There's no escaping Android phone tracking. Even if you disable what you can, built-in apps are still sending data to the phone and the companies that make them, a new study shows.

The study by Haoyu Liu and Paul Patras of the University of Edinburgh and Douglas J. Leith of Trinity College, Dublin, used Samsung, Xiaomi, Huawei, and Realme phones and their respective Android skins, as well as the open source devices running the Android operating systems LineageOS and /e/ were studied.

"We believe we have missed massive and ongoing data collection by cell phones. 'We've concentrated too much on web cookies and ill-mannered apps.'

Researchers intercepted data from cell phones during normal use to find out exactly what was being transmitted. Assuming "privacy-sensitive but busy and technologically illiterate users," the researchers disabled tracking when the phones prompted them to do so, but otherwise left it at its default setting.

Surprisingly, built-in apps on Samsung, Xiaomi, Huawei, and Realme phones sent large amounts of data to third parties, including Google, in addition to OS developers.

Others, including Facebook, Microsoft (in the form of SwiftKey keyboards and OneDrive cloud storage), and LinkedIn, sent data via "system apps" pre-installed on the device.

These built-in apps cannot be deleted because they reside on read-only memory (ROM) and can grant permissions that regular apps cannot access. Many of these are basic Google apps, but some, as mentioned above, are provided by the handset manufacturer or through third-party agreements with other companies.

As for alternative operating systems, LineageOS did not collect data for itself, but did send information to Google through system apps. /e/ sent only very limited data back to the developer, indicating that it is quite possible to run Android without extensive data collection.

However, /e/ is a heavily reworked version of Android specifically designed not to track users, and offers a very different experience from stock Android, without many of the apps that regular users are accustomed to.

If you want to know exactly what was sent from each OS, the researchers have compiled the following table. In most cases, the data is extensive and includes information about the device, which apps are being used and for how long.

The study concludes that "the observed data transmissions far exceed [the expected rate of communication with the OS server], raising a number of privacy concerns." (The "pure" Google build of Android was not studied, but is provided for reference.)

Google appears to support the decision to collect such dates; a statement from a company spokesperson, written in response to BleepingComputer, reads:

"While we appreciate the work of the researchers, this behavior is unexpected.

The statement goes on to say that Google Play Services data is "essential for core device services such as push notifications and software updates across a diverse ecosystem of devices and software builds," and that other data, such as IMEI numbers, are " necessary "to ensure delivery of critical updates across Android devices and apps"

Unfortunately, users can't really do anything about this if they care about it. As mentioned above, there is no way to opt out of getting data from system apps. Any identities that can be reset can be easily reconfirmed by cross-referencing them with non-resettable identities, such as the phone's IMEI number.

Installing a custom OS like /e/ is an option, but it requires more effort than the average person is willing to put into making it work. You could switch to an iPhone, but while Apple stresses how important user privacy is, it is still impossible to escape all tracking with iOS.

Indeed, another study conducted by Leith this spring found that the core Android and iOS operating systems themselves transmit roughly the same amount of user data (regardless of system apps).

Meanwhile, a new Oxford University study released last week found that iPhone apps are just as snoopy as Android apps, with 60% of iOS apps sharing data with Google.