps were asking users to install a root, which would allow them to gain access to internet and data passing through their mobile phone.
Granting root privileges to third-party apps can be risky, as developers can exploit it to their advantage. Apple doesn’t allow root certificate permissions in third-party apps. However, SensorTower’s apps got around this by installing certificates through Safari. For example, Luna VPN takes users to Safari and asks them to install a root certificate with an in-app notification about installing the Adblock Extention to block ads on YouTube.
Head of mobile analytics Randy Nelson disputed claims of covert and illegal user data collection, stating that Sensor Tower's apps do not track, request, or store any sensitive and personal user data, such as passwords, usernames, and more, from users or other apps on a user's device, including web browsers.
Furthermore, when Buzzfeed suggested removing apps from app stores, Nelson pointed out that the majority of the apps mentioned are not used, while few of them are widespread.
However, it was not the first time that mobile VPN apps have been called into question regarding user privacy protection, as last year a report revealed that out of 150 free VPN apps used as a sample, 90% violated users' privacy in various ways.
