DuckDuckGo’s anti-tracking Android tool could be “even more powerful” than iOS

App Tracking Protection blocks outbound traffic to listed tracking firms.

Privacy-focused search site DuckDuckGo has added yet another way to prevent more of your data from going to advertisers, opening its App Tracking Protection for Android to beta testers.

DuckDuckGo is positioning App Tracking Protection as something like Apple's App Tracking Transparency for iOS devices, but "even more powerful." Enabling the service in the DuckDuckGo app for Android (under the "More from DuckDuckGo" section) installs a local VPN service on your phone, which can then start automatically blocking trackers on DDG's public blocklist. DuckDuckGo says this happens "without sending app data to DuckDuckGo or other remote servers."

Google recently gave Android users some native tools to prevent wanton tracking, including app-by-app location-tracking approval and a limited native ad-tracking opt-out. Apple's App Tracking Transparency asks if users want to block apps from accessing the Identifier for Advertisers (IDFA), but apps can still use the largest tracking networks across many apps to better profile app users.

Allison Goodman, senior communications manager for DuckDuckGo, told Ars Technica that App Tracking Protection needs Android's VPN permission so it can monitor network traffic. When it recognizes a tracker from its blocklist, it "looks at the destination domain for any outbound request and blocks them if they are in our blocklist and the requesting app is not owned by the same company that owns the domain."

Goodman added that "much of the data collected by trackers is not controlled by [Android] permissions," making App Tracking Protection a complementary offering.

App Tracking Protection launched a year ago in a limited beta. Since then, DuckDuckGo has updated the app to show you more information about what kinds of data trackers are trying to collect—"like your precise location, age, and a digital fingerprint of your phone." Through its testing, DuckDuckGo has seen that an Android phone with 35 apps can see 1,000–2,000 tracking attempts every day, sending data to more than 70 companies.

WIRED's Matt Burgess tested the app when it launched, installing 36 apps on a new Pixel 6 Pro and logging in to roughly half of them:

These included the McDonald’s app, LinkedIn, Facebook, Amazon, and BBC Sounds. … I left the phone alone for four days and didn’t use it at all. In 96 hours, 23 of these apps had made more than 630 tracking attempts in the background.

When I opened the McDonald’s app, trackers from Adobe, cloud software firm New Relic, Google, emotion-tracking firm Apptentive, and mobile analytics company Kochava tried to collect data about me. Opening the eBay and Uber apps—but not logging into them—was enough to trigger Google trackers.

DuckDuckGo notes that some apps are still excluded from tracking protection because they require tracking to work properly, particularly browsers and apps that have in-app browsers. When I had DuckDuckGo's protection installed on an Android phone early last year, I had trouble renting scooters and e-bikes from Lime and accessing my apartment building's door-unlocking service. Then again, that is likely the kind of feedback DuckDuckGo is seeking in this beta.

Source