Hidden Data Practices: Android Apps Under Scrutiny

A sweeping academic study has uncovered a major transparency gap in the Android ecosystem, revealing that a majority of apps collect sensitive user data through logging—often without clearly disclosing it in their privacy policies.

Conducted by researchers from the Rochester Institute of Technology, University of Waterloo, and Ontario Tech University, the study analyzed 1,000 apps and nearly 87 million log entries over an 11-month period from late 2024 to 2025. The findings point to widespread inconsistencies between what apps claim and what they actually record during operation.

Figure 1. Android Apps.

When Logging Becomes a Privacy Risk

Logging is a fundamental part of software development, helping engineers troubleshoot issues, monitor performance, and understand user behavior. But these logs often contain highly sensitive information, including IP addresses, device identifiers, location data, and even login credentials.

The study examined apps across 42 categories on the Google Play Store, spanning everything from social media to health and productivity tools. Figure 1 shows Android Apps.

Policies vs. Reality

While most apps (88%) provided a privacy policy, only 28.5% mentioned logging practices at all. Even among those that did, many disclosures were vague, offering little clarity on what data was being collected or how it was used. The gap between policy and practice was even more striking. Researchers found that:

• Over 60% of apps leaked sensitive data through logs
• Nearly 68% failed to disclose the types of data being logged
• Only about 4% of apps fully aligned with their stated privacy policies

This disconnect leaves users largely unaware of how their data is handled behind the scenes.

What Data Is Being Exposed?

Among the most commonly logged—and undisclosed—data points were fine-grained location details, with tens of thousands of instances recorded. IP addresses and device identifiers were also frequently captured without proper disclosure.

Notably, nearly all instances of device model data logging went unmentioned in privacy policies, highlighting how routine data collection can escape user awareness.

Why the Gap Exists

The study suggests that many developers implement logging for technical purposes without fully considering its privacy implications. At the same time, privacy policies are often created using generic templates that fail to reflect actual app behavior.

Interestingly, apps with larger user bases and more reviews were more likely to disclose logging practices, indicating that public visibility and regulatory pressure may encourage better transparency.

Implications for Users and Regulators

Privacy policies are meant to inform users about how their data is collected and used, particularly under regulations like GDPR and CCPA. When these policies fall short, users are left exposed to hidden risks, and regulators face challenges in enforcing compliance.

Toward Better Transparency

To close this gap, researchers recommend treating all logging data as sensitive by default. Developers should clearly disclose what is collected, why it is needed, and how it is protected [1]. Suggested improvements include limiting the collection of sensitive identifiers, applying anonymization techniques, encrypting logs, and regularly auditing data practices.

A Wake-Up Call for App Privacy

The findings highlight a broader issue in digital privacy: what users are told often doesn’t match what actually happens. As apps continue to play a central role in everyday life, ensuring transparency in data practices will be critical for building trust and protecting user privacy.

References

1. https://cyberinsider.com/67-of-android-apps-log-data-not-mentioned-in-their-privacy-policies/

Cite this article:

Keerthana S (2026), “Study Finds 67% of Android Apps Collect Undisclosed User Data”, AnaTechMaz, pp.363