Xiaomi defends its data practices, says it collects aggregated data that can't be used to identify users and syncs browsing history if data sync is turned on
even if it is wrong! — without doing any basic scrutinizing. For anyone following the Xiaiomi story, read @cybergibbons' excellent tweet thread on the matter. https://twitter.com/... Mishaal Rahman / @mishaalrahman : Xiaomi just published a blog post in response to the report by @iblametom and @cybergibbons http://blog.mi.com/... Context: https://www.forbes.com/... Thomas Brewster / @iblametom : Xiaomi is the world's fourth biggest smartphone maker. Its Google Play apps have over 15m downloads. It confirmed it collects browsing data, but repeatedly denied that it tracked users browser habits when in incognito mode... even when I sent them a video showing it happening. https://twitter.com/...
Context & Ripple Effects
This is Xiaomi's rebuttal, one day after researchers reported that its phones were collecting usage habits and browsing data even in incognito mode (the original findings). The company's blog post concedes it collects browsing data through its Google Play apps — which have over 15m downloads — but denies tracking habits, framing what was observed as aggregated, non-identifying data plus browsing-history sync that only fires when users enable data sync.
First-order effects
- Xiaomi shifts the dispute onto the researchers' methodology: if the sync explanation holds, the flagged traffic is opt-in behavior rather than covert tracking, and the burden moves to Thomas Brewster and cybergibbons to show otherwise.
- Users of Xiaomi's preinstalled apps are left making a settings decision — leaving data sync off becomes the practical mitigation while the aggregation claim stays unverified.
Second-order effects
- Every Android vendor shipping preinstalled browsers and analytics SDKs now faces the same researcher playbook; the later disclosure of how Meta and Yandex glean logged-in browsing histories via web identifiers ([[a:886505]]) shows this class of finding keeps recurring across vendors.
- Google's position gets awkward by association — Apple's internal 'Android is a massive tracking device' framing surfaced years later in US v. Google ([[a:845897]]) — so platform-level scrutiny of OEM data flows strengthens rather than fades.
Third-order effects
- If researcher-driven audits keep forcing vendors into defensive blog posts, telemetry design converges on a compliance posture — aggregation claims, sync toggles, documented data flows — as a standard cost of shipping phones globally.
- For Xiaomi specifically, trust questions compound a brand already built on undercutting rivals on price rather than R&D depth, making privacy perception a competitive liability in markets where it sells against Samsung and Apple.
The trend: Smartphone vendors' built-in data collection is being mapped researcher-by-researcher, pushing OEMs from silent telemetry toward defensive, documented privacy postures.