A new study has found that many popular smartphone apps routinely share personal information with third parties, often without users' knowledge. Researchers from the Massachusetts Institute of Technology (MIT), Harvard, and Carnegie-Mellon universities analysed 110 apps from Google Play and the Apple App Store, uncovering widespread data leakage.
The study, titled 'Who Know What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third Parties by Mobile Apps', tested 55 Android and 55 iOS apps. Researchers monitored HTTP and HTTPS traffic for transmissions containing personally identifiable information, behavioural data, and location details. On average, Android apps sent data to 3.1 third-party domains, while iOS apps connected to 2.6.
Among Android apps, 73% shared users' email addresses and 49% shared names, compared to 18% of iOS apps sharing names and 16% sharing email addresses. Location data was shared by 47% of iOS apps. Three out of 30 health and fitness apps transmitted search terms and user inputs to third parties. Notably, the Android health app Drugs.com sent medical information, including words like 'herpes', to five domains including doubleclick.net and googlesyndication.com.
The most data-intensive Android app was Text Free, which sent data to 11 third-party domains, while the iOS app Localscope transmitted to 17 domains. Google and Facebook were the most common recipients of leaked data. Additionally, 93% of Android apps connected to a mysterious domain, safemovedm.com, which also transmitted data when the phone was idle, likely due to a background process.
Privacy International's technologist Christopher Weatherhead expressed concern, stating the report 'highlights the many ways that the devices we use can betray us' and noted that such data sharing could have implications under the UK's draft Investigatory Powers Bill, as internet connection records would retain these third-party connections, potentially leading to incorrect assumptions about browsing habits.
The findings align with a recent US survey by the Pew Research Centre, which found that 54% of users had declined to install an app due to privacy concerns, and 30% had uninstalled an app after discovering unwanted data collection.
