HEALTH APPS THAT NEVER ASK FIRST

Health apps handle some of the most sensitive data there is: mental health records, real-time glucose readings, heart rate. A leak can lead, the authors note, to discrimination at work, refused insurance or blackmail. Yet, according to Ethan Myers and colleagues at Colorado State University, the New Jersey Institute of Technology, the University of Calgary and Stony Brook University, these apps “remain poorly understood at scale”.

They focused on the moment that matters most: installing the app and opening it for the first time, when users decide what to grant. Once data has been handed over, they point out, taking back control becomes practically impossible.

Finding the real health apps

First problem: what counts as a health app? Store categories are unreliable. Of the apps the team labelled by hand, only 71.5% of those filed under “Medical” or “Health & Fitness” were actually health apps; a delivery service that brings prescriptions, for instance, can land there. So they wrote a definition based on World Health Organization guidelines — monitoring, disease management, telemedicine, medication — and trained a classifier on 5,000 hand-labelled apps. Run over 500,000 app descriptions, it found 10,688 health apps, downloaded from Google Play between March and May 2024.

Three ways to break trust

The team measured three threats:

1. Asking for too much: permissions that the app’s own description does not justify. A language model trained on human-labelled sentences predicted which permissions each description supports; the team then compared that with what the app actually requests.
2. Never asking: no consent screen before data starts flowing. Each app was installed on test phones, its first screen captured and read automatically in 43 languages, while its network traffic was recorded.
3. Taking more than agreed: collecting identifiers that the consent form never mentions.

What they found

• 69% of the 10,036 apps still online request at least one unjustified permission. According to the abstract, about 53% want location, 50% the camera and 35% the microphone without a functional reason. One fitness app with over 163 million downloads, offering step counting and health tips, requested the camera, audio, phone, call logs and contacts.
• Less popular apps overreach more: an average of 2.79 excess permissions below 10,000 installs, against 1.24 above a million.
• Many apps could not be tested — they crashed or failed to start. Of the 3,599 that ran, only 253 (7%) showed any consent mechanism on their first screen. The other 93% asked nothing. The identifier most often sent out without consent was the phone’s advertising ID: one workout app with more than 177 million downloads did so.
• Among the apps that do show a consent form, 18 of 253 — about 1 in 14 — collected an identifier the form did not mention. The authors read this the other way round too: when developers do ask, they generally stick to what they announced.
• No app was caught collecting restricted identifiers such as the IMEI by a side route, which suggests Android’s protections work.

Average number of unjustified permissions per app, by developer country (grey: fewer than 10 apps). — Figure 2, Myers et al. (2026), arXiv:2610.23851, CC BY 4.0.

Laws are not enough

Apps from regions with privacy laws — the European Union, South America and parts of Asia — still showed large gaps, of 3.1 to 4.5 extra permissions on average. Consent screens were rare everywhere, including where regulations exist; the authors describe the missing consent as a direct violation of requirements such as Europe’s GDPR. Even apps from well-resourced developers such as Samsung or Google showed violations. And with the top 5% of apps accounting for 92% of downloads, a lapse in a popular app reaches millions.

Share of health apps with no consent screen on first launch, by developer country (grey: fewer than 10 apps). — Figure 5, Myers et al. (2026), arXiv:2610.23851, CC BY 4.0.

What the test cannot see

The analysis stops at first launch, before any account is created, and automated exploration of an app guarantees no full coverage. Apps that crashed were left out. Since only observed failures are counted, the authors expect their figures to underestimate the problem.

Their recommendation targets the gatekeepers: voluntary compliance and app-store review, they conclude, are not protecting users, and regulators could make automated privacy audits a condition for entering the market. The team plans to release its dataset and tools so the checking can continue.