How much is Google collecting and keeping on Android if not signed in?

If you install TrackerControl, no root needed (it pretends to be a VPN to capture your traffic, but is not a real VPN), you will see which apps try to talk to tracking services and thus also which ones talk to Google.

It also as a 'traffic log' feature which, when turned on, shows live which app is talking to which tracker.

Note that, especially if you turn on blocking services marked as essential in the setup, you will need to unblock a lot of CDNs and tracking services for many apps to work including Spotify, your browser, etc. Of course you can also just whitelist apps completely, or temporarily turn all blocking off altogether. But by default it will block trackers, since that's kind of its point. This has the side effect of blocking virtually all advertisements.

Disclaimer: I work at Google. In cloud, not on Android.

I am privacy conscious so I though I would give a try at Graphene OS, it was brutal. It was overall stable and the stock android R was refreshing. The app selection available through F-droid was very limiting and the quality of apps was a struggle compared to those in the app store.

I wish there was some incentive for the better apps to open source and publish on F-droid. I donate to many apps on Patreon, should I just message to the devs and ask them to go open source and publish on f-droid?

Google has a track record of pushing out Google-y spyware through software update channels. Whatever assumptions you're making based off Android's *current* behaviors, it's not safe to assume they'll hold.

https://news.ycombinator.com/item?id=18064537 ("Chrome 69 will keep Google Cookies when you tell it to delete all cookies")

https://news.ycombinator.com/item?id=24817304 ("Chrome exempts Google sites from user site data settings")

https://news.ycombinator.com/item?id=20044430 ("Google to restrict modern ad blocking Chrome extensions to enterprise users")

https://news.ycombinator.com/item?id=17942252 ("Tell HN: Using Gmail? You will be force logged into Chrome")

Depends on the ROM. AOSP barely has any Google on it compared to "stock" Android; it uses Google services for system resources like DNS, time synchronization, cert stores updates, etc. This is configurable. Of course, it uses Google servers for updates.

I believe that webviews and such use Google Safe Browsing.

AOSP doesn't have Google Play Services at all. There's a trivial amount to "de-google".

I'd recommend looking into GrapheneOS too once it gets 5a support.

"Privacy perspective" is way too ambiguous. Can you describe what specific things you want to protect from ?

I don’t if it’s still the case , but in stock ROM Androids it would track your location history even with location services turned off.

https://www.wired.com/story/google-location-tracking-turn-of...

With a stock, store bought android rom with google play services and such?

It might help anonymize your device.

If you sign into a network regularly that you use with devices you sign into google with, or a network google associates you.with, they might correlate you with the device.

If you follow your normal routine of locations, browsing or other behaviour google is aware of, google may associate the device with what it knows about you.

It's kind of hard to say though, Google's data collection is somewhat opaque in regards to things it collects to associate you to other things.

I have noticed a few occasions where google has given me suggestions or ads based on searches i've made or on devices that I'm not signed into or associated me with data available only from such devices, other times not.

This is just anecdotal though so make of it what you will.

I bought a moto g30 for this reason that it is stock android. Do not have a google account so haven't signed in. I do believe by disabling a lot of google crap, using newpipe any data google does take from my phone is stuck behind a "user #37484774" or something. My name is not tied to any online account so who cares.

Oh, BTW I use pihole at home so tracking is minimized even more

Isn't 5a the same hardware as 4a 5G for the most part? CalyxOS, RattlesnakeOS, and GrapheneOS should have support for it soon.

Edit: Here you go https://gitlab.com/CalyxOS/calyxos/-/issues/642

You may want to read this article, I am sure there are other academic sources about what is transmitted.

https://www.scss.tcd.ie/Doug.Leith/pubs/contact_tracing_app_...

You can completely remove Google packages with ADB. There are tools for that.

I would be more concerned about vendor packages. For example stock weather widget uses GPS and pinks servers, even when not in use...

I have a stock android phone but use wireguard and a pihole for DNS. It blocks something like 70% of all request but my phone works without issues.