A recent investigation conducted by Cybernews has revealed alarming privacy concerns regarding Google’s latest flagship smartphone, the Pixel 9 Pro XL. Despite users disabling location services and GPS, the phone continues to transmit user data to Google at regular intervals. The research found that every 15 minutes, the device sends a data packet containing personally identifiable information (PII) such as the user’s email address, phone number, network status, and even location data. In addition, every 40 minutes, the phone performs a “check-in,” sending system details like the firmware version and SIM card carrier information.
Aras Nazarovas, a security researcher involved in the study, criticized the device’s periodic data transmission, arguing that it goes beyond acceptable industry standards for anonymization. Another significant finding revealed that the Pixel 9 Pro XL contacts Google’s services, including Google Photos’ Face Grouping, without explicit user consent, raising serious concerns about biometric data privacy.
The investigation also uncovered that the Pixel 9 Pro XL has built-in remote management features, typically found on enterprise devices. The “CloudDPC” package allows Google to remotely control the phone’s settings and perform actions like software updates without the user’s awareness. Researchers also noted that the device frequently communicated with an experimental endpoint, likely for A/B testing and user interface modifications.
While no direct threats were detected, the potential for remote control or unauthorized software installations is a cause for concern, particularly if malicious actors gain access to Google’s staging environment. On the upside, researchers did not find any evidence of third-party data transmissions, and the phone regularly checked for updates on scam-related numbers, a feature associated with its call-screening functionality.
In response to the findings, Google defended the data transmissions, claiming they are essential for core functions such as software updates and personalized experiences. The company also highlighted that the test conditions, which involved a rooted device, may have caused data behaviors that deviate from standard use, assuring that such transmissions are necessary across all smartphones.
