Should You Share Your Data With Tech Companies?

Daniel Kahn Gillmor, senior staff technologist for the American Civil Liberties Union’s Project on Speech, Privacy, and Technology who himself helps develop free software, says data about how you use a program and problems you encounter are invaluable to computer engineers. “A detailed bug report is incredibly useful to a software developer,” he says. “What you’re seeing in the report is examples of what a user actually did in the real world, and how the software didn’t meet their needs.

“Some of these reports will give full memory dumps, in which case there could well be sensitive user data present there. Some of it will just be the program crashed at this particular point.”

User data can also prompt software engineers to eliminate or change certain features of their programs.

“If there’s a feature, and you spend a thousand engineering hours on that feature, and you find later that it’s been used by less than 1 percent of your user base, and half of them had bugs in it, you might want to just rip the feature out,” Kahn Gillmor says. “But if you spend a thousand user engineering hours on a feature, and you find 100 percent of your user base is using it, and only 2 percent of them have had a bug report, well, now you know where to focus your energy on fixing those bugs, because everybody wants to use this feature.”

Steve Shillingford has also long seen the utility of user data as a former employee at software company Oracle, as founder of privacy company Anonyome Labs, and now as CEO of DeepSee, which uses machine learning to help companies automate business practices. “There’s a lot of value to developers of software to get a lot of that crash data,” he says. “Most of that crash data is generally anonymous, and really related to performance of the application network.”

Experts differ in their assessment of how much a typical consumer should worry about sharing of usage and crash data from their devices.

“I actually think that most of the time, that’s fine,” says Lorrie Faith Cranor, a professor at Carnegie Mellon University and former chief technologist at the Federal Trade Commission. “Especially if it’s a legitimate company, that is in fact what they’re going to do with the data. But that said, there is a small risk, because the crash report may include sensitive data that’s on your computer.”

Daniel Kahn Gillmor of the ACLU worries that email details could end up in crash reports. “If I use an email program, and something goes wrong with it, maybe the contents of my email are sent back to the software developer in that bug report,” he says. “If the contents of my email are sensitive, it seems pretty problematic for that software developer to have that information.”

Aleecia McDonald, PhD, associate director of the privacy engineering program at Carnegie Mellon’s School of Computer Science, has similar concerns about the potential exposure of personal data. 

“If you want to [share], great, you’ll slightly contribute to a better and more debugged world. That’s a nice thing,” she says. “And as long as you’re not doing anything at all ever on your device that you don’t want to be public? Sure.”

Shillingford of DeepSee differentiates companies such as Facebook and Google, whose business models rely on harvesting user information to target advertising, and other software developers. “On the whole, folks—Apple, for instance—they’re really trying to improve the software product, in my view, and as a result, I feel less concerned about that.” he says. “Like everything in life, reputation matters.”

Kshirsagar at Princeton agrees about the importance of reputation, which makes him cautious about sharing usage data for many apps. “If it’s sort of a dodgy company that you know very little about that’s asking for a lot of intrusive information about you, you might be suspicious, and might be justified in that suspicion,” he says. “From a consumer perspective, a large part depends on whether you trust the company with which you’re interacting.”

Here’s what some leading companies say about their product improvement programs.

By default, Microsoft monitors what it calls “required” data on how you use its Windows operating system as well as its Office programs including Word, Excel, and Outlook. For Office, such required data sent back to Microsoft includes details about your laptop battery, camera, processor, network speed, hard drives, devices, crash data and errors, and lots more, which it details here. Microsoft-owned Skype also collects this data.

“You expect Office to be secure and work properly. To meet this expectation, we collect diagnostic data as you use Office and OneDrive which helps us find and fix problems, identify and mitigate threats, and improve your experience,” the company explains on its website. “This data does not include your name or email address, the content of your files, or information about apps unrelated to Office or OneDrive.”

Such user data helps Microsoft developers troubleshoot issues such as malfunctioning video drivers and tells software designers which features people use most, Microsoft says on its website. Monitoring also allows software programs to update automatically. Office does not allow users to turn off the transmission of this required data. 

Microsoft also invites Office users to share even more of what it calls “optional diagnostic data,” to give the company insights such as which shapes customers insert into Word documents or how fast PowerPoint slides appear on the screen.

Microsoft’s Windows operating system also shares user information by default, but customers who dig into the settings can turn off the Customer Experience Improvement Program. 

“The operating system itself sends tremendous amounts of metrics back to Microsoft by default. And you have to dig around to figure out how to turn that off,” says the ACLU’s Kahn Gillmor. “The amount of information that’s been collected from these feedback systems is increasingly the concern for me as a privacy advocate, from a surveillance perspective.”

