Signed in to Google play by accident, does this compromise privacy?

mareep

My dad is new to a grapheneOS and when he tried to download an app he accidentally signed into the sandboxed google play store on his phone. He fully signed out and didn't download anything. Did this compromise the privacy of the phone?

katemason

mareep

The hardware identifies were not passed on due to Google Play Sandbox, if that is what your question.

unwat

mareep

Depends on what you mean by "compromise the privacy."

Is it possible that Google can link that installation to him? Yes, if they stored the ANDROID_ID (see https://grapheneos.org/faq#non-hardware-identifiers). Is it probable? I don't think so since Google is used to having access to actual hardware IDs, which katemason has already assured you didn't happen... unless your dad also granted Google Play Services access to Phone or something more invasive (unlikely).

I'd personally say there's nothing to worry about since Google doesn't actually have any privileged access to the phone.

User2288

mareep
The instance of google play services installed on this profile is now associated with that account. Though not a lot of data will be passed to it regardless. Unless if you give it location access in the future.

If this is on a separate profile you can delete the profile and create a new one and reinstall GPS. This I think will create a new set of IDs.

Whether GPS would "hardware fingerprint" the device (CPU, GPU) accurately enough to be able to tell that its on the same device again is unknown. (and perhaps as @unwat argued, unlikely).

If its feasible, resetting this profile might make things a bit "cleaner".

[deleted]

unwat If I'm not wrong I've read that hardware IDs can't be accessed by normal apps (and Google Play Services is a normal app in GrapheneOS) even if Phone, SMS or other permission is granted.

unwat

[deleted]

Yeah. I meant phone number could be read with the phone permission. As the website says, READ_PRIVILEGED_PHONE_STATE, a privilege only system apps can have, is required to get any IDs that cannot be reset.

OpenSource-Ghost

Yes, Google does record and store unique hardware identifiers of devices signed into Google accounts via Google Play Services. I think it includes hardware MAC address, but I am not sure. The only sensible way to sign into Google account is by using a browser like Vanadium, Brave, Bromite, Firefox or Tor Browser.

It makes me feel really bad for people who purchase VPN subscriptions and sign into Google with Google Play Services over those VPN subscriptions. Sure, VPN hides some network information, but hardware ID's of your phone get sent to Google...