Rules
Mobile app privacy problems: permission creep, contact uploads and location exposure
Diagnose mobile app privacy problems with evidence, containment and repair steps for permissions, background use, contacts, photos, location and IDs.
What to take away
- Write down what you saw and when, before you touch a setting or delete anything.
- A permission grant, a battery spike or a contacted domain is a clue, not proof of collection.
- Revoking device access does not remove copies the company already holds on its servers.
- Fix the feature, the embedded library, the notice, retention and deletion as one job.
- Re-test the same feature after the next app update, because updates reintroduce access.
Mobile privacy symptoms can come from the app, a library inside it, the operating system, your account, or another connected service. Keep the words apart: allowed, accessed, transmitted, retained and shared are five different claims. Only the last four describe something that happened to your data.
Permission creep
Symptoms: An update asks for contacts or location that the visible feature does not use. Old grants survive after the feature is removed.
Permission creep check
- Compare current feature to permission
- Read release notes for changes
- Check store label and prompt
- Review privacy notice and dashboard
- Confirm with network evidence
- Grant alone proves nothing
Check: Compare these items:
- current feature
- release notes
- store label
- prompt text
- privacy notice
- permission dashboard
- network evidence A grant alone proves nothing about use.
Repair: Deny or revoke the permission. Offer a manual or narrower alternative. Delete the obsolete code path and correct the notice. Recheck after every update.
Silent background use
Symptoms: Location reminders you did not ask for, camera or microphone indicators, persistent services, battery drain, or mobile data while the app is closed.
Record background use evidence
- Note exact time of issue
- Record app version
- Capture system indicator
- Read permission dashboard
- Log battery and data use
- Note active trip or call
Check: Record several details at the time of the issue. Record the time, app version, system indicator, and dashboard reading. Also record battery and data use. Note whether a trip or call was active.
Repair: Stop the active feature, revoke background permission, remove data or battery exceptions, and update the app. Escalate unexplained sensor access through device security support.
Contact uploads
Symptoms: People who never installed the app get invitations. Your contacts appear as recommendations. A deleted account reappears after another address-book sync.
Local match or server upload?
Do contacts appear as recommendations?
check account archive and invitation history
review address-book permission and hashing claim
Check: Separate local matching from a server upload. Review app settings, the account archive, invitation history, address-book permission, and any hashing claim.
Repair: Turn off synchronization, revoke access, delete uploaded contacts through the account, and limit future matching. Tell affected people where the context and policy require it.
Photo leakage
Symptoms: A post reveals coordinates. A screenshot exposes a code. The app holds full-library access for a one-photo task.
Photo leakage repair
- Remove or replace the post
- Revoke broad library access
- Switch to selected-photo access
- Strip metadata from future exports
- Close unneeded shared links
Check: Inspect file metadata and visible content before blaming the app. Establish whether the platform stripped coordinates, kept an original, or made a cloud copy.
Repair: Remove or replace the post, revoke broad library access, switch to selected-photo access, strip metadata from future exports, and close shared links you no longer need.
Location exposure
Symptoms: A map, post, nearby feature or shared trip reveals a home. A photo or history reveals a routine or current movement.
Check: Find the source before you delete anything. It may be a device permission, a manual place, a geotag, or account history. It may also be family sharing, an IP estimate, a wearable, a vehicle, or another person. Where stalking or abuse is involved, preserve the evidence first.
The FTC's guide to marketing a mobile app tells developers to honor privacy promises, get affirmative permission for material changes, and treat geolocation and persistent identifiers as child-privacy issues where that law applies. It supports accurate disclosure and change control, not a legal conclusion about any particular app.
Repair: Stop active sharing, change the audience, revoke location, delete retained history, and review connected devices. Use safety planning or police support where there is an immediate threat.
Advertising identifiers
Symptoms: You reset your advertising ID and expect every profile and recommendation to disappear.
Check: Separate the platform advertising ID from account IDs, installation IDs, cookies, device tokens, IP addresses and purchase records.
Repair: Apply platform tracking controls, reset or delete supported identifiers, review account ad settings, and use the opt-out or deletion routes that apply. Say plainly what remains.
Vet app changes by risk
NIST SP 800-163 on vetting mobile applications describes app security and privacy testing, permissions, vulnerabilities and authorized use in an organizational setting. Use it to structure a review after a permission or library change. It does not certify a consumer app or replace platform, legal and store-specific analysis.
Verify the repair
Repeat the exact feature with a test account and minimal permissions. Check these, in order:
- Permission dashboard and any system indicator during use.
- Network destinations the app contacts while idle.
- Account archive and the result of any deletion request.
- Store label and privacy notice against what the app now does.
Keep the before-and-after record, the owner, the app version and the unresolved limits.
Common questions
Does high battery use prove background tracking?
No. Media, navigation, poor signal, updates, synchronization and bugs all draw power. Pair the battery reading with system and app evidence before you conclude anything.
Does revoking contacts delete the uploaded address book?
No. Revoking blocks future device access only. Use the app's account control to delete contacts it already holds, and ask for written confirmation.
Is removing a photo's geotag enough?
No. Visible landmarks, text, timing, shared albums and earlier copies can still reveal location. Check who saved or reshared the image before you assume it is clean.
Does resetting an advertising ID erase an account profile?
No. Account and server-side records may key on other identifiers and need separate controls. Outcomes depend on the controller, the jurisdiction and its verification process.