If you would like to see exactly what your devices are sending to Microsoft, you can download the company’s Diagnostic Data Viewer.

The collection of information from your device could also give Microsoft insights valuable for targeting advertising. If you turn on Microsoft’s “tailored experiences” to enable personalized tips and recommendations, it also uses that information for advertising, the company says on its website.

“If you choose to turn on Tailored experiences, we will use your Windows diagnostic data to offer you personalized tips, ads, and recommendations to enhance Microsoft experiences,” the company writes.

Yet such use blurs the line of taking user information purely to improve the product with seeking to make extra money off a customer. “This is simultaneously not surprising, and counter to what people expect,” says CR privacy researcher Bill Fitzgerald.

“Data collected for analytics is often described as somehow separate or different than data collected for ads or tracking,” he says. “This claim has never passed the smell test. Analytics data is sensitive—it can be used to track people in its own right, and when it’s combined with other preexisting datasets, it can increase the accuracy and precision of tracking by companies.”

When you set up a Google Android phone, the program offers a choice on sharing your user data. Such information includes how often you use your apps, network connection data, and details about your WiFi and other connections. Some of the data is also shared with Android developers. You can turn off the sharing under Settings > Google > More > Usage & diagnostics.

However, a 2021 paper found that both Android and Apple iOS phones still send a surprising amount of data even when users opt out of sharing, with Google sending around 20 times more data than Apple. On average, Apple and Android phones sent data every 4.5 minutes when idle. “Our data shows that the ‘essential’ data collection is extensive, and likely at odds with reasonable user expectations,” writes report author Douglas Leith, PhD, a professor and chair of computer systems at Trinity College Dublin in Ireland.

In response to the study, Google spokesman Scott Westover said, “This research largely outlines how smartphones work. Modern cars regularly send basic data about vehicle components, their safety status and service schedules to car manufacturers, and mobile phones work in very similar ways. This report details those communications, which help ensure that iOS or Android software is up to date, services are working as intended, and that the phone is secure and running efficiently.”

Google’s Chrome browser collects usage statistics and crash data by default. To turn off this feature, go to Settings > You and Google > Sync and Google Services, then turn off the tab “Help improve Chrome’s features and performance.” While you’re there, you might want to make sure “Make searches and browsing better” is turned off as well, if you want to limit data collection.

“Our Privacy Policy helps our users understand what information we collect, why we collect it, and how they can update, manage, export and delete information,” says Google spokesman Matt Bryant.

Several voice assistants, including Amazon’s Alexa, Apple’s Siri, and Google Assistant, can send back recordings of your voice, as part of their product improvement programs. Apple and Google’s products require users to opt in to voice review during setup; Amazon’s Alexa has the process enabled by default.

Details of these voice-monitoring programs caused some controversy for all three companies back in 2019, when a series of reports exposed how human agents listened to some snippets of consumer recordings. Apple and Google have since made their programs opt-in, while Amazon still has the program on by default. 

“What they didn’t tell consumers was that periodically to assess if the AI was translating your words correctly, they would have humans listening in to those conversations,” says Kshirsagar of Princeton University’s Center for Information Technology Policy. “Do you trust their employees there? Do you trust their subcontractors who might be responsible for looking at this? There’s a whole range of issues that come up.”

Amazon says such monitoring improves the device’s accuracy in interpreting what people say, allowing it to distinguish between similar sounding words such as Austin and Boston.

“Training Alexa with a diversity of voice recordings helps Alexa better understand customer requests and provide more accurate and personalized responses,” says spokeswoman Lauren Raemhild. “To help improve Alexa, we manually review and annotate a small fraction of 1 percent of Alexa requests. Access to human review tools is highly controlled and only granted to a limited number of employees who require them to improve the service.”

She added that these annotations don’t include information that could identify users, and customers can opt out of human review of their voice recordings, a process Amazon describes on this page. The options include saying: “Alexa, turn off human review of my voice recordings.” CR’s "How to Set Up a Smart Speaker for Privacy" details the privacy options for Alexa, Apple’s Siri, and Google Assistant.

A graphics program such as Photoshop may analyze your photos to judge how well its features work. Adobe, the maker of Photoshop and graphics and video software, by default uses machine learning on images processed in its cloud. “Adobe’s automated systems analyze aggregated user images (e.g., image segmentation, contrast analysis, etc.) to improve Adobe’s products, but we do not collect data about specific users,” says Andrew Savage, who leads the legal team for Adobe’s digital media business. 

The company explains how its machine learning works here. Users can opt out by signing on to their Adobe account, finding the “machine learning” section and disabling “Allow my content to be analyzed by Adobe using machine learning techniques.”

