Your phone could be revealing details about your daily life that you never intended to share. From the websites you visit and products you search for to your precise location and photo metadata, popular apps can collect an extraordinary amount of personal information.
Several investigations have now examined what happens behind the scenes when people use familiar apps. The findings raise uncomfortable questions about how much information companies gather and how far that data travels after users tap a screen.
An Investigation Put Six Popular Apps Under The Microscope
A Marketplace investigation tested six widely used smartphone apps to discover what information they collect and whether they share it with outside companies. The apps included Tim Hortons, PC Optimum, The Weather Network, Facebook, Amazon and YouTube.
To investigate their behaviour, Joel Reardon, an associate professor in the University of Calgary’s computer science department, and his team examined network traffic generated by the apps on an Android device. An organization called Privo also conducted scans of the same apps on Apple’s iOS platform.
The researchers discovered that some apps appeared to transmit personal information to third-party companies. The information reportedly ranged from names and email addresses to precise location details and unique device identifiers.
Although the apps disclose certain collection and sharing practices in their privacy policies, researchers questioned whether some of the information was necessary for the services being provided. They were particularly concerned about how much data could reach companies outside the app developers’ direct operations.
Reardon was particularly critical of the wider situation surrounding digital privacy. “To me, this is not the internet we wanted. This is not the internet we deserve. It’s turned into a monstrous data collection surveillance system,” he said.
The investigation revealed different practices across the six apps, with some appearing to share considerably more information with outside companies than others.
These Six Popular Apps Raised Serious Privacy Questions
The findings varied between applications, but researchers identified several examples of information collection that deserved closer examination. Here is what their testing revealed about each service.
1. Tim Hortons Appeared To Collect Detailed Device Information
The Tim Hortons app appeared to send information to third-party companies shortly after users launched it. Reardon said one overseas company connected to the app appeared to receive enough information to create something resembling a digital fingerprint of each device.
The information reportedly included the name assigned to the device, its unique identifier, available sensors and camera specifications. Researchers also identified details such as ringtone and alarm names, alongside the names of nearby Wi-Fi routers.
The Wi-Fi information particularly concerned researchers because nearby router names can potentially help determine someone’s location. Rollason questioned whether collecting such extensive device information was necessary to validate a purchase involving a cup of coffee.
She described the amount of information being collected as seemingly excessive for that purpose. Marketplace did not identify the third-party company or its location, explaining that accountability rested with the app developer.
Tim Hortons defended the arrangement through a statement from communications director Michael Oliveira. He said the information was collected for fraud prevention, account protection and payment abuse prevention rather than marketing or advertising.
The company also said the third party could not sell the information. According to Tim Hortons, these details helped identify unfamiliar devices accessing customer accounts and detect potential attempts at impersonation.
The PC Optimum investigation uncovered another concerning practice involving information about what customers searched for inside the app. Researchers found that the application appeared to send product search information to 10 outside companies, including searches for sensitive items such as prenatal vitamins.
One third-party company appeared to receive users’ latitude and longitude alongside a unique device identifier. Another overseas recipient reportedly received first names, unredacted email addresses, membership numbers and information about how people interacted with the application.
That interaction information could include when someone opened the app and which activities they performed. Reardon and Rollason questioned why so many outside companies needed access to details about customers’ searches.
Loblaw, the company behind PC Optimum, responded by saying it had never sold personal information. It also explained that information collected through its applications supported everyday services such as online shopping and finding nearby stores.
Weather applications have an obvious reason to request location access because accurate local forecasts depend on knowing where users are. However, the investigation raised questions about what happens to that information after permission is granted.
Researchers found that The Weather Network app appeared to send precise latitude and longitude information to a third-party company for targeted advertising. The information reportedly included local weather conditions and the device’s advertising identifier.
Reardon explained that combining location information with a persistent device identifier could help create a history of someone’s movements. Advertisers could potentially use those details to understand patterns in people’s daily behaviour.
