Smartphones have pervaded our every waking hour, changed the way we communicate, work and access services in our daily lives, but the technology that underpins smartphone apps may be even more intrusive than you realise.
That’s according to new research from Which?, which has revealed that 20 popular apps installed on the phones of millions of Brits are set up to siphon user data by unnecessarily accessing personal information they otherwise don’t need to work properly.
Apps including WhatsApp, Facebook, Instagram, TikTok and YouTube were found to ask for scores of different ‘permissions’, which is when an app asks for access to things on your phone such as location, camera and microphone.
Which? said if a person were to have all 20 of the studied apps installed on their phone, they would potentially have allowed 882 separate permissions. The results were studied on Android, and are not representative of the permissions of the same apps on Apple’s iOS.
“Of these 882 permissions, 78 are considered risky on an industry standard grading scale – including those that access your microphone, can read files on your device, or see your ‘fine’ (precise) location,” Which? said.
“This data is a valuable commodity for advertisers, and it may be possible for firms to target users with uncannily accurate ads as a result. However, some apps specifically asked your consent before using these permissions, including risky permissions.”
The consumer watchdog also surveyed 2,000 UK adults, finding 66 percent of them were most concerned about smartphone apps accessing their location, with 15 out of the 20 offending apps asking to access location by default.
15 apps asked for access to files on phones, while a worrying 14 wanted access to the phone’s microphone. 16 requested to be able to create windows on top of other apps, effectively allowing themselves to create pop ups, while seven apps asked for permission to run in the background even if you haven’t opened the app.
“Millions of us rely on apps each day to help with everything from keeping on top of our health and fitness to doing online shopping,” Harry Rose, Editor of Which? said. “While many of these apps appear to be free to use, our research has shown how users are in fact paying with their data – often in scarily vast quantities.
“While it’s easy to quickly skim a privacy policy and tick ‘yes’ on autopilot, our research underscores why it’s so important to check what you’re agreeing to when you download a new app.”
Four very popular apps, AliExpress, Facebook, Strava and WhatsApp, asked for permission to read what other apps you are currently running or recently used – something Google previously tweaked Android not to allow, but these apps are attempting to get around that to hoover up more user data.
The app that asked for the most permissions overall was the Xiaomi Home app with a staggering 91, with five considered “risky” by Which?. Samsung’s SmartThings smart home app was close behind with 82 and eight risky.
Facebook asked for the highest number of permissions of all the social media apps with 69 overall, six of which were considered risky. WhatsApp, also owned by Facebook parent Meta, was close behind with 66 and six respectively.
TikTok asked for 41 permissions in total, with only three thought of as risky.
Meta told Which? that none of its apps (Facebook, WhatsApp and Instagram) “‘run the microphone in the background or have any access to it without user involvement”, and said users must “explicitly approve” the app to access the microphone that first time it happens.
“All our apps, including SmartThings, are designed to comply with UK data protection laws and relevant guidance from the Information Commissioner’s Office (ICO),” a Samsung spokesperson said.
TikTok said privacy and security are “built into every product” it makes.
Part of the issue is that it’s easier to tap ‘accept’ or ‘allow’ for confusing permissions when we set up apps, as we can often be worried the apps won’t work properly unless we do. But think carefully about what permissions you really need to give to a free app – if you post on Instagram, you likely do not need to give the app permission to access your microphone, for instance.