Study: Spotify app shares most data with third parties
January 4, 2024
In a study of 100 popular apps, research from cybersecurity company Surfshark highlights entertainment apps, particularly Spotify and SoundCloud, share data with third parties the most, while YouTube collects significant amounts of user data.
Out of the 10 analysed entertainment apps, almost half track some of the data points collected across platforms. Research is aided by a free App privacy checker tool where users can select the specific apps they have on their phone and receive a report on the extent of data collection.
“Analysing 100 popular apps on the App Store, we’ve found a concerning trend: nearly 20 per cent of collected data is used for tracking. Such tracked data can be shared with third-party advertisers or data brokers, who use it to deliver personalised ads targeting the users, or aid companies in market research,” said Agneska Sablovskaja, Lead Researcher at Surfshark. “Understanding an app’s privacy policy is crucial for safeguarding digital autonomy.”
Entertainment apps collect an average number of data points
On average, travel and mobility apps collect 15 out of 32 possible data points. That is the same as the average: 15 collected data points across all 100 examined apps. Moreover, these apps link 94 per cent of collected data points to the user’s identity. Also, 4 out of 10 such apps use collected data points to track users across third-party platforms (Spotify, Soundcloud, Audible and Wattpad).
YouTube could be named the most data-hungry app within the entertainment apps category, collecting 25 out of 32 data points respectively, and linking all data points to the user’s identity, although they don’t use data to track their users across third-party advertising networks.
Spotify and SoundCloud are apps that share the most data points with third parties. Six data points collected by Spotify are used to track the user, like email address, phone number, product interaction and advertising data. Soundcloud is second when it comes to user tracking, tracking five data points across third-party platforms. Its competitor, Amazon Music, tracks zero data points out of 16 collected.
Out of the 10 analysed travel and mobility apps, Libby collects the least data points (3) and doesn’t track users across third-party advertising platforms. Ten popular analysed travel and mobility apps were YouTube, Spotify, Amazon Music, SoundCloud, Shazam, Audible, Amazon Kindle, Goodreads, Wattpad and Libby.
Around half of analysed apps collect search history and precise location
Some 1,523 data points are collected across 100 of the most popular apps. Statistically speaking, that’s an average of 15 unique data points per app out of the 32 unique data points defined by Apple. Around 90 per cent of the apps collect usage, diagnostic, and identifier data such as product interaction, user ID, device ID, crash, and performance data. Most are essential for their app functionality.
Two-thirds of the apps collect name and coarse location, and nearly half collect precise location. Coarse location is a more general estimation of where users are, while precise location is more detailed and accurate. Over a third of the apps collect contacts, and a fifth collect emails or text messages and browsing history.
Facebook and Instagram are the two most privacy-invasive apps. Both apps collect all 32 data points defined by Apple and are the only two to do so. Signal is also the only social media and messaging app to make the top ten most privacy-sensitive list. It is the second least data-hungry app, collecting just one data point (phone number) that is not linked to the user or used to track them.