18,000 Android apps found violating ad tracking rules

File photo - A 3D printed Android logo is seen in front of a displayed cyber code in this illustration taken March 22, 2016. (REUTERS/Dado Ruvic/Illustration)

Getting online advertisers to stop tracking you over Android may not be as easy it seems. New research has found that over 18,000 Android apps can create permanent records on their users, even when they try to stop the tracking.

The apps in question should only be collecting a digital "advertising ID" from your phone as a way to serve up targeted ads. If you'd like to opt out, all you should need to do is go to the phone's settings and reset the advertising ID.

However, the International Computer Science Institute in Berkeley, California, has discovered that many popular apps are doing more than just capturing the advertising ID from Android phones. They're also collecting other identifiers, such as the device's serial number, the IMEI number, and other hardware or network indicators — none of which you can reset.

As a result, the apps can still identify your device, even if you decide to reset the advertising ID, said Serge Egelman, a researcher at the institute. "What little users can do is use the privacy controls, but as this research shows, those controls don't appear to do anything," he told PCMag.

The data collection also appears to violate Google's own developer policies, which forbids apps from collecting the advertising ID with device information. According to Egelman's findings, which were first reported by CNET, some of the most popular Android apps, with millions of installs, all engage in the practice. Much of the data is also being sent to various ad networks.

However, Google is pushing back on some of the research. The company told PCMag that collecting both the advertising ID and other device indicators can be done for legitimate purposes, like detecting fraud or account registrations, which is permitted under Google's policy.

Nevertheless, the tech giant said it's taking action against many of the apps identified in Egelman's research. "We take these issues very seriously. Combining Ad ID with device identifiers for the purpose of ads personalization is strictly forbidden," the company said in a statement. "We're constantly reviewing apps —including those listed in the researcher's report — and will take action when they do not comply with our policies."

Still, Egelman said the company should be doing more to stop the online tracking. "Google has made a choice to allow this," he said, noting that the iOS versions of the same apps don't have the same capabilities. "iOS has solved this problem by simply making the identifiers unavailable to developers."

The institute has created a service calls AppCensus, which can tell you what data a mobile app is collecting from your phone. Simply type in the app's name, and AppCensus will provide you a privacy analysis.

To reset an Android phone's advertising ID, go to Settings > Google > Ads to access the option.

This article originally appeared on PCMag.com.