{"id":14537,"date":"2025-07-22T03:45:10","date_gmt":"2025-07-22T03:45:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/14537\/"},"modified":"2025-07-22T03:45:10","modified_gmt":"2025-07-22T03:45:10","slug":"the-popular-apps-that-are-spying-on-you-cybersecurity-experts-issue-urgent-warning-over-data-hungry-apps-that-can-access-your-location-microphone-and-data","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/14537\/","title":{"rendered":"The popular apps that are SPYING on you: Cybersecurity experts issue urgent warning over ‘data hungry’ apps that can access your location, microphone and data"},"content":{"rendered":"

They’re some of the biggest apps in the world, used by hundreds of millions of people every day.\u00a0<\/p>\n

But according to a new investigation, ‘data hungry’ smartphone apps like\u00a0Facebook<\/a> and Instagram<\/a> ask for ‘shocking’ levels of access to your personal data.<\/p>\n

Experts at consumer champion\u00a0Which? investigated 20 popular apps across social media, online shopping, fitness and smart home categories.\u00a0<\/p>\n

They found all of them ask for ‘risky’ permissions such as access to your location, microphone, and files on your device \u2013 even when they don’t need to.\u00a0<\/p>\n

The experts urge people to be more careful about what exactly we agree to when we download an app and mindlessly agree to permissions.\u00a0<\/p>\n

We could be compromising our privacy when we hastily tap ‘agree’.\u00a0<\/p>\n

‘Millions of us rely on apps each day to help with everything from keeping on top of our health and fitness to doing online shopping,’ said Harry Rose, editor of Which?<\/p>\n

‘While many of these apps appear to be free to use, our research has shown how users are in fact paying with their data \u2013 often in scarily vast quantities.’\u00a0\u00a0<\/p>\n

\"Among <\/p>\n

Among social media apps, Facebook, owned by Meta, was arguably the most keen for user data – it wanted the highest number of permissions (69 in total, of which 6 are considered ‘risky’<\/p>\n

\"WhatsApp, <\/p>\n

WhatsApp, also owned by Meta, wanted 66 permissions in total, six of which are considered risky)<\/p>\n

Which? researchers worked with experts at cybersecurity firm Hexiosec to assess the privacy and security features of 20 popular apps on an Android handset.\u00a0<\/p>\n

The list included some of the biggest names in social media (including WhatsApp, Facebook, Instagram, TikTok), online shopping (Amazon, AliExpress) the smart home (Samsung Smart Things,\u00a0Ring Doorbell) and fitness (Strava).\u00a0<\/p>\n

Combined, the 20 apps have been downloaded over 28 billion times worldwide \u2013 meaning the average UK adult is likely to have several of them on their phone at any given time.\u00a0<\/p>\n

If someone were to have all 20 downloaded on their device, collectively they would grant a staggering 882 permissions \u2013 potentially giving access to huge amounts of an individual\u2019s personal data.<\/p>\n

Overall, the team found Chinese app Xiaomi Home asked for a total of 91 permissions \u2013 more than any other app in the study \u2013 five of which are described as ‘risky’.\u00a0<\/p>\n

Risky permissions include\u00a0those that access your microphone, can read files on your device, or see your precise location (usually referred to as ‘fine location’).\u00a0<\/p>\n

Such data is a valuable commodity and may allow firms to target users with ‘uncannily accurate adverts’.\u00a0<\/p>\n

Samsung’s Smart Things app asked for 82 permissions (of which eight are risky), followed by Facebook (69 permissions, six risky) and WhatsApp (66 permissions, six risky).\u00a0<\/p>\n

\"Meta's <\/p>\n

Meta’s photo-sharing app Instagram asked for a total of\u00a056 permissions, of which four are considered ‘risky’\u00a0<\/p>\n

\"Overall, <\/p>\n

Overall, Xiaomi asked for a total of 91 permissions – more than any other app in the study – five of which described as ‘risky’<\/p>\n

