Even if the content of the message does not reveal anything more than “some Android device connected”, the metadata (which includes the source IP) can be used to derive further information, especially if combined with data such as WiFi access point locations. The connection check traffic can be observed and analyzed by the party controlling the connectivity check server and any entity observing the network traffic. Mullvad’s report outlines the potential privacy implications: As there seems to be no way to stop Android from leaking this traffic, we have reported it on the Android issue tracker. However, this can be a privacy concern for some users with certain threat models. So most users will want the captive portal check to happen and allow them to display and use the portal. If for instance there is a captive portal on the network, the connection will be unusable until the user has logged in to it. We understand why the Android system wants to send this traffic by default. It does this every time the device connects to a WiFi network, even when the Block connections without VPN setting is enabled. We researched the reported leak, and concluded that Android sends connectivity checks outside the VPN tunnel. According to the company’s blog, the mobile operating system bypasses VPNs and leaks data, even when the option to Block connections without VPN is enabled: In one of its latest security audits, Mullvad discovered an issue with Android. Unlike many companies in the space, Mullvad has traceable ownership, anonymous payments, and has been audited by a third party. Mullvad is one of the leading VPN providers and consistently wins praise for being one of the most secure and private options on the market.

Famed VPN company Mullvad has found that Android circumvents VPNs and leaks data, raising privacy implications.

Mullvad android