The Android operating system has evolved a lot since its creation and, with its evolution, several changes were implemented in order to improve user’s privacy and control of the information stored by the applications.
Even with the existing restrictions placed on previous versions of the operating system, applications were still able to access user content without their knowledge, using these files for monitoring and accessing personal data. To prevent this sharing of information without users’ consent, in Android 10 the concept of storage by scope was introduced.
Scoped Storage limits access to sensitive information (location, photos, documents, etc.) by applications that should not have access to that information and ensures that data generated by these applications is deleted when they are uninstalled. Although these changes were included in Android 10, the developer can still choose to turn them off to have more time to adapt the applications. However, they will be mandatory on Android 11.
Evolution of access to the system files
Initially, access to files on Android was similar to file access on a personal computer. With reading or writing permission, it was possible to access all files in common storage areas. These files could contain sensitive information. In addition to obtaining personal information, applications could store specific data anywhere in the common storage area, leaving a lot of data behind when it was uninstalled.
On Android 5 (Lollipop), the choice to allow access to files and folders could be remembered through the application, so it was no longer necessary to keep asking for user’s permission all the time.
On Android 7 (Nougat), a simplified form of access to the memory card was introduced, where it was possible for the application to choose a folder to read and write access, and the user could grant or deny permission. However, it was still possible for the application to request access for the entire memory card and, if the user accepted this permission, the application would keep having access to all the user’s files.
Even with all the restrictions listed above, it was still possible to access the common storage area in the main memory of the device (standard memory in the devices) and applications still had access to the memory card if the user granted the appropriate permissions.
From Android 10, changes have been made to avoid privacy and data issues of applications that aren’t deleted in an eventual uninstallation.
What are the changes with the Scoped Storage introduced on Android 10?
In Scoped Storage, applications lose unrestricted access to common storage – both internal storage and memory card ones. Applications still can read and write freely on the file system, however, they do not have the complete view of it anymore. Instead, a virtual file system is created for each application, so that it only can access files created by itself.
This prevents access to files created by other applications. Another advantage of this implementation is that, once the application is uninstalled, all files created by it will be deleted, avoiding problems with files that could be left on devices by applications that were deleted.
However, there are special system folders for storing files that can be shared between applications, such as folders used for downloads, audios, videos and images. With scoped storage, applications can store files in these folders without restriction and with no need to request access. In these folders (except for downloads folder), all files created by the application can be read with no need of special permission, however, files generated by other applications need user permission to be accessed.
In addition to these changes, the information of locations that are stored in videos and images is removed when an application obtains access to these files. . These applications can request it if necessary and the user will be informed that the application wants to access the location of the photos before granting permission.
Here you can find more information on changes needed in applications to support storage by scope.
With the implementation of Scoped Storage, it was possible to restrict the gaps used by various applications to gain access to users’ sensitive information and at the same time, prevent uninstalled application files from being stored. In addition, as this solution applies to both the main memory of the device and the memory card, it implementation by developers, in addition to preventing loopholes in accessing files.