Nine out of 10 mobile health apps collect and track user data, according to a new global study. The research published in the British Medical Journal conducted in-depth analysis of more than 20,000 mobile health apps on the Google Play Store, some of which require users to disclose sensitive health information, including step and calorie counters, apps that manage health conditions, symptom checkers and menstruation trackers. Muhammad Ikram, a lecturer at the Macquarie University Cyber Security Hub, said the vast majority (88%) were using “tracking identifiers and cookies to track user activities on mobile devices, and some of these applications are actually using tracking across different platforms”. Additionally, 28% of health apps did not provide any sort of privacy statement on Google Play about what was being collected, which is against the store’s terms of service. Research found that about two-thirds could collect advertising identifiers or cookies, one-third could collect a user’s email address, and about a quarter could identify the mobile phone tower to which a user’s device was connected, potentially providing information on the user’s location. But only 4% of mobile health apps actually transmitted data to a third party – usually a user’s name and location information. Ikram said: “Some of this information collected is used for tracking purposes and profiling purposes, which is done by third parties like advertisers and tracking companies and which is basically a form of data mining and this is done without user consent and it is being done explicitly and implicitly.” A Google spokesperson said in response that developers should request permission from users for the use of their data. “Our Google Play Developer Policies are designed to protect users and keep them safe. When violations are found, we take action. We are reviewing the report.” The report also commended the European General Data Protection Regulation, “which has improved transparency around apps’ data collection and sharing practices and requires specific measures to ensure active consent to data sharing”. In comparison, Ikram said Australia lacked clear privacy policies for mobile health applications. “There is no such privacy regulation as such that we have in Australia that can be used, but I think some of these GDPR policies can be used potentially used in Australia to protect the privacy of Australian users,” he said. Despite these statistics, researchers also found only 1.3% (3,609) of user reviews raised concerns about privacy. Ikram said users should “look at their privacy policy link available on Google Play. If the app does have a policy link on Google Play, then they should use it, otherwise they should avoid installing those applications. Similarly, the users should also look into how these applications would be sharing the data and to whom they would be sharing the data so that they can have a general sense of what sort of privacy risks exist.”