Nearly three-quarters of Android apps and close to half of iOS apps are inappropriately sharing smartphone users’ personal information, according to a joint study from MIT, Carnegie Mellon and Harvard.

Who Knows What About Me? A Survey of Behind-the-Scenes Personal Data Sharing to Third Parties by Mobile Apps” is a pretty damning indictment of the way developers handle the personal information they get when users download their products. In a random look at 55 apps across both platforms, for example, the study found 47 percent of iOS apps share location data about the iPhone customers, while a staggering 73 percent of Android apps offer email addresses without explicit consent.

Although it’s unlikely many of these apps are offering personal information to cybercriminals, the study shows an apparent lack of accountability in how data moves from one organization to another. As BusinessInsider reported, many of the details seem innocuous enough, such as the iOS version of Instagram sending birthday, gender and location to Apple. In 3 out of 10 medical, health and fitness apps, however, what’s being collected includes in-app search histories for medical terms.

To prove how much spying is going on within mobile apps, the researchers tracked HTTP and HTTPS traffic and then identified personal information that went to third-party domains, according to BBC News. In some cases, the results were mysterious, such as the fact that 93 percent of Android apps covered in the study connected to Privacy International told BBC the report documented a betrayal of smartphone users’ trust and raised questions about possible future data retention legislation.

Although neither Google nor Apple responded to requests from several outlets for comment, it’s not as though they’re unaware of the potential fallout. Just a few weeks ago, for example, a story on Ars Technica said Apple had pulled more than 250 iOS apps from its App Store for violating its privacy policy and collecting personal information from private APIs.

Apple, of course, has been making its approach to privacy a centerpiece of its strategy, with an in-depth policy update earlier this year. As this research proves, however, the problem may be one of mobile OS providers coaching developers on the boundaries for data sharing — and providing more enforcement when necessary.

More from

What CISOs Should Know About CIRCIA Incident Reporting

In March of 2022, a new federal law was adopted: the Cyber Incident Reporting Critical Infrastructure Act (CIRCIA). This new legislation focuses on reporting requirements related to cybersecurity incidents and ransomware payments. The key takeaway: covered entities in critical infrastructure will now be required to report incidents and payments within specified time frames to the Cybersecurity and Infrastructure Security Agency (CISA).These new requirements will change how CISOs handle cyber incidents for the foreseeable future. As a result, CISOs must stay…

Will the 2.5M Records Breach Impact Student Loan Relief?

Over 2.5 million student loan accounts were breached in the summer of 2022, according to a recent Maine Attorney General data breach notification. The target of the breach was Nelnet Servicing, a servicing system and web portal provider for the Oklahoma Student Loan Authority (OSLA) and EdFinancial. An investigation determined that intruders accessed student loan account registration information between June and July 2022. The stolen data includes names, addresses, emails, phone numbers and social security numbers for 2,501,324 student loan…

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…

Inside the Second White House Ransomware Summit

Ransomware is a growing, international threat. It's also an insidious one. The state of the art in ransomware is simple but effective. Well-organized criminal gangs hiding in safe-haven countries breach an organization, find, steal and encrypt important files. Then they present victims with the double incentive that, should they refuse to pay, their encrypted files will be both deleted and made public. In addition to hundreds of major attacks around the world, two critical ransomware incidents — the Colonial Pipeline…