HTC logging, 2011: what was reported
23 events.
Oldest first.
In 2011 a researcher, Trevor Eckhart, reported that logging software on some HTC Android phones recorded far more than users expected. It was one of the first widely discussed cases of a phone maker's own diagnostics being questioned as surveillance. The account below follows what was reported at the time, in order. It is a summary, not a primary record, and dates and details are not linked to sources here, so treat them as approximate.
No exploit steps are given here. For what your own phone records today, run the audit.
Eckhart notifies HTC of the HTCLogger exposure
24 September 2011 / HTC
Trevor Eckhart privately alerted HTC to a serious flaw involving an internal suite known as HTCLogger. The vulnerability allowed any application requesting standard network permissions to access sensitive device telemetry, location data, and call logs. The private disclosure provided the vendor with details to reproduce and patch the security weakness.
HTCLogger vulnerability made public
30 September 2011 / HTC
Details of the HTCLogger security flaw were publicly revealed on developer forums after initial private communications. Security researchers demonstrated that untrusted local applications could query a local port to retrieve personal data including SMS data, phone numbers, and location history. The publication prompted widespread scrutiny of pre-installed diagnostic software by original equipment manufacturers.
HTC reported to have responded
October 2011 / HTC
HTC was reported to have responded to the disclosure and to be working on an update to close the exposed diagnostic interfaces. The exact timing and wording of its response are not linked to a source here. Details of this event are less certain.
Eckhart publishes analysis of Carrier IQ on Android devices
12 November 2011 / Carrier IQ
Trevor Eckhart released in-depth research and video demonstrations detailing the operation of Carrier IQ software embedded on several carrier-branded Android devices. The analysis demonstrated that the software recorded keystrokes, SMS content, and visited URLs at a low system level. The report prompted public debate over whether the telemetry constituted an unannounced rootkit.
Carrier IQ publishes a statement about its software
28 November 2011 / Carrier IQ
Carrier IQ published a formal response to public allegations, denying that its platform functioned as spyware or logged keystrokes. The company stated that its diagnostic software measured wireless network performance and device operational health on behalf of mobile carriers. It also withdrew a previous cease-and-desist letter sent to Trevor Eckhart following intervention by civil liberties groups.
US Senator Al Franken writes to Carrier IQ and handset makers
1 December 2011 / Carrier IQ
United States Senator Al Franken sent formal inquiries to Carrier IQ and major mobile network operators demanding answers regarding user tracking and diagnostic collection. The letter asked for clarification on what data was logged, how long it was retained, and whether users could opt out of the monitoring. Franken expressed concern that the practice could breach federal privacy laws.
Google introduces Bouncer scanning for Android Market
February 2012 / Android
Google announced the launch of an automated security service codenamed Bouncer to scan applications in the Android Market for malicious software. The system automatically analysed existing and newly uploaded applications in a cloud emulation environment to detect malware, spyware, and trojans. Google reported that the system had achieved a significant reduction in potentially harmful software across the ecosystem. Details of this event are less certain.
Google introduces Android Device Manager
1 August 2013 / Android
Google announced the rollout of Android Device Manager, a native remote device location and management tool for Android handsets. The service allowed users to locate misplaced phones on a map, sound an alarm at full volume, or remotely erase personal data if the device was lost or stolen. The tool offered an official security feature comparable to Apple's Find My iPhone service.
Apple publishes a privacy site and says it does not monetise customer data
September 2014 / Apple
Apple launched a comprehensive privacy website featuring an open letter from Chief Executive Tim Cook outlining the company's data protection philosophy. The company emphasised that its business model was not based on selling user data or monetising personal information for targeted advertising. The update coincided with stronger default disk encryption introduced in iOS 8. Details of this event are less certain.
Android 6.0 Marshmallow introduces runtime permissions
5 October 2015 / Android
Google released Android 6.0 Marshmallow, overhauling the operating system's security architecture by replacing install-time permissions with runtime permissions. Users were prompted to grant individual permissions such as camera, microphone, and contacts access only when the application required them. The change also allowed users to revoke specific permissions at any time via the system settings menu.
GDPR adopted by the European Parliament
14 April 2016 / regulation
The European Parliament formally approved the General Data Protection Regulation, establishing a unified data privacy framework across the European Union. The legislation expanded individual rights, introduced strict rules on consent, and mandated notification for data breaches. It also established severe potential financial penalties for non-compliance, setting a two-year transition period before enforcement.
Android 8.0 Oreo adds background location limits
August 2017 / Android
Google introduced Android 8.0 Oreo, which implemented strict limits on how frequently background applications could retrieve a device's geographical location. The restrictions reduced unintended tracking and battery drain by curbing silent, continuous location polls. Developers were directed to use foreground services or geofencing APIs to maintain essential location functionality. Details of this event are less certain.