How to improve your app privacy\u00a0\u00a0 Check privacy information: Review any data collection information on the app store listing, including the permissions an app will requestRead the privacy policy: You can find it either on the app store listing or company\u2019s website. If you don\u2019t want to read the whole thing then focus on the sections on data collection and sharingLimit or revoke permissions: In Apple iOS and Google Android, you can control what apps can access your data (tap Settings, and then Apps and Permissions to see what each app can access)Delete: If you aren\u2019t sure about an app, delete it – and make sure all your account data is deleted, too <!- – ad: https:\/\/mads.dailymail.co.uk\/v8\/us\/sciencetech\/none\/article\/other\/mpu_factbox.html?id=mpu_factbox_1 – -><\/p>\n

Advertisement<\/p>\n

Xiaomi Home was also one of two apps (alongside AliExpress) to send data to China, including to suspected advertising networks \u2013 although this was flagged in the privacy policy by both.<\/p>\n

Ali Express requested six risky permissions such as precise location, access to microphones and reading files on the device.\u00a0<\/p>\n

AliExpress also bombarded users with a deluge of marketing emails after download (30 over the course of a month) but the\u00a0researchers did not see any specific permission request from AliExpress to do so.\u00a0<\/p>\n

Temu, another Chinese-owned online marketplace, also gave a heavy push to sign up to email marketing \u2013 which many users could easily agree to without realising, the experts reasoned.\u00a0<\/p>\n

Among social media apps, Facebook was ‘the most keen for user data’ as it wanted the highest number of permissions (69 in total, six of which risky), followed by WhatsApp (66 altogether, six of which risky).\u00a0<\/p>\n

TikTok, meanwhile, asked for 41 permissions, including three risky ones, including the ability to record audio and view files on the device, while\u00a0YouTube asked for 47 permissions, four of which were ‘risky’.\u00a0<\/p>\n

Overall, 16 of the 20 apps requested a permission that allows apps to create windows on top of other apps \u2013 effectively creating pop-ups on your phone, even if you opted out of the app sending notifications.<\/p>\n

Seven also wanted a permission that allows an app to start operating when you open your phone even if you haven’t yet interacted with it.\u00a0<\/p>\n

\"AliExpress <\/p>\n

AliExpress was also one of two apps (alongside smart device app Xiaomi) to send data to China, including to suspected advertising networks<\/p>\n

In some cases there are clear uses for risky permissions \u2013 for example the likes of WhatsApp or Ring Doorbell may need microphone access in order to carry out certain functions.<\/p>\n

But other examples the need for risky permissions was less clear cut, according to Which?<\/p>\n

For example, four apps \u2013 AliExpress, Facebook, WhatsApp and Strava \u2013 requested permission to see what other apps recently used or currently running.<\/p>\n

The researchers stress that the investigation was conducted on an Android phone and that permissions may vary on Apple iOS devices.\u00a0<\/p>\n

But we should all be more careful of tapping “yes” to permissions while mentally on ‘autopilot’ without really being aware of what we’re agreeing to, Mr Rose said.\u00a0<\/p>\n

‘Our research underscores why it\u2019s so important to check what you\u2019re agreeing to when you download a new app,’ he added.\u00a0<\/p>\n

The full findings can be read on the Which? website<\/a>.\u00a0<\/p>\n

In response to the findings,\u00a0Meta (which owns WhatsApp, Facebook and Instagram) said none of its apps ‘run the microphone in the background or have any access to it without user involvement’.\u00a0<\/p>\n

\"Samsung's <\/p>\n

Samsung’s Smart Things app asked for 82 permissions (of which eight were risky), followed by Facebook (69 permissions, six risky) and WhatsApp (66 permissions, six risky)<\/p>\n

Meta also said that users must \u2018explicitly approve\u2019 in their operating system for the app to access the microphone for the first time.\u00a0<\/p>\n

A Samsung spokesperson said: ‘All our apps, including SmartThings, are designed to comply with UK data protection laws and relevant guidance from the Information Commissioner’s Office (ICO).’\u00a0<\/p>\n

Meanwhile, TikTok said that privacy and security are ‘built into every product’ it makes. It added: TikTok ‘collects information that users choose to provide, along with data that supports things like app functionality, security, and overall user experience’.\u00a0<\/p>\n

