Surprise, surprise: researchers have discovered that apps available in both the Google Play Store and the iOS App Store frequently send personal information to a multitude of sources, often without notifying the user.
The researchers tested 110 popular free apps, 55 from each app store, and looked specifically for how and where these apps shared personal information. It was discovered that, on average, Android apps send user information to 3.1 third-party domains, while iOS apps send data to 2.6 third-party domains.
The situation is a little bit worse on Android than it is on iOS. 73% of the Play Store apps tested send the user's email address to third-parties, 49% send the user's name, 33% send the handset's current GPS coordinates, 25% sent addresses, and 24% sent IMEI information.
On iOS, 47% of apps sent the user's current location, 18% sent the user's name, and 16% sent the user's email address. Of the domains that data was sent to, google.com was the most popular, with 36% of all apps sending data there, while googleapis.com was used by 18% of apps, and facebook.com by 14%.
The most concerning discovery was that some health-related apps were sending potentially sensitive user information to third-party domains. An app from Drugs.com, for example, sent some symptom information to five domains, including to advertisers like DoubleClick. Period Tracker Lite also transmitted symptom information to third parties.
It should be noted that this information is being sent to third parties with permission, as these apps require a user's permission to collect the data they are sending. However, the apps often don't inform users that the data they agree to share is being sent off to third-parties, and users will often blindly accept permission requests when they are presented.
The researchers suggest the only way to avoid having your data transmitted to various sources is to supply false data wherever possible. It's also a good idea to selectively disable permissions for apps if you don't think they require them, which is possible to do in some cases in iOS 9 and Android 6.0.