Mobile health apps collect sensitive data often without proper consent
Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps
Human-Computer InteractionCryptography and SecurityComputers and Society
Summary
Mobile health apps often gather personal information, like location or microphone data, which they don’t explain or need based on their app description. The authors studied over 10,000 such apps and found most don’t provide users with proper consent forms, ignoring important privacy laws. This means many health apps might be collecting sensitive data without clearly telling users or asking for permission.
What this means in practice
- •For mobile app developers: Identify and avoid requesting unnecessary permissions in health apps to comply with privacy regulations and improve user trust.
- •For privacy compliance teams: Use the paper’s measurement framework to audit health apps’ permissions and consent practices for regulatory compliance monitoring.
Authors
Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Joel Reardon, Indrakshi Ray
Abstract
Mobile health (mHealth) apps collect personally-identifiable information while handling uniquely sensitive medical data, ranging from mental health records to real-time glucose or heart rate monitoring -- yet they remain poorly understood at scale. We present the first comprehensive analysis of consent and data collection practices across 10,000+ mHealth apps on the Google Play Store, combining static analysis and privacy policy examination. We develop a rigorous operational definition to distinguish health apps from general wellness programs, and design a measurement framework to detect misuse of permissions and violations of consent. Our analyses reveal a troubling ecosystem: 69.15% of apps request at least one permission unrelated to their stated purpose, with over 52.9% apps requesting location data, and 50.5% and 34.9% apps requesting camera and microphone access, respectively -- despite no functional justification based on app descriptions and stated purposes. Most alarmingly, nearly 93% of apps fail to provide users with a consent form, directly violating regulatory requirements such as GDPR; and even among the remaining 7%, 1 in 14 demonstrate a gap between the obtained consent and collection of personally identifiable information. These findings demonstrate an urgent need for stronger enforcement of privacy regulations in mHealth apps. We plan to release our dataset and measurement tools for continued monitoring of this critical space.