Share
A new investigation by Which? reveals the alarming extent to which popular smartphone applications are collecting user data, often requesting access to sensitive information such as location, microphone and device files.
Conducted in collaboration with cybersecurity firm Hexiosec, the research reveals that millions of UK users may be unknowingly granting extensive permissions, effectively transforming their mobile devices into lucrative “data goldmines” for advertisers and other corporations.
Which? meticulously examined 20 widely used apps, including industry giants such as WhatsApp, Facebook, YouTube, Instagram, TikTok, Amazon, and Strava. The investigation’s findings indicate that if a user were to install all 20 apps, they would collectively grant an astonishing 882 permissions.
A significant 78 of these are classified as “risky,” encompassing permissions that allow access to your microphone, the ability to read files stored on your device and precise location tracking.
The report highlights that the collected data represents a highly valuable commodity for advertisers, potentially enabling them to deliver remarkably accurate and personalized advertisements. A parallel Which? survey of over 2,000 adults revealed a prevalent concern: two-thirds (66%) of respondents expressed apprehension about apps collecting their precise location.
Despite this widespread worry, 15 out of the 20 apps tested sought this very permission. Similarly, 15 apps requested access to device files and 14 sought microphone access.
Beyond the more obvious permissions, the investigation brought to light more subtle, yet potentially intrusive, requests. Sixteen of the apps examined asked for permission to create pop-up windows over other applications, even if the user had opted out of receiving notifications from that app. Furthermore, seven apps sought permission to automatically initiate operations when a phone is switched on, without any direct user interaction.
While certain “risky” permissions, such as microphone access for calling applications like WhatsApp, serve clear functional purposes, the necessity of others appeared less clear-cut. For example, AliExpress, Facebook, Strava, and WhatsApp all requested the ability to see which other apps a user had recently used or was currently running—a level of access that Android had previously restricted due to privacy concerns. .
Which? also developed a bespoke framework to evaluate app consent practices, revealing that health and fitness apps scored the lowest with an average of 5.6 out of 10. Brain training app Impulse (4/10) and running app Strava (5/10) were particularly criticized for their lack of transparency regarding consent.
Strava, for instance, employed what researchers described as a “dubious design,” featuring a brightly highlighted “agree” button contrasting with a greyed-out “disagree” option, potentially nudging users towards acceptance. Shopping apps fared only slightly better with an average score of 5.9/10, with AliExpress and Temu flagged for overwhelming users with marketing emails and for easily missed privacy information during the setup process.
Even social media (6.9/10) and smart device apps (7/10), while generally performing better on consent, were found to be less than fully transparent. Facebook stood out as particularly data-intensive, requesting the highest number of permissions (69 in total, with 6 deemed risky) and deploying the most trackers (nine). Smart device apps, including Xiaomi and Samsung, were among the most demanding overall, requesting 91 and 82 permissions respectively.
Says Harry Rose, Editor of Which?:
“Millions of us rely on apps each day… While many of these apps appear to be free to use, our research has shown how users are in fact paying with their data – often in scarily vast quantities.”
He urges consumers to “check what you’re agreeing to when you download a new app.”
Related Posts
Discover more from Tech Digest
Subscribe to get the latest posts sent to your email.