GDPR becomes enforceable
25 May 2018 / regulation
The European Union's General Data Protection Regulation became directly enforceable across all EU member states after a two-year transition window. Companies worldwide updated their privacy terms and consent mechanisms to avoid hefty administrative fines for unauthorised data processing. European privacy regulators immediately received multiple high-profile complaints against major technology firms.
Android 10 introduces the "only while using" location option
September 2019 / Android
Google released Android 10, bringing a new tripartite permission model for location access that gave users finer control over app tracking. Users gained the option to grant location permissions solely while an application was actively in use on screen, rather than permanently. The operating system also restricted background clipboard access and tightened controls over non-resettable device identifiers. Details of this event are less certain.
iOS 13 adds location and Bluetooth permission reminders
19 September 2019 / Apple
Apple released iOS 13, incorporating periodic notification pop-ups that displayed maps of where background apps had tracked user location. The update also required third-party applications to ask for explicit user consent before accessing Bluetooth interfaces, curbing passive beacon tracking in physical retail spaces. Additionally, Apple introduced a one-time location permission option alongside fine-grained wireless privacy controls.
iOS 14 introduces privacy nutrition labels and approximate location
16 September 2020 / Apple
Apple rolled out iOS 14, introducing an approximate location toggle that let users share general regional data rather than pinpoint coordinates. The platform also prepared developers for mandatory App Store privacy nutrition labels detailing data collection categories. New on-screen indicators informed users whenever an application accessed the device camera or microphone.
iOS 14.5 launches App Tracking Transparency
26 April 2021 / Apple
Apple launched iOS 14.5, enforcing the App Tracking Transparency framework across all third-party software on its App Store. The framework required applications to obtain explicit user consent before tracking them across other companies' apps and websites via the Identifier for Advertisers. The requirement led to widespread declines in tracking opt-in rates and significantly disrupted mobile digital advertising models.
Xiaomi analytics scrutiny: Lithuania NCSC reports on Xiaomi phones
September 2021 / Xiaomi
Lithuania's National Cyber Security Centre published a security assessment of 5G handsets produced by Chinese manufacturers, focusing on a Xiaomi flagship model. The report alleged that the handset contained latent software modules capable of detecting and censoring politically sensitive search terms. Xiaomi denied the allegations, stating that its devices complied with European privacy standards and did not censor user communications.
Android 12 introduces the Privacy Dashboard and microphone and camera indicators
October 2021 / Android
Google launched Android 12, adding a dedicated Privacy Dashboard that displayed a timeline of application access to permissions over the previous 24 hours. The update added persistent status bar indicators whenever an application engaged the device microphone or camera, alongside quick-setting kill switches. Users were also provided an option to share approximate instead of precise geographical locations. Details of this event are less certain.
Google announces Privacy Sandbox on Android
February 2022 / Android
Google announced a multi-year initiative to build the Privacy Sandbox for Android, aiming to develop privacy-preserving alternatives to cross-app tracking identifiers. The technology aimed to restrict tracking across independent mobile applications while continuing to support personalised advertising mechanisms. The company stated that it would keep existing advertising identifiers functional for at least two years while consulting industry partners. Details of this event are less certain.
Google announces Timeline will move to on-device storage
12 December 2023 / Google
Google announced that Google Maps Timeline, previously known as Location History, would shift to storing location records directly on user devices rather than on cloud servers. The update offered encrypted cloud backup options while preventing Google from accessing historical location breadcrumbs. The change substantially curtailed law enforcement access to historical geofence warrants targeting Google's centralised databases.
EU Digital Markets Act obligations begin for gatekeepers
7 March 2024 / regulation
Designated technology gatekeepers reached the compliance deadline for the European Union's Digital Markets Act. The regulations required platforms to dismantle anti-steering rules, permit alternative browser engines, and enable third-party app stores on mobile ecosystems. Gatekeepers were also prohibited from combining personal data across distinct core platform services without explicit consumer consent.
Android 15 introduces Private Space
15 October 2024 / Android
Google officially released Android 15, adding a native feature called Private Space that let users isolate sensitive applications within a separate authentication container. When locked, apps inside Private Space were hidden from the launcher, recent apps overview, notifications, and settings menus. The release also added automatic theft detection locks driven by machine learning to secure devices if stolen.
Why it still matters
The episode showed that diagnostic tools shipped by a manufacturer can collect personal detail and hand it to other apps. Modern phones still carry such tools under other names. See what phones log and the trackers inside apps.
Old forum write-ups of the same story once lived at this address; a fresh version is kept there.