@Dashrender said in Android OS and tracking:

Unless she is willing to root it and put on her own firmware/ROM, I wouldn't use it if she's worried about that at all.

The built in ROM could easily restore any tracking, etc, software installed when you wipe the phone. Only way to be sure would be to not use it. Second best way, replace the ROM. I'm not sure you can actually update the BIOS to ensure nothing is hiding in there - remember LoJack - it can be in the BIOS and reinstall itself on a new OS install - just like the Lenovo BIOS thing of last year.

While it is possible that tracking is built into the stock ROM, I find that highly unlikely. Also, since this is a gaming device, there is no real need to use your main Google Account on this device if you are wary of it. If you just play the games on it and disable the GPS, I don't see much of an issue.

I do agree that rooting and putting a custom ROM on there is a good idea. However, I think the risk of tracking with the stock ROM is virtually non-existent.