Rollason also discussed how weather conditions could reveal information about people’s habits. For example, advertisers might learn whether someone uses their phone more frequently during rainy weather or when they spend time indoors.
Pelmorex, the company’s parent organization, defended its practices. It said location information was used to provide local forecasts and relevant advertisements, adding that users could access weather information without granting location permission.
4. Facebook Appeared To Collect Photo Metadata
Facebook’s handling of photo information was another part of the investigation that attracted attention. Researchers found that when users granted the app access to their camera roll to upload one image, it appeared to collect metadata from other photos and videos stored on the device.
Metadata can reveal information such as file names, the dates and times images were captured and the camera settings used. The investigation also found that Facebook appeared to collect latitude and longitude information associated with images and videos actually uploaded to the platform.
Researchers observed additional activity tracking inside the application. This included recording users’ scrolling behaviour and how long they lingered on particular content.
Interestingly, Facebook did not appear to share information with third-party companies during the testing period. Meta, its parent company, did not comment on Marketplace’s specific findings, although its privacy policy discloses certain information collection practices.
5. Amazon Collected Search Information
Amazon also appeared to collect information about the products users searched for, including searches involving sensitive items. The investigation additionally identified the collection of device advertising identifiers.
However, researchers did not detect Amazon sending information to outside companies during the testing period. Reardon suggested that large technology companies often have the resources to operate their own advertising networks.
Amazon said it never sells customers’ personal data. The company also stated that its products and services are designed to protect privacy and give customers control over their experiences.
6. YouTube’s Findings Were Different
YouTube produced a different result during the investigation. Researchers did not detect the app sending information to third-party companies, with the data appearing to go only to the United States.
Marketplace also examined whether YouTube followed Google’s rules regarding targeted advertising during children’s content. The test found no targeted advertisements while watching a children’s video.
Google said it does not sell personal information. However, the findings represent what researchers observed during their testing period rather than a guarantee about every possible form of data collection.
A Separate Study Found 45% Of Apps Collected Browsing History
The six-app investigation was not the only research raising concerns about smartphone privacy. A separate study examined 40 popular Android and iOS applications across social media, e-commerce, messaging and generative AI.
Researchers compared privacy information published in the Apple App Store and Google Play Store. Their goal was to identify which applications reported collecting users’ browsing history.
The findings revealed that 18 of the 40 apps collected browsing history on at least one platform. That represents 45% of the applications examined, suggesting that browsing information collection is widespread among popular mobile services.
Social media applications were particularly prominent in the research. Nine out of 10 apps in that category reportedly collected browsing history on at least one operating system.
The platforms identified included Facebook, Instagram, TikTok, X, YouTube, Pinterest, Reddit, LinkedIn and Snapchat. Facebook, Instagram, TikTok, X, YouTube and Pinterest reported collecting browsing history on both Android and iOS.
Shopping applications also featured in the findings, with eBay, Shopee and Shopify collecting browsing history on both platforms. Taobao collected it on iOS, while AliExpress reported collecting it on Android.
Messaging services were also represented, with Rakuten Viber, Messenger and LINE identified in the research. Google Gemini was the only generative AI application in the study reported to collect browsing history.
Researchers suggested that this information could help companies understand users’ interests, personalize content and deliver more targeted advertisements. The findings are particularly relevant because browsing activity can reveal interests beyond what people deliberately share inside individual applications.
Instagram And Facebook Ranked Among The Most Data-Hungry Apps
Another investigation examined the privacy policies of more than 5,000 applications listed on Apple’s App Store. Conducted by QR Code Generator, the research developed an index based on 46 indicators covering different types of data and collection practices.
Instagram and Facebook jointly occupied the top position, each receiving a score of 61.47 out of 100. Both applications reportedly collected 32 of the 35 data types examined, with 25 linked to users and seven both linked and tracked.
