Buying a Pixel device directly from google with Gmail Account ?

johndoe55667788

Hello, I am curious if it is a bad idea to buy a pixel device directly from the Google Store.

I am asking because I recently bought a Pixel 6a directly from the google store with my verified gmail account.

**I am concerned that google may have recorded the imei number for my device? Is this a valid concern? Should I return the device and repurchase from a different online store?**

mythodical

johndoe55667788 I think it's likely that Google did associate the IMEI to your purchase identity (I had the same concerns), but my understanding is that the IMEI isn't typically available to apps, including even the sandboxed Play components.

From the FAQ:

Can apps access hardware identifiers?
As of Android 10, apps cannot obtain permission to access non-resettable hardware identifiers such as the serial number, MAC addresses, IMEIs/MEIDs, SIM card serial numbers and subscriber IDs. Only privileged apps included in the base system with READ_PRIVILEGED_PHONE_STATE whitelisted can access these hardware identifiers.

It's also worth keeping in mind that folks buy, sell and trade cell phones everyday. Just because you bought it today doesn't mean you'll be the one using it next month. I think that what you actually do with it once in-hand is more likely to compromise your privacy.

abcZ

johndoe55667788 Google knows ALL of the IMEI's for ALL pixel's, regardless of how you purchased it. No exception. After all, THEY'RE THE MANUFACTURER!!!

James9x19

Buy one from Best Buy with cash. I've done that with 4 different Pixels, no probems at all.

johndoe55667788

mythodical

Slightly off topic, I logged onto the gmail app with sandboxed google play.

I received an email that said I had a google pixel and gave me a BS offer for YT music or something.

My question is what information has been leaked to google? Is it just that I have a pixel 6a?

Im feeling a little worried because I went out of my way to purchase a pixel with cash (pixel aren't really available outside of amazon where I live)

roddyd

What is the harm in Google/Amazon/whoever knowing you bought a pixel phone? Anyone who sees you holding it in public will know.

ve3jlg

abcZ Google knows ALL of the IMEI's for ALL pixel's, regardless of how you purchased it. No exception. After all, THEY'RE THE MANUFACTURER!!!

This is true. Linking initially anonymous immutable data like an IMEI with personal identification and/or behavior is where privacy really goes downhill.

ve3jlg

Regardless of where you buy your phone, Google immediately collects a lot of immutable IDs from your phone, according to this study:
Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google
Douglas J. Leith, School of Computer Science & Statistics, Trinity College Dublin, Ireland
25th March, 2021 (Updated 10th June, 2021

The study was done with an earlier version of Android but I will not assume data collection has been reduced unless shown a comparable and more recent independent study.

This would happen when you start the phone for the first time and boot Google Android to fully unlock the phone, prior to GrapheneOS being installed.

When you buy from Google, additionally it will also be able to associate an address and billing/financial information even if you ship elsewhere.

The complete report (link above) is a dense and disturbing read. Here's an excerpt:

"Upon startup the first connection that the Android handset makes that sends data is to Google Analytics endpoint
app-measurement.com:[] The app instance id that is sent is linked to the device RDID (Resettable Device Identifier or so-called Ad ID, used formeasurement and ads9) in a later call to app-measurement. com. The next connection is made by the DroidGuard process (used for device attestation, part of Google's SafetyNet service), which send the device hardware serial number (which persists across a factory reset) to www.googleapis. com/androidantiabuse. The device RDID is now sent to www.gstatic.com and app-measurement.com. Early in the startup process a call is made to youtubei.googleapis.com/ deviceregistration that sends a raw DeviceId value and in due course a call to the android.clients.google.com/checkin endpoint is made.

This shares the handset Wifi MAC address, its hardware serial number and IMEI, effectively linking these three persistent device identifiers together. A subsequent call to android. clients.google.com/checkin further links these values to the Google AndroidId (a persistent device identifier that requires a factory reset to change) and a variety of security tokens10. The Droidguard device key is a large, opaque binary message: the contents are intentionally obfuscated by Google and it remains unclear whether it contains device/user identifiers11.
Cookies are sent in a number of calls, starting with one to fonts.gstatic.com and then to play.googleapis.com (this call
includes the AndroidId and so links that with the cookie). Despite deselecting the “Send usage and diagnostic data”option during the startup process, a substantial quantity (approximately 1.2MB) of telemetry/logging data is sent by the handset to play.googleapis.com/log/batch and play.googleapis.
com/play/log. The handset also sends 1.1MB of device data to www.googleapis.com/experimentsandconfigs and 181KB to android.clients.google.com/checkin. In total, around 3.6MB of data is sent to Google servers (via URL parameters, headers and POST data."