Have you ever wondered why, after talking about a trip to Turkey, they suddenly start showing you advertisements for tours to Antalya? Or how does Google Maps know where you were last night, although you did not turn on the navigator? Modern Android smartphones have become powerful tools for collecting data - and not all applications honestly tell what information they transfer to third parties.

According to research Oxford University (2026), The average Android app from the top 100 Google Play has access to 14 different types of personal user data - from geolocation to contact list and call history. Moreover, 68% of applications share this data with advertising networks and analytical platforms. In this article we will look at:

  • 🔍 Which popular applications collect the most data (spoiler: it's not just social networks)
  • 📱 How tracking mechanisms work through Android 14+ permissions
  • 🛡️ Step-by-step guide for blocking tracking without loss of functionality
  • ⚠️ Legal nuances: what the GDPR and Russian 152-FZ say about data protection

Important to understand: surveillance it happens explicit (you give permission to geolocation for maps) and hidden (the application reads your SMS to “improve the service”, although this is not related to its main function). We will focus on the second type - when data collection goes beyond what is reasonable.

📊 Have you ever checked what data your applications collect?
Yes, regularly
I tried it, but I didn’t understand anything
No, I didn’t think about it
I don’t care

1. Social networks: data collection champions

If you think that Facebook and Instagram they only track you when you log into the application, you are mistaken. The mechanism Off-Facebook Activity (enabled by default) allows Meta to track your actions on any siteswhere the Facebook pixel is installed - even if you do not have an account. For example:

  • 📌 You read an article about loans on Banks.ru → after 5 minutes you are shown targeted advertising for microloans in Instagram
  • 🛒 Added a product to the cart on Wildberries, but did not buy → an advertisement for this product haunts you for a week
  • 📍 Visited a cafe with Wi-Fi → Facebook receives your geolocation from an access point

But Meta is not the only player. TikTok in 2026, he came under investigation European Commission for collecting data about clipboard (clipboard) users every 3 seconds. And X (Twitter) after the change of owner, he began to aggressively collect browser history through the app's built-in browser - even when you are not authorized.

⚠️ Attention: Android 14 has a new permission POST_NOTIFICATIONSthat social networks actively request. In fact, it is not needed for notifications, but to collect data about your activity in other applications through Notification Listener API.
Application Types of data collected Where it is transferred Is it possible disable
Facebook Geolocation, contacts, SMS, browser history, activity in other applications Meta Ads, analytical platforms (AppsFlyer, Adjust) Partially (in the "Activity outside Facebook" settings)
TikTok Clipboard, Device IMEI, list of installed applications, sensor data ByteDance, Chinese analytical services No (without loss of functionality)
X (Twitter) Browser history, IP address, data on connected devices (Bluetooth, Wi-Fi) X Ads, Targeting partners (MoPub) Yes (disable "Ad Personalization")

2. Maps and navigators: your digital footprint

Google Maps and Yandex.Maps know more about you than you think. Even when you are not using navigation, these applications:

  • 📍 Track your location with an accuracy of 5 meters through Fused Location Provider
  • 🚗 Remember all routes, including walking and subway trips
  • 🕒 Analyze time spent in each place (home, work, cafe)
  • 📱 Read data from the accelerometer and gyroscope to determine whether you are driving or walking

In 2026 Google added a function Timelinethat creates a complete chronology of your life since 2010 (if you used Android). This data is not only used to personalize advertising, but is also sold to data aggregators like Placer.ai or SafeGraph, which analyze people flows for retailers and municipalities.

💡

To delete location history in Google Maps, go to Chronology → Settings → Delete data by date range. But keep in mind: Google retains anonymized data for another 18 months “to improve services.”

Less obvious "spies":

  • 🌍 2GIS - collects data about establishments visited and transfers them to partners (for example, banks for credit scoring)
  • 🚖 Yandex.Taxi —even if you don’t order a car, the application tracks your location to “optimize tariffs”
  • 🚶 Strava —a fitness application that publishes your running routes, revealing your residential address (this was used to track military bases)

3. Banking apps: surveillance under the guise of security

Banks justify data collection as “security concerns,” but in practice, many of them abuse trust. For example:

  • 🏦 SberBank Online requests access to SMS, contacts i geolocation, although only SMS is enough to work (to confirm payments)
  • 💳 Tinkoff analyzes your purchases in other banks through Open Banking API and uses this data for credit scoring
  • 📱 Alfa-Click collects information about installed applications to "determine creditworthiness"

Permission READ_PHONE_STATEis especially dangerous, which banks often require “to identify the device.” In fact, it allows you to:

  • Read IMEI, device serial number and SIM card information
  • Track incoming/outgoing calls (to whom and for how long you call)
  • Get data about connected networks (Wi-Fi, Bluetooth)
⚠️ Attention: Since 2026, the Bank of Russia has obliged banks to disclose what data they collect and where they transfer it. However, 70% of users (according to data ROTSIT) do not read these notifications, simply clicking “Agree”. Always check the "Privacy Policy" section before installing a banking application.

