Android sends public broadcasts with metadata useful for tracking
@uniqx discovered another area of tracking to map out: tracking which songs are being played on the device. There are multiple public broadcasts that include song metadata, and many apps receive them. BroadcastReceiver instances can be registered in the manifest, or dynamically registered at runtime. But the string names for them are static and global. There could be an arms race scenario where apps use all sorts of techniques to obfuscate those strings, since they are clear sources of tracking info.
Here's the list of broadcasts that come from Android itself: https://stackoverflow.com/questions/4031740/where-is-the-all-android-broadcast-intent-list
- generate list of BroadcastReceivers from AndroidManifest.xml from as many APKs as possible.