Researcher finds OnePlus' OxygenOS does not anonymize telemetry data, lacks an opt-out setting
OxygenOS, a custom version of the Android operating system that comes installed on all OnePlus smartphones, is tracking users actions without anonymizing data, allowing OnePlus to connect each phone to its customer.
Context & Ripple Effects
OxygenOS began as OnePlus' in-house replacement for Cyanogen's software — first an alpha Lollipop build for the One in early 2015, then a full ROM reveal that February — so the telemetry finding lands on software the company built itself rather than licensed. It also lands on a brand whose credibility was already dented that year by benchmark manipulation on the OnePlus 5.
The disclosure triggered a fast reversal: within days OnePlus committed to adding a usage analytics opt-out to the setup process. But the pattern didn't stop there — three years later the company was shipping unremovable Facebook bloatware in the OS itself.
First-order effects
- Every OnePlus phone running OxygenOS can be tied back to its specific owner through non-anonymized usage data, with no setting available to stop collection.
- OnePlus faces immediate reputational pressure from its enthusiast core audience — the same community that had just absorbed the benchmark-manipulation findings months earlier.
Second-order effects
- The opt-out OnePlus promised in the setup flow becomes a template other Android vendors get measured against; Xiaomi's parallel finding that its phones track usage and browsing even in incognito mode shows the practice spans budget and flagship Chinese OEMs alike.
- Privacy-conscious buyers who chose OnePlus as a 'clean' Android alternative now have reason to weigh custom-ROM or stock-Android routes, hitting the retention base the community-driven brand depends on.
Third-order effects
- If researcher scrutiny keeps forcing per-vendor opt-outs one outcry at a time, telemetry disclosure and an analytics toggle are likely to harden into baseline expectations for Android OEM setup flows rather than differentiators.
- The episode fits a longer arc of OEM-added software layers — telemetry, then unremovable preloads — eroding the distinction between a phone's operating system and its vendor's data business.
The trend: Android vendors are treating their custom OS layers as data-collection surfaces, with independent researchers — not regulators — forcing opt-outs vendor by vendor.