Several other familiar platforms also appeared near the top of the rankings. The complete top 10 included:
| App | Privacy Index Score |
|---|---|
| 61.47 | |
| 61.47 | |
| Grab | 55.57 |
| Threads | 54.53 |
| Meta Business Suite | 54.53 |
| Messenger | 54.53 |
| Nordstrom Rack | 53.62 |
| Nordstrom | 52.54 |
| 50.06 | |
| AE + Aerie | 50.01 |
Grab’s position was particularly interesting because the service provides transportation and food delivery. The research found that it collected 27 data types, including financial information, precise location and purchase history.
Photo and video applications were identified as the most invasive category overall in the study. Social networking applications and food and drink services followed.
These rankings need some context because the investigations used different methodologies. Some researchers examined actual network traffic, while others assessed information disclosed in app store privacy reports and company policies. Their results offer different perspectives on data collection rather than a single universal ranking.
Why Do Smartphone Apps Collect So Much Information?
There are legitimate reasons for applications to request certain types of personal information. A weather service needs location details to provide accurate local forecasts, while shopping platforms require purchase information to process orders and recommend products.
The concern arises when information collection appears to extend beyond what users might reasonably expect from a service. Device identifiers, browsing history and precise location information can potentially reveal much more about someone’s habits than a single transaction or app interaction.
Browsing history can indicate interests and shopping preferences, while location information can help establish patterns of movement. When combined with other identifiers, these details can contribute to more detailed profiles of individual users.
Companies can use collected information to personalize services and advertising. However, researchers have questioned whether users understand how much information is being gathered and which outside organizations may receive it.
Former Ontario privacy commissioner Ann Cavoukian raised concerns about the limited control consumers have over their personal information. Speaking about the wider privacy problem, she said: “You lack total control. It can be used in a variety of unorganized ways. It can come back to haunt you.”
The Office of the Federal Privacy Commissioner of Canada also said Marketplace’s findings raised a number of concerns. Meanwhile, the office of Canada’s AI Minister Evan Solomon pointed to proposed legislation intended to strengthen transparency and accountability around personal information.
Seven Ways To Reduce How Much Data Your Apps Collect
Removing every application from your smartphone may be unrealistic, particularly when certain services are essential to everyday activities. However, there are practical steps you can take to limit unnecessary information sharing.
- Review app permissions: Check which applications have access to your camera, microphone, contacts, photographs and location. Remove permissions that are unnecessary for the service you use.
- Limit location access: Where possible, allow location access only while using an application. You can also check whether approximate location is sufficient for the features you need.
- Check privacy disclosures: Before installing an application, examine its privacy information in the Apple App Store or Google Play Store. Pay attention to the types of information collected and how companies say they use it.
- Delete applications you no longer use: Unused applications can remain installed on your device long after you have stopped needing them. Removing unnecessary apps reduces the number of services you interact with and the permissions they retain.
- Consider browser-based alternatives: Some services can be accessed through their websites rather than dedicated applications. This may reduce the number of applications installed on your phone, although browser-based services can also collect information.
- Review advertising settings: Check your device and individual app settings to see whether personalized advertising can be limited. These settings may reduce certain forms of tracking, although they cannot prevent every type of information collection.
- Ask companies about your information: Find out what personal details a company collects, why it needs them and whether you can request deletion. Privacy experts say companies should collect only the information necessary for their services.
Researchers also cautioned that controlling permissions cannot necessarily prevent every form of data transmission. Information may still be collected through services and third-party systems operating within an application.
The Next App You Download Deserves A Closer Look
Most people install applications because they make everyday activities easier, from ordering food and checking forecasts to shopping and watching videos. The investigations show that these ordinary activities can involve information collection that extends well beyond what users might expect.
Companies may disclose their practices through privacy policies, but understanding those documents can be difficult for ordinary consumers. Checking permissions, deleting unnecessary applications and questioning excessive information requests are practical ways to take greater control of your digital privacy.
Before downloading another app, take a moment to examine what it wants access to. A free service may save you money at the checkout, but understanding what you share in return deserves just as much attention.