In a revealing study of 100 popular apps, new research from Surfshark highlights that X (Twitter) shares data with third parties the most, while Facebook and Instagram collect significant amounts of user data.
Out of the 10 social media and messaging apps analysed, more than half track some of the data points collected across platforms.
Research is aided by a free app privacy checker tool where users can select the specific apps they have on their phone and receive a report on the extent of data collection.
“Analysing 100 popular apps on the App Store, we’ve found a concerning trend: nearly 20% of collected data is used for tracking,” says Agneska Sablovskaja, lead researcher at Surfshark. “Such tracked data can be shared with third-party advertisers or data brokers, who use it to deliver personalized ads targeting the users, or aid companies in market research.
“Understanding an app’s privacy policy is crucial for safeguarding digital autonomy.”
On average, social media and messaging apps collect 19 out of 32 possible data points. That is more than the average: 15 collected data points across all 100 examined apps. Moreover, these apps link 89% of collected data points to the user’s identity. Also, only three out of 10 such apps do not use collected data points to track users across third-party platforms (Whatsapp, Telegram, Signal).
Facebook and Instagram could be named the most data-hungry apps within the social media and messenger apps category, collecting 32 out of 32 data points, linking all data points to the user’s identity, and using seven data points to track their users across third-party advertising networks, such as email, phone number, physical address, device ID.
X (formerly Twitter) is an app that shares the most data points with third parties. Out of 22 data points, 10 collected by Twitter are used to track the user, like email address, precise location, physical address, and browsing history. Reddit is fourth (after Twitter, Instagram, and Facebook) when it comes to user tracking, tracking four data points across third-party platforms.
Out of the 10 analyzed travel and mobility apps, Signal collects the least data points (only one – phone number) and doesn’t track users across third-party advertising platforms. The 10 popular social media and messenger apps analyzed were Facebook, Instagram, X (formerly Twitter), TikTok, Reddit, Snapchat, Discord, WhatsApp, Telegram, Signal.
A total of 1 523 data points are collected across 100 of the most popular apps. Statistically speaking, that’s an average of 15 unique data points per app out of the 32 unique data points defined by Apple.
Around 90% of the apps collect usage, diagnostic, and identifier data such as product interaction, user ID, device ID, crash, and performance data. Most are essential for their app functionality.
Two-thirds of the apps collect name and coarse location, and nearly half collect precise location. Coarse location is a more general estimation of where the user is, while precise location is more detailed and accurate. Over a third of the apps collect contacts, and a fifth collect emails or text messages and browsing history.
Facebook and Instagram are the two most privacy-invasive apps. Both apps collect all 32 data points defined by Apple and are the only two to do so. Signal is also the only social media and messaging app to make the top 10 most privacy-sensitive list. It is the second least data-hungry app, collecting just one data point (phone number) that is not linked to or used to track the user.