> That it's on your own app where you anyway know exactly which backend endpoint has been called by the user does.

If it only exposed information the user was already sending, the vendor wouldn't bother with the spyware.

> What private information do you think is sent to the vendor that would not be otherwise?

Depends on the app; I expect, for instance, market apps (Amazon, Walmart, etc.) to watch the user's every move to try and better model the user's mental state in an effort to get them to buy stuff that they wouldn't have done otherwise.

No one is modeling your state of mind because it doesn’t work. We do look at click stream data and try to push down the number clicks/swipes/etc to purchase. Everything is done on a cohort basis, there is no value at an individual scale.

> Depends on the app; I expect, for instance, market apps (Amazon, Walmart, etc.) to watch the user's every move to try and better model the user's mental state in an effort to get them to buy stuff that they wouldn't have done otherwise.

Not being funny but I think you’re vastly overestimating the capabilities of most engineering teams.

> in an effort to

Just because they may be bad at something doesn't mean they don't attempt it.

This attitude is why I hardly have any native apps on my phone and use a browser with ublock origin for it.

You can see how valuable this tracking is by the amount of websites begging you to install their native apps. No thanks!

Websites can still track everywhere you're tapping though. Wasn't that the original scare?

Yeah I know they do, but websites can collect much less data than native apps.

I just try to minimize it.

What data can apps collect without you giving them permission that websites can’t?

A unique identifier which is 100% stable over multiple sessions for once. Which makes the rest of the data so much more useful.

There are plenty of ways to uniquely enough identify a user on the web.

Why is that possible in native apps but not websites?

In the end, this is because the browser works for you, and the app works for the company.

You mean the browser developed by a adTech company, the browser developed by the company who gets $18B a year from an adTech company to be the default search engine or the browser created by a company who only survives because of the adTech company?

My guess? They don't only get a unique identifier, but they get to know and link you to other more useful data using your Apple/Android device ID and so on, that they can use to track you across multiple user accounts. Something that browser fingerprinting can't guarantee 100% (but getting very accurate these days)

Apple specifically limits apps ability to get a unique identifier that can be used across apps. And the percentage of people who use multiple accounts is not even worth optimizing for.

I don't seem to be able to reply to your post, but to the sibling;

I'm not an app developer so I don't know specific, but by the amount of websites begging you to use their native apps it is quite obvious that there is something they get from the native apps they can't get from the website that they are very interested in.

Just try to go to the reddit website on a mobile (not old.) and see how fast they spam you with the app prompt.

So you don’t use native apps because they can track everything you do in the app so you use websites that can track everything you do on their site?

They said "...a browser with ublock origin.." uBlock Origin is a content blocker that would help prevent tracking.

But wouldn't they be able to infer what you clicked by the data loaded?

If you block that data, most webapps, especially things like an app store, will be useless.

Cutting the shit out of website is much easier compared to app. I am doing it by default.

What extension allows you to block “hover” tracking and not “click” tracking?

If the website is not using a third party site for tracking, you can’t block the owner from tracking and storing your interactions.

hover tracking is done by js, hence any js stopping would do.

I personally use that + VPN that cuts the rest that sneaks in