Strava said that risky permission it takes, such as precise location, allow it to ‘provide the very service that our users are requesting’. It said that it has ‘implemented appropriate guardrails\u2019 around how data is \u2018collected, shared, processed, and used’.\u00a0<\/p>\n

Amazon said that device permissions are to provide ‘helpful features’, such as ‘the ability to visualise products in their home with their device\u2019s camera or search for products using text-to-speech’. It added: ‘We also give customers clear control over personalised advertising by requesting consent when they visit our UK store and providing options to opt out or adjust preferences at any time.’\u00a0<\/p>\n

AliExpress claimed that the precise location permission is not used in the UK, and the microphone permission requires user consent. It added: ‘We strive to create a platform where consumers can shop with confidence, knowing that their data is safeguarded in accordance with the law and our strict privacy policy. We welcome the findings from Which? as an opportunity to redouble our efforts in this area.’\u00a0<\/p>\n

Ring said that it doesn\u2019t ‘use cookies or trackers on the Ring app for advertising’ and all permission as used to ‘provide user-facing features’. It added: ‘We design our products and services to protect our customers\u2019 privacy and security, and to put our customers in control of their experience. We never sell their personal data, and we never stop working to keep their information safe.’\u00a0<\/p>\n

A Temu spokesperson said precise location permission is \u2018used to support completing an address based on GPS location\u2019 but it is not used in the UK market, adding that it ‘handles user data in accordance with local and international regulations and in line with leading industry practices’.<\/p>\n

Google (representing YouTube), Xiaomi, Impulse and MyFitnessPal did not respond to requests for comment.\u00a0<\/p>\n

Total permissions by app\u00a0 <\/p>\n

APP NAME\u00a0<\/p>\n

Bosch Home Connect<\/p>\n

Ali Express\u00a0<\/p>\n

Amazon\u00a0<\/p>\n

Calm\u00a0<\/p>\n

Facebook\u00a0<\/p>\n

Flo\u00a0<\/p>\n

Instagram\u00a0<\/p>\n

MyFitnessPal\u00a0<\/p>\n

Ring Doorbell\u00a0<\/p>\n

Samsung Smart Things<\/p>\n

Shein\u00a0<\/p>\n

Strava\u00a0<\/p>\n

Temu\u00a0<\/p>\n

TikTok\u00a0<\/p>\n

Tuya<\/p>\n

WhatsApp\u00a0<\/p>\n

Vinted\u00a0<\/p>\n

YouTube\u00a0<\/p>\n

Xiaomi\u00a0<\/p>\n

Impulse\u00a0<\/p>\n

\u00a0TOTAL PERMISSIONS<\/p>\n

22<\/p>\n

50<\/p>\n

48<\/p>\n

23<\/p>\n

69<\/p>\n

45<\/p>\n

56<\/p>\n

34<\/p>\n

37<\/p>\n

82<\/p>\n

27<\/p>\n

38<\/p>\n

12<\/p>\n

41<\/p>\n

48<\/p>\n

66<\/p>\n

25<\/p>\n

47<\/p>\n

91<\/p>\n

21<\/p>\n

\u00a0RISKY\u00a0PERMISSIONS<\/p>\n

2<\/p>\n

6<\/p>\n

4<\/p>\n

2<\/p>\n

6<\/p>\n

1<\/p>\n

4<\/p>\n

3<\/p>\n

5<\/p>\n

8<\/p>\n

4<\/p>\n

5<\/p>\n

2<\/p>\n

3<\/p>\n

5<\/p>\n

6<\/p>\n

2<\/p>\n

4<\/p>\n

5<\/p>\n

1\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"They’re some of the biggest apps in the world, used by hundreds of millions of people every day.\u00a0…\n","protected":false},"author":2,"featured_media":14538,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[97,59,124,86,56,54,55],"class_list":{"0":"post-14537","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-dailymail","9":"tag-gb","10":"tag-sciencetech","11":"tag-technology","12":"tag-uk","13":"tag-united-kingdom","14":"tag-unitedkingdom"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/14537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=14537"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/14537\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/14538"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=14537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=14537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=14537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}