Refuse geolocation permission|Deny access to contacts|Disable collection of data about installed applications|Use a virtual card for online payments-->

4. Dating applications: intimate data for sale

Tinder, Badoo and Mamba collect not only your photos and correspondence. They analyze:

  • 💬 Communication style (what words you use, how quickly you respond)
  • 📸 What photos you like (via swipes) to build a psychological profile
  • 🕒 Activity time (when you most often access the application)
  • 📍 Places where you visit (via geolocation)

This data is sold not only to advertisers, but also data brokerswho form dossiers on users. For example, the company Grindr (an application for LGBT dating) got into a scandal in 2023 due to the transfer of data about the HIV status of users to third parties.

Permission CAMERA in such applications is especially dangerous. Many of them include a camera in the background to:

  • Analyze your emotions through facial recognition
  • Collect biometric data (for example, for verification)
  • Record video without your knowledge (this violates privacy laws in some countries)
Like apps for dating bypass Android 14 restrictions

In Android 14, Google has tightened the rules for accessing geolocation and camera. However, many applications use workarounds:

1. Request access to ACTIVITY_RECOGNITION (activity recognition) to track your movements without explicit geolocation permission.

2. They use SDK from AppsFlyer or Adjustwhich collect data about your actions in other applications through deep linking.

3. They ask permission to NOTIFICATION_LISTENER under the pretext of “notifications of new messages,” but in fact they read notifications from other messengers.

5. Games: entertainment with subtext

Mobile games are one of the most aggressive data collectors. Even a simple arcade or puzzle can:

  • 🎮 Read IMEI, Android ID and MAC address to bind to the device
  • 📱 Receive a list of all installed applications (to show competitors' advertisements)
  • 🕹️ Track how you interact with the interface (where you hold your gaze, what buttons you press more often)

Examples of the most "gluttonous" games:

Game Collected data Where it is transferred
PUBG Mobile Geolocation, contacts, call history, data sensors Tencent, Chinese analytical platforms
Candy Crush Saga List of applications, IMEI, Wi-Fi connection data King (Activision Blizzard), advertising networks
Genshin Impact Clipboard, device data, browser history miHoYo, partners in China and Singapore

The permission GET_ACCOUNTSthat many games request is especially dangerous. It allows you to:

  • Get a list of all accounts on the device (Google, mail, social networks)
  • Find out what services you use (for example, if you have an account in Netflix, you will be shown advertising for subscriptions)
  • Link your gaming activity to a real person
💡

Even if the game is free, you pay with your data. Always check permissions before installation - if a simple snake asks for access to contacts or geolocation, this is a clear sign of surveillance.

6. Utilities and “useful” applications: wolves in sheep’s clothing

It would seem that there could be something dangerous in a flashlight or weather widget? In fact, many utilities collect data more actively than social networks. Examples:

  • 🔦 Flashlight from Super-Bright LED requests access to camera, microphone i geolocation - although for work you only need a FLASHLIGHT
  • 🌡️ Weather from Weather Forecast transmits your geolocation to advertising networks accurate to your home
  • 🔋 Battery (applications to monitor charge) collect data on the use of other applications and sell them to aggregators
  • 📁 File managers (for example, ES File Explorer) scan all files on the device, including personal photos and documents

One of the most scandalous cases is the application Brightest Flashlight, which in 2022 was removed from Google Play for transferring location data of users to the company Placed (now part of Snap Inc.). At the same time, in the description of the application there was not a word about collecting geodata.

How to recognize a "spy" utility:

  • 🚩 Asks for unnecessary permissions (for example, flashlight not needed contacts)
  • 🚩 Has too many ads (which means it is monetized by selling data)
  • 🚩 Developer from China or an unknown company without a website
  • 🚩 There is no privacy policy in the description or it is written in poor English

7. How to protect yourself from surveillance: step-by-step guide

It is impossible to completely avoid surveillance on Android, but you can significantly reduce it. Here's what to do:

  1. Check application permissions

    Go to Settings → Applications → Permissions and disable everything unnecessary. For example:

    • 📍 Geolocation - leave only for maps and navigators
    • 📷 Camera/microphone - only for instant messengers and camera
    • 📞 Contacts - only for calls and SMS
  • Use alternative applications

    Replace "gluttonous" applications with safer analogues:

    Dangerous application Safe alternative
    Facebook Session (decentralized social network)
    Google Maps OsmAnd (offline maps based on OpenStreetMap)
    TikTok Lemmy or Mastodon (for a short video - PeerTube)
  • Set up an advertising ID

    Go to Settings → Google → Advertising i:

    • Disable "Personalized Ads"
    • Reset the advertising ID (this will make it difficult tracking)
    • Disable "Diagnostics and usage" in Google settings
    • Use VPN and DNS filtering

      Set NextDNS or Blokadato block trackers at the network level. A VPN with an ad blocking function will also help (for example, ProtonVPN).

