As we reported in a recent article, a security researcher discovered that popular smartphone manufacturer Xiaomi is tracking a large amount of its users' data, which includes both device usage habits and queries in the company's default browsers.
Security researcher Cirling said he discovered that Xiaomi is recording all search requests and everything viewed in its device's default browser (Mi Browser Pro), as well as the Mint browser, and it appears that this tactic is also applied to Incognito Mode.
Other Xiaomi devices have been confirmed to have the same issue, including the Mi 10, Redmi K20, and Mi MIX 3.
The company responded that the data it collects is anonymous and is used only for internal evaluations, while users are aware and have given their consent to it. At the same time, it denied the researcher's claims that it also monitors data in Incognito mode.
Of course, the researcher managed to prove his words in a video, where he is shown visiting a pornographic site via Incognito mode and his data is sent to servers.
On this, Xiaomi stated that "collecting anonymous browsing data is one of the most common solutions adopted by internet companies.".
Is it true that the data collected is anonymous?
As Cirling said, if the browsing data the company collects is combined with other "metadata" on the phone, it can identify individual users.
But in addition to browsing data, the researcher noticed that applications , as well as every time he touched his mobile screen.
After doing some digging, Cirling was able to connect the app's data tracking to the SensorDataAPI, which allows third parties to access app data. In Xiaomi's case, the third party was Sensors Analytics, a company known for tracking users.
While Xiaomi confirmed the researcher's findings, it claimed that the data collected by Sensors Analytics remains anonymous and is stored on Xiaomi's own servers.
The company updated post with another announcement, stating that the update to Mi Browser (v12.1.4) and Mint Browser (v3.4.3) includes a toggle to disable aggregated usage data collection in Incognito mode.