Photoshop users can also opt in to a program allowing Adobe researchers to review low resolution copies of users’ photos. Adobe says such information helps them fine-tune features such as automatically selecting the main subject of a photo or filling in an area of a photo you want to replace.

“Once a user has opted in, Adobe researchers may review the user’s Photoshop images that are uploaded to Adobe servers,” Savage says. “Please note that Adobe does not have access to images on a user’s computer.”

Adobe also automatically uploads more general information about your device and its interactions with Adobe programs and services. Users can opt out of such data gathering.

Apple, which has marketed itself as a more privacy-friendly company in recent years, offers an opt-in model to share analytics information, although it takes some effort across different company web pages to understand your options. 

The choices are apparently confusing not only to users. When I called Apple tech support to ask whether the company automatically collected user analytics data from the iOS operating system, iCloud, and iPhone without user consent, the agent initially seemed confused but then said yes. But Apple web pages appear to suggest usage information is shared only after you opt in when setting up your devices.

“Help Apple improve its products by allowing analytics of usage data from your iPhone,” the phone asks as you set up the device (the “Share with Apple” button is also highlighted). “You can change your decision later in Settings.”

To check your iPhone settings go to Settings > Privacy > Analytics & Improvements. “iPhone Analytics may include details about hardware and operating system specifications, performance statistics, and data about how you use your devices and applications,” the company says on its website, adding that location data may also be sent if “Location Services” is also on. Apple also separately asks if users wish to share health records and iCloud analytics with Apple, as well as crash and usage data with third-party app developers.

For its iOS operating system, Apple writes: “Apple asks customers to help improve the iOS by occasionally providing analytics, diagnostic, and usage information. Apple collects this information anonymously,” it says. Such information helps it come up with better predictive suggestions while you are typing, or emoji suggestions. 

On MacOS devices, you can adjust your sharing settings in System Preferences under Security & Privacy > Privacy > Analytics & Improvements.

For Apple’s iCloud online storage service, which works across devices, the company writes: “If you give your explicit consent to share iCloud Analytics, Apple can improve Siri and other intelligent features by analyzing how you use iCloud data from your account, such as text snippets from email messages.”

CR reached out to Apple for comment on their device analytics data collection and sharing, and an Apple spokesperson responded: “When users set up an Apple device, they are asked whether they would like to share app analytics with developers and partners to help improve their apps. If a user opts in to sharing this data, the device will only provide analytics information and statistics in aggregate, or in a form that does not personally identify the user.”

Trinity College Dublin Professor Leith’s paper found, however, that Apple shares some data even from users who have not opted in. 

“A number of the pre-installed apps/services are also observed to make network connections, despite never having been opened or used. In particular, on iOS these include Siri, Safari, and iCloud,” Leith writes, adding that Google programs also act similarly. “The high frequency of network connections made by both iOS and Google Android (on average every 4.5 minutes) therefore potentially allow tracking by Apple and Google of device location over time.”

In response to the findings in Leith’s report, the Apple spokesperson told CR “Apple devices may send data to Apple servers for reasons that are necessary for the device to function such as registering a new phone on the carrier’s network. Even in these cases Apple devices and software minimize the data shared with Apple, and where possible, do not associate data sent with an Apple ID or any other form of identity.”

Many companies share anonymized usage data with outside partners as well. Mozilla’s Firefox browser’s privacy policy describes how it shares data under a subheading titled “improve performance and stability for users everywhere.” It says: “Firefox sends data about your interactions with Firefox to us (such as number of open tabs and windows; number of web pages visited; number and type of installed Firefox Add-ons; and session length) and Firefox features offered by Mozilla or our partners (such as interaction with Firefox search features and search partner referrals).” This data collection is turned on by default.

An untrained eye might not appreciate how much sharing such a policy allows, but after reading it, Carnegie Mellon’s McDonald, who previously served as a senior privacy researcher at Mozilla, expressed concern about sharing anonymized internet search data with “search partners.” 

“Just having search terms from a given person can very quickly become personally identifiable information,” she says. “Pretty privacy-invasive.”

Firefox users can turn off the sharing of performance data by going to Settings > Privacy & Security > Firefox Data Collection and Use, and then unclick “Allow Firefox to send technical and interaction data to Mozilla.” While there, you can also turn off “Allow Firefox to install and run studies.”

Firefox’s crash reports—which you can choose to share whenever the software crashes—also contain what the company describes as sensitive data that could identify you. “We strictly limit access to those crash dumps to a small number of employees who are charged with investigating crashes and data collected are unconditionally deleted after six months,” says Vicky Chin, Mozilla’s senior director of desktop engineering.