Study of 10,000+ mHealth apps finds consent and permission failures
Original title: Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps
About 93% lacked a consent form, and 69.15% requested at least one permission unrelated to the stated purpose.
A measurement study of more than 10,000 Google Play mobile health apps combines static analysis with privacy-policy review. The authors separate health apps from general wellness programs and look for permission misuse and consent gaps. They report frequent requests for location, camera, and microphone access without a stated functional need, and say missing consent forms violate requirements such as GDPR. They plan to release the dataset and tools.
Unconfirmed: Figures come from the authors' measurement study; the dataset and tools are not yet released.
- Over 52.9% of the studied apps requested location data.
- Camera access was requested by 50.5% and microphone access by 34.9%.
- Among the 7% with a consent form, 1 in 14 had a gap with PII collection.
- Covered data includes mental health records, glucose readings, and heart rate.
- Vendors
- Products
- Google Play Store
From the original article
1 min read at arxiv.orgMobile health (mHealth) apps collect personally-identifiable information while handling uniquely sensitive medical data, ranging from mental health records to real-time glucose or heart rate monitoring -- yet they remain poorly understood at scale.
By Ethan Myers · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.