XPost: comp.mobile.android, misc.phone.mobile.iphone   
   From: marion@facts.com   
      
   On Thu, 4 Sep 2025 21:15:21 -0700, AJL wrote :   
      
      
   >> Yes, but, it's a little like saying Apple can break the law by   
   >> brazenly lying about their batteries because Apple can afford to be   
   >> above the law.   
   >   
   > You misunderstand my meaning. I meant that if they really wanted to get   
   > Google's attention the fine should be substantially larger. $425m is   
   > chump change to a company the size of Google.   
      
   Oh. I see. Yes. I agree. I apologize. I thought you were minimizing the   
   law, which is something I see a lot happening on Apple newsgroups.   
      
   It seems Google plans on fighting this verdict, where Google's point   
   appears to be that they got our data from Lyft, so it's not Google's fault.   
      
   >> It irks me whenever someone says Apple and Google don't ever have to   
   >> follow the law just because they can easily afford to pay the legal   
   >> penalties.   
   >   
   > Exactly. Make the fine something that actually hurts the company's   
   > bottom line and things just may change. But not so big that they start   
   > charging me for their services...  8-O   
      
   Thanks for explaining your point, where, given I don't have a Google   
   Account on my phone, I'm trying to figure out how this whole thing works.   
      
   I'm running through the scenario on the net what happens whey we use Lyft.   
      
   Apparently, even if we disabled tracking in our Google account (like   
   turning off Web & App Activity), our data could still flow to Google   
   through Lyft's use of embedded Google services, and apparently specifically   
   the Firebase SDK.   
      
   As far as I can piece it together, assuming I'm on my iPhone, the iOS Lyft   
   app uses the Firebase SDK that Lyft integrated using Google's Firebase SDK.   
      
   Apparently Firebase is an iOS/Android SDK toolkit that helps developers   
   with analytics, crash reporting, performance monitoring "and more".   
      
   It seems that Firebase collects what Google calls "automatically collected   
   events" which apparently include "Page location" (which screen we're on),   
   "Page referrer" (how we got there), "Page title", "Device info", "app usage   
   patterns" & possibly "ride-related metadata", whatever data that may be.   
      
   Note that this data collection is independent of our Google Account   
   Settings as this data collection happens outside of our Google account.   
      
   So even if we turned off tracking in our account settings, iOS/Android   
   Firebase still collected and sent our private data to Google's servers.   
      
   With respect to the case that Google just lost, apparently the court found   
   that Google didn't clearly inform users that disabling tracking wouldn't   
   stop data collection via third-party apps like Lyft. This was deemed   
   deceptive and a violation of users' reasonable expectations of privacy.   
      
   Keeping in mind badgolferman's question, when I look at the difference   
   between Android & iOS, it appears that iOS has stronger privacy controls,   
   but iOS doesn't block the Firebase SDK from operating inside the Lyft app   
   unless the Lyft app itself restricts it. It seems that Apple's App Tracking   
   Transparency (ATT) doesn't cover server-side SDKs like Firebase unless the   
   Lyft app explicitly opts out.   
      
   Does it?   
   I don't know.   
      
   Bottom line?   
      
   Even on iOS, if we took a Lyft ride, our app-usage data (such as which   
   screens we visited, how long we stayed and possibly contextual info about   
   our ride) could easily have been sent to Google via that Firebase API.   
      
   The issue the court determined was that this privacy loss happened   
   regardless of our Google account settings & without clear user consent.   
      
   On both platforms.   
      
   This is already too long, but I started researching the pros and cons of   
   this scenario between iOS and Android and it appears to be rather complex.   
      
   On both platforms, Firebase in the Lyft app can still send analytics and   
   usage data to Google even if Google account tracking is turned off. iOS may   
   give more up-front warnings and require disclosure, but neither OS blocks   
   this by default.   
      
   Let me dig deeper into figuring out the differences for badgolferman.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)