    Geolocation permissions for social networks are disabled|Alternative applications without trackers are installed|Advertising ID is reset in Google settings|Tracker blocking is enabled in the browser (uBlock Origin)|Diagnostic data collection is disabled in system settings-->

    For advanced users:

    • 🛠️ Install XPrivacyLua (requires root) to block application access to personal data
    • 📱 Use GrapheneOS or CalyxOS —modified versions of Android without Google services
    • 🔒 Configure Firewall (for example, NetGuard) to block Internet access for suspicious applications

    In Russia, the collection and processing of personal data regulated:

    • 📜 152-FZ "On Personal Data" - requires the user's consent to collect data, but in practice consent is often obtained by deception (small text, pre-checked boxes)
    • 📜 374-FZ "On the Protection of Information" - obliges companies to disclose where data is transferred, but control is weak
    • 📜 Decision of Roskomnadzor of 2023 - prohibits the transfer of data of Russians abroad without localization, but many companies ignore this requirement

    Valid in Europe GDPR, which gives users more rights:

    • 🔹 The right to access their data (the company is obliged to provide a report on what information it has collected)
    • 🔹 The right to delete data ("the right to be forgotten")
    • 🔹 The right to data portability (you can request the transfer of your data to another company)

    However, in practice:

    • ❌ Most users are not aware of their rights
    • ❌ Companies hide the real amount of data collected behind complex legal terminology
    • ❌ Fines for violations (for example, 4% of the company's global income under GDPR) are often disproportionate to the profits from the sale of data
    ⚠️ Attention: Since 2026, a new law on the “sovereign Runet” has come into force in Russia, which obliges foreign companies to store the data of Russians on servers in the Russian Federation. However, many applications (for example, TikTok or Twitter) ignore this requirement. continuing to transfer data abroad. You can file a complaint with Roskomnadzor, but the process is long and not always effective.

    FAQ: Frequently asked questions about surveillance on Android

    ❓ Is it possible to completely disable surveillance on Android?

    No, it is impossible to completely disable surveillance because:

    • Android is a proprietary system from Google that collects data itself (for example, through Google Play Services)
    • Even if you disable all permissions, applications can collect data through bypasses paths (for example, traffic analysis)
    • Telecom operators and device manufacturers (Samsung, Xiaomi, etc.) also collect telemetry

    However, you can significantly reduce the amount of transmitted data - we talked about this in the "How to protect yourself" section.

    ❓ Which applications are definitely not monitoring users?

    There are no absolutely “clean” applications, but there are those that collect minimal data:

    • 📧 ProtonMail — email client with encryption and open source
    • 🗺️ OsmAnd — offline maps without tracking
    • 💬 Signal — messenger with end-to-end encryption
    • 🎵 VLC —a media player without unnecessary water and trackers
    • 📁 Simple File Manager —a file manager without access to the Internet

    Before installing, always check the application for Exodus Privacy —this service analyzes which trackers are built into APK.

    ❓ Why do applications know where I am even after disabling geolocation permission?

    There are several ways to determine location without explicit permission:

    • 📶 Cell tower data — even without GPS, the application can determine your location with an accuracy of 1–2 km using the nearest towers
    • 📡 Wi-Fi and Bluetooth —scanning nearby access points allows you to determine the location with an accuracy of 50 meters
    • 🌐 IP address —it can be used to determine the city and provider
    • 📱 Sensor data (accelerometer, gyroscope) - vibration and motion analysis can show whether you are driving or walking

    To block these methods, use:

    • 🛡️ NetGuard - blocks application access to the network
    • 📵 Airplane mode (but this will disable all communication functions)
    • 🔄 Frequent changes of IP via VPN
    ❓ Can the smartphone manufacturer (Samsung, Xiaomi, etc.) track me?

    Yes, and this is one of the most serious threats. Manufacturers install their services that:

    • 📱 Samsung - collects data through Samsung Knox, Bixby and Samsung Cloud
    • 📱 Xiaomi - transfers data about the use of the device to China (2020 scandal with Mi Browser)
    • 📱 Huawei - uses Huawei Mobile Services to collect telemetry

    What to do:

    • Disable all manufacturer services in the settings (for example, Samsung Account, Mi Cloud)
    • Install custom firmware (for example, LineageOS), if this is possible for your model
    • Use ADB to disable system applications (requires unlocking the bootloader)
    adb shell pm uninstall -k --user 0 com.samsung.android.app.reminder

    adb shell pm uninstall -k --user 0 com.miui.analytics

    ❓ What should I do if I discovered that an application is tracking me illegally?

    If you are sure that the application is collecting data without your consent:

    1. Collect evidence:
      • Screenshots of permissions in Settings → Applications
      • Traffic logs (can be obtained via NetGuard or PCAPdroid)
      • Correspondence with application support (if you asked questions about data collection)
    2. Submit a complaint:
      • 📝 B Roskomnadzor (for Russian users) via the website pd.rkn.gov.ru
      • 📝 V Google Play — click "Complain" on the application page and select "Privacy violation"
      • 📝 V European Data Protection Board (if you are an EU citizen)
  • Spread the information:
    • Write a review in Google Play with details
    • Publish a post on social networks with a hashtag #StopDataAbuse
    • Inform independent organizations like Electronic Frontier Foundation (EFF)

    Unfortunately, in most cases there will be no reaction, but mass complaints can force the company to change its policy (as happened in TikTok in 2023).