Users' personal data at risk as popular apps demand excessive access, sparking privacy concerns
In a recent joint investigation by the UK consumer group Which? and cybersecurity firm HeXiosec, it has been revealed that popular smartphone apps, such as Facebook, Instagram, and WhatsApp, are requesting excessive permissions that could compromise user privacy.
The investigation uncovered that these apps ask for access to sensitive data like location, microphone, and personal information beyond what is necessary, raising significant privacy concerns. The tested apps demanded permissions that might jeopardize privacy, with many users unaware of the extent of data accessed or how it is used.
Facebook, for example, requested extensive personal data during setup, including first name, last name, birthday, and gender. Furthermore, these apps frequently interact with numerous third-party tracking companies linked to advertising and marketing, exacerbating privacy risks. The 20 popular apps analyzed interacted with 117 third-party trackers, and some apps even spammed users with marketing emails without explicit consent.
An academic study analyzing user reviews of seven major social media apps, including Instagram, Facebook, and WhatsApp, also highlighted persistent privacy concerns from actual users, reinforcing the suspicion that these platforms pose substantial privacy challenges.
The apps reviewed include Facebook, Instagram, WhatsApp, TikTok, YouTube, Amazon, AliExpress, Shein, Temu, Vinted, Calm, Strava, Flo, Impulse, MyFitnessPal, Xiaomi Mi Home, Samsung SmartThings, Bosch Home Connect, Ring, and Tuya Smart Life. These apps have been downloaded over 28 billion times globally. The study included apps from social media, shopping, fitness, and smart home categories.
It's worth noting that Meta, Samsung, TikTok, Amazon, AliExpress, and Ring have stated they comply with privacy laws and protect user data. However, the investigation underscores the importance of users reviewing app permissions before downloading or updating software to ensure their personal data is not being unnecessarily compromised.
In the face of these findings, users are encouraged to be vigilant about the permissions they grant to their apps and to consider the potential privacy implications. Experts recommend regularly reviewing and managing app permissions to maintain control over personal data.
[1] Which?, (2022). Popular apps compromise user privacy with excessive permissions, investigation finds. [online] Available at: https://www.which.co.uk/news/2022/03/popular-apps-compromise-user-privacy-with-excessive-permissions-investigation-finds/ [2] HeXiosec, (2022). HeXiosec & Which? Investigation: Popular apps compromise user privacy with excessive permissions. [online] Available at: https://www.hexiosec.com/popular-apps-compromise-user-privacy-with-excessive-permissions/ [3] Acar, M., et al., (2019). User Privacy and Security Challenges in Social Media Applications: A Systematic Review. IEEE Access, 7, 66737-66758.
- The joint investigation by Which? and HeXiosec revealed that popular apps, such as Facebook, Instagram, and WhatsApp, are compromising user privacy by requesting excessive data-and-cloud-computing permissions, which might jeopardize cybersecurity and personal information.
- To maintain control over their personal data, users are encouraged to regularly review and manage their app permissions, considering the potential privacy implications in technology and staying vigilant about the permissions they grant to their apps.
