Four Democratic US senators today asked the Federal Trade Commission to "investigate Apple and Google for engaging in unfair and deceptive practices by enabling the collection and sale of hundreds of millions of mobile phone users' personal data.".

"The FTC should investigate Apple and Google's role in transforming online advertising into an intense system of surveillance that incentivizes and facilitates the unrestrained collection and constant sale of Americans' personal data," they wrote.

"Apple and Google both designed their mobile operating systems, iOS and Android, to include unique tracking identifiers which they have specifically marketed for advertising purposes," the letter said.

While Apple has stopped enabling the tracking identifiers by default, the senators wrote that both companies harmed consumers:.

Both Apple and Google now allow consumers to opt out of this tracking.

By failing to warn consumers about the predictable harms that would result by using their phones with the default settings that these companies chose, Apple and Google enabled governments and private actors to exploit advertising tracking systems for their own surveillance and exposed hundreds of millions of Americans to serious privacy harms.

"This is because some data brokers sell databases that explicitly link these advertising identifiers to consumers' names, email addresses, and telephone numbers.

Additionally, Google Play has policies in place that prohibit using this data for purposes other than advertising and user analytics.

Google also said its Android Privacy Sandbox will "enable new, more private advertising solutions that limit sharing of user data with third parties and operate without cross-party identifiers, including advertising IDs." Ars reporter Ron Amadeo's coverage of that initiative called it "toothless.".

The EFF urged state and federal lawmakers to "pass meaningful privacy legislation" and said companies should protect privacy "by allowing anonymous access, stopping behavioral tracking, strengthening data deletion policies, encrypting data in transit, enabling end-to-end message encryption by default, preventing location tracking, and ensuring that users get notice when their data is being sought."