You wake up in the morning and, first thing, you open your weather app. You close that pesky ad that opens first and check the forecast. You like your weather app, which shows hourly weather forecasts for your location. And the app is free!
But do you know why it’s free? Look at the app’s privacy settings. You help keep it free by allowing it to collect your information, including:
- What devices you use and their IP and Media Access Control addresses.
- Information you provide when signing up, such as your name, email address and home address.
- App settings, such as whether you choose Celsius or Fahrenheit.
- Your interactions with the app, including what content you view and what ads you click.
- Inferences based on your interactions with the app.
- Your location at a given time, including, depending on your settings, continuous tracking.
- What websites or apps that you interact with after you use the weather app.
- Information you give to ad vendors.
- Information gleaned by analytics vendors that analyse and optimise the app.
This type of data collection is standard fare. The app company can use this to customise ads and content. The more customised and personalised an ad is, the more money it generates for the app owner. The owner might also sell your data to other companies.
You might also check a social media account like Instagram. The subtle price that you pay is, again, your data. Many “free” mobile apps gather information about you as you interact with them.
As an associate professor of electrical and computer engineering and a doctoral student in computer science, we follow the ways software collects information about people. Your data allows companies to learn about your habits and exploit them.
It’s no secret that social media and mobile applications collect information about you. Meta’s business model depends on it. The company, which operates Facebook, Instagram and WhatsApp, is worth US$1.48 trillion. Just under 98% of its profits come from advertising, which leverages user data from more than 7 billion monthly users.
What your data is worth
Before mobile phones gained apps and social media became ubiquitous, companies conducted large-scale demographic surveys to assess how well a product performed and to get information about the best places to sell it. They used the information to create coarsely targeted ads that they placed on billboards, print ads and TV spots.
Mobile apps and social media platforms now let companies gather much more fine-grained information about people at a lower cost. Through apps and social media, people willingly trade personal information for convenience. In 2007 – a year after the introduction of targeted ads – Facebook made over $153 million, triple the previous year’s revenue. In the past 17 years, that number has increased by more than 1,000 times.
Five ways to leave your data
App and social media companies collect your data in many ways. Meta is a representative case. The company’s privacy policy highlights five ways it gathers your data:
First, it collects the profile information you fill in. Second, it collects the actions you take on its social media platforms. Third, it collects the people you follow and friends. Fourth, it keeps track of each phone, tablet and computer you use to access its platforms. And fifth, it collects information about how you interact with apps that corporate partners connect to its platforms. Many apps and social media platforms follow similar privacy practices.
Your data and activity
When you create an account on an app or social media platform, you provide the company that owns it with information like your age, birth date, identified sex, location and workplace. In the early years of Facebook, selling profile information to advertisers was that company’s main source of revenue. This information is valuable because it allows advertisers to target specific demographics like age, identified gender and location.
And once you start using an app or social media platform, the company behind it can collect data about how you use the app or social media. Social media keeps you engaged as you interact with other people’s posts by liking, commenting or sharing them. Meanwhile, the social media company gains information about what content you view and how you communicate with other people.
Advertisers can find out how much time you spent reading a Facebook post or that you spent a few more seconds on a particular TikTok video. This activity information tells advertisers about your interests. Modern algorithms can quickly pick up subtleties and automatically change the content to engage you in a sponsored post, a targeted advertisement or general content.
Your devices and applications
Companies can also note what devices, including mobile phones, tablets and computers, you use to access their apps and social media platforms. This shows advertisers your brand loyalty, how old your devices are and how much they’re worth.
Because mobile devices travel with you, they have access to information about where you’re going, what you’re doing and who you’re near. In a lawsuit against Kochava Inc., the Federal Trade Commission called out the company for selling customer geolocation data in August 2022, shortly after Roe v Wade was overruled. The company’s customers, including people who had abortions after the ruling was overturned, often didn’t know that data tracking their movements was being collected, according to the commission. The FTC alleged that the data could be used to identify households.
Kochava has denied the FTC’s allegations.
Information that apps can gain from your mobile devices includes anything you have given an app permission to have, such as your location, who you have in your contact list or photos in your gallery.
If you give an app permission to see where you are while the app is running, for instance, the platform can access your location anytime the app is running. Providing access to contacts may provide an app with the phone numbers, names and emails of all the people that you know.
Cross-application data collection
Companies can also gain information about what you do across different apps by acquiring information collected by other apps and platforms.
This is common with social media companies. This allows companies to, for example, show you ads based on what you like or recently looked at on other apps. If you’ve searched for something on Amazon and then noticed an ad for it on Instagram, it’s probably because Amazon shared that information with Instagram.
This combined data collection has made targeted advertising so accurate that people have reported that they feel like their devices are listening to them.
Companies, including Google, Meta, X, TikTok and Snapchat, can build detailed user profiles based on collected information from all the apps and social media platforms you use. They use the profiles to show you ads and posts that match your interests to keep you engaged. They also sell the profile information to advertisers.
Meanwhile, researchers have found that Meta and Yandex, a Russian search engine, have overcome controls in mobile operating system software that ordinarily keep people’s web-browsing data anonymous. Each company puts code on its webpages that uses local IPs to pass a person’s browsing history, which is supposed to remain private, to mobile apps installed on that person’s phone, de-anonymising the data. Yandex has been conducting this tracking since 2017, while Meta began in September 2024, according to the researchers.
What you can do about it
If you use apps that collect your data in some way, including those that give you directions, track your workouts or help you contact someone, or if you use social media platforms, your privacy is at risk.
Aside from entirely abandoning modern technology, there are several steps you can take to limit access – at least in part – to your private information.
Read the privacy policy of each app or social media platform you use. Although privacy policy documents can be long, tedious and sometimes hard to read, they explain how social media platforms collect, process, store and share your data.
Check a policy by making sure it can answer three questions: what data does the app collect, how does it collect the data, and what is the data used for. If you can’t answer all three questions by reading the policy, or if any of the answers don’t sit well with you, consider skipping the app until there’s a change in its data practices.
Remove unnecessary permissions from mobile apps to limit the amount of information that applications can gather from you.
Be aware of the privacy settings that might be offered by the apps or social media platforms you use, including any setting that allows your personal data to affect your experience or shares information about you with other users or applications.
These privacy settings can give you some control. We recommend that you disable “off-app activity” and “personalisation” settings. “Off-app activity” allows an app to record which other apps are installed on your phone and what you do on them. Personalisation settings allow an app to use your data to tailor what it shows you, including advertisements.
Review and update these settings regularly because permissions sometimes change when apps or your phone update. App updates may also add new features that can collect your data. Phone updates may also give apps new ways to collect your data or add new ways to preserve your privacy.
Use private browser windows or reputable virtual private networks software, commonly referred to as VPNs, when using apps that connect to the internet and social media platforms. Private browsers don’t store any account information, which limits the information that can be collected. VPNs change the IP address of your machine so that apps and platforms can’t discover your location.
Finally, ask yourself whether you really need every app that’s on your phone. And when using social media, consider how much information you want to reveal about yourself in liking and commenting on posts, sharing updates about your life, revealing locations you visited and following celebrities you like.
- is an Associate Professor of Electrical and Computer Engineering, University of Wisconsin-Madison
- is a PhD Student in Computer Science, University of Wisconsin-Madison
- This article first appeared in The Conversation
