Massive Google Play Privacy Issue

http://phetdreams.tumblr.com/post/42959902001/massive-google-play-privacy-issue#notes

by petrel • 13 years ago

31 19 13 years ago

phetdreams.tumblr.com

jpatokal• 13 years ago

ZDnet interview with the guy who found the issue: http://www.zdnet.com/google-play-privacy-slip-up-sends-app-b...

proexploit• 13 years ago

It's not a "guy that found an issue". Nothing has every been hidden and it's not a privacy slipup. Come on.

1010011010• 13 years ago

Kinda like Paypal.

nilved• 13 years ago

Yes, exactly like that service everyone hates. ;)

DinosaurArms• 13 years ago

Coming from developing iOS apps first I thought it was strange that I received these user details when they purchased my Android app. I assumed it had already been brought up though and was decided to not be an issue.

Pkeod• 13 years ago

https://plus.google.com/106557483623231970995/posts/Bed6WUJp...

"With apple's app store you buy the apps from apple. With google play you buy the apps from the developer. If you are the merchant of record you need to know the address to correctly compute sales tax.

This is documented on http://support.google.com/googleplay/android-developer/bin/a....

Google cannot give tax advice, so we have to give you the data to make the determination yourself"

pdonis• 13 years ago

In other words, Google, the huge corporation, would rather that the app developer, who may not even be a corporation at all, be the merchant of record?

I guess I can kinda sorta see this from one point of view: they are trying not to be Apple. But they are still taking 30% of the money.

fpgeek• 13 years ago

And while they give you the burden of being the merchant of record, they also give you capabilities Apple doesn't (e.g. carrier billing, control of refunds, ability to reply to reviews, etc.). It's a different bundle, with different trade-offs.

AnthonyMouse• 13 years ago

>you need to know the address to correctly compute sales tax.

OK, so that explains why they provide the city you're in, which is the least objectionable of the information -- the developer can probably get that from GeoIP in any event.

But why do they provide your real name? Why do they provide your email address rather than an anonymized forwarder like Craigslist does? Walmart doesn't need to know any of that when I buy a toaster, neither should the app developer.

hysan2• 13 years ago

For the e-mail: Google Wallet / Google Checkout has a checkbox that lets you hide your email address (instead using some intermediary one from Google) at checkout. They also have one that let's you tell the merchant that you don't want to receive promotional emails from them (if that is an option with the normal purchase via other means). Both options have been there since Google Checkout came into existence (I've been using this service since it came out in 2006).

gmoore• 13 years ago

Doesn't sound all that unusual. Anyone selling anything via a credit card is going to get the same info....perhaps even more...

tzs• 13 years ago

The difference is that if you go to, say, Best Buy, and buy a Samsung TV, a Sony Blu Ray player, and a game for your Wii, your personal information doesn't go to Samsung, Sony, and the Wii game maker. The store, Best Buy, gets your info, not the makers of the products sold in the store.

This is what people generally expect from stores that sell a variety of items from many different manufacturers.

DannyBee• 13 years ago

What makes you think the first sentence is true? I would in fact, assume the exact opposite. I've bought plenty of things where the warranty was automatically registered by buying it at best buy, and samsung/sony/whoever sent me a postcard, to my name and address, letting me know that.

It's very clear my personal information was shared.

unsignedint• 13 years ago

The thing about Google Checkout is that it's more of a "credit card processor" than the merchant. They consider the developer as a merchant (maybe because Google might have first designed Google Checkout to be payment processor, like Paypal) which basically makes transfer of goods between a customer vs. developer, as opposed to customer vs. Play store.

Aside the argument if it's good or bad, it seems to be consistent with that notion -- if Google is considering Google Play to be more of a promotion service with payment processing built-in, as opposed to curated content store.

collegelabs• 13 years ago

Its interesting to note that the email address wasn't always included, they used to be [random]@checkout.google.com before they made the switch to Google Wallet

tdtran• 13 years ago

If you buy something from me, even via Google, you enter a mutual contract. And as such you have to provide sufficient information to identify yourself. Same with me. Pretty normal for any law protected contracts.

Massive Google Play Privacy Issue

